JP2003030138A - Internet connection system, managing sever device, internet connecting method, and program making computer implement the method - Google Patents

Abstract

PROBLEM TO BE SOLVED: To provide safe Internet connection service for a user who does not have security knowledge without introducing implements and materials such as a firewall into individual users. SOLUTION: An information terminal device 200 is connected to an ISP(Internet service provider) network 600 through a RAS(remote access server) 400. RAS 400 receives a connection request from the information terminal device 200 of a user and relays data to the ISP network 600. The ISP network 600 includes an authentication server device 300 which checks a user ID and a password and a managing server device 100 which manages information on contracting users. The managing server device 100 stores user information on application kinds, data directions, etc., that the user applied when making a contract.

Description

Detailed Description of the Invention

[0001]

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to an internet connection system, a management server device, an internet connection method, and a program for causing a computer to execute the method, which can improve user safety.

[0002]

2. Description of the Related Art With the spread of the Internet, the number of users who use network services from companies and homes is increasing. In recent years, ADSL (Asynchronou
s Digital Subscriber Lin
e), with the development of high-speed, broadband network technology such as optical fiber, the usage pattern of users has changed from dial-up connection, which is connected only when using the Internet, to permanent connection.

Here, when the Internet is always used, the address to be used is fixed.
There is a problem that the risk of unauthorized access from the Internet by a malicious user (cracker) becomes higher than that of a dial-up connection in which the assigned address changes each time the connection is made. Therefore, users often introduce devices such as firewalls to deal with unauthorized access.

FIG. 10 shows a document "OPEN DESIGN".
No. 14 ", page 8 (CQ publisher ISBN 4-7898
-1808-3) is a network configuration diagram to which a firewall described in (1808-3) is connected.

In FIG. 10, the organizational network 63
Is a plurality of internal networks 1, 2, 3 (60, 6).
1, 62). The organizational network 63 is
It is connected to the Internet 65 via the router 64. The router 64 operates as a firewall by limiting the connecting portion from the organizational network 63 to the Internet 65 to one place and filtering the data passing therethrough, thereby maintaining the safety of the organizational network 63.

[0006] Here, a general case of connecting to the Internet from home will be described as an example.
7 is an ISP (Internet Service P) that provides an Internet connection service using a modem.
dialer 66 to connect to the Internet 65.

[0007]

However, in such a case, in most cases, the home terminal 67 does not have a firewall for filtering, and all communication data between the Internet 65 and the user terminal 67 is not available. Will be allowed. Therefore, there is a possibility of unauthorized access from the Internet 65 to the terminal 67 and inadvertent data leakage from the terminal 67 to the Internet 65. Therefore, the above-mentioned conventional method has a problem that it is necessary to install a firewall for each user in order to prevent unauthorized access.

[0008] Further, since the user may erroneously set the rules of the installed firewall, the security may be deteriorated. Therefore, there is a problem that the user is required to have a high level of knowledge about networks and security when installing the firewall. is there.

The present invention has been made in view of the above,
An internet connection system, management server device, internet connection method, and method that can provide a safe internet connection service to users who do not have security knowledge without introducing equipment such as a firewall to each computer. The purpose is to get a program to let you.

[0010]

In order to achieve the above object, an internet connection system according to the present invention is
In an internet connection system for connecting a user's information terminal device to the internet, application type information relating to the type of application permitted by the user and data direction information relating to the direction of data permitted to be transmitted and received by the user are registered. Contract registration means, issuing means for issuing a user ID and password to the user, and when the user connects to the Internet, receives the user ID and the password from the information terminal device of the user. An authentication unit that authenticates whether the user ID and the password have been issued to the user by the issuing unit; and, if authenticated by the authentication unit, the information terminal device of the user. To IP
An IP assigning unit that assigns an address, and a condition determining unit that determines whether or not the data transmitted and received by the user matches the application type information and the data direction information registered by the contract registration unit,
It is characterized in that transmission / reception is permitted for the data determined to match by the condition determination means.

According to the present invention, the application type information relating to the type of application the user is permitted to use and the data direction information relating to the direction of the data the user is allowed to send and receive are registered, and the user ID and password are given to the user. Is issued, and when the user connects to the Internet, the user ID and password are received from the user's information terminal device, and it is authenticated whether the user ID and password have been issued to the user. In the case of data, an IP address is assigned to the user's information terminal device, it is determined whether the data transmitted / received by the user matches the registered application type information and data direction information, and the data determined to match About sending and receiving about Without introducing equipment such as Le, it is possible to provide a secure Internet connection services to users without security knowledge. That is,
By pre-registering the application type and data direction to be used by the user in the ISP or the like, the possibility of unauthorized access from the Internet to the user's information terminal device and the possibility of inadvertent data leakage from the information terminal device to the Internet are reduced. be able to.

In the internet connection system according to the next invention, in the above invention, when the user disconnects from the internet, the IP address assigned by the IP assigning means is invalidated.
It is characterized by further comprising P address invalidating means.

According to the present invention, when the user disconnects from the Internet, the IP address assigned by the IP assigning means is invalidated, so that the user information set in the ISP or the like can be deleted. become able to.

The internet connection system according to the next invention is characterized in that, in the above invention, it further comprises contract changing means for changing the application type information and the data direction information registered by the contract registration means. .

According to the present invention, since the registered application type information and data direction information are changed,
The user can change the applications permitted to use and the data direction at any time.

In the internet connection system according to the next invention, in the above invention, a warning message is sent to the information terminal device of the user transmitting and receiving the data when the condition determining means determines that the data does not match. Is further provided with a warning message transmitting means for transmitting.

According to the present invention, when it is determined by the condition determination that they do not match, a warning message is sent to the information terminal device of the user who sends and receives data, so that the rejected application, data direction, etc. The user can be notified.

The internet connection system according to the next invention is the above invention, wherein the contract registration means is
Rejection application type information relating to the type of application the user refuses to use, and rejection data direction information relating to the direction of the data the user refuses to send and receive are further registered, and the condition determining means is the above It is determined whether the data matches the rejection application type information and the rejection data direction information registered by the contract registration means, and the condition determination means matches the rejection application type information and the rejection data direction information. If so, the data is discarded.

According to the present invention, the rejected application type information regarding the type of application the user refuses to use, and the rejected data direction information regarding the direction of the data that the user refuses to send and receive are further registered, and the data sent and received by the user is registered. Is determined to match the registered rejection application type information and rejection data direction information, and if it is determined to match the rejection application type information and rejection data direction information by the condition determination, the data is discarded. The user can register in advance an ISP or the like with an application that refuses to use and a data direction that refuses to send and receive data.

In the internet connection system according to the next invention, in the above invention, the contract changing means is:
Type changing means for mutually changing the registered application type information and the rejected application type information, and direction changing means for mutually changing the registered data direction information and the rejected data direction information And is further provided.

According to the present invention, the registered application type information and the rejected application type information can be mutually changed, and the registered data direction information and the rejected data direction information can be mutually changed. Will be able to flexibly select applications or data directions to allow or deny use.

A management server device of an internet connection system according to the next invention is an information terminal of the user, which is constructed by communicably connecting an authentication server for authenticating the user and a relay device connected to the internet. In a management server device of an internet connection system for connecting a device to the internet, application type information regarding a type of an application permitted by the user and data direction information regarding a data direction permitted by the user for transmission and reception are registered. A contract registration means, an issuing means for issuing a user ID and a password to the user, and an IP address for the user who has been authenticated with the user ID and the password by the authentication server and assigned an IP address.
A user information storage unit that stores an address, the application type information, and the data direction information in association with each other, the IP address stored by the user information storage unit, the application type information, and the data direction information. And a user information transmitting means for transmitting to the relay device, in the relay device, it is determined whether the data transmitted and received by the user matches the application type information and the data direction information, It is characterized in that transmission and reception are permitted for the data determined to match.

According to the present invention, application type information relating to the type of application the user is permitted to use and data direction information relating to the direction of data the user is permitted to send and receive are registered, and the user ID and password are given to the user. Is issued, the user ID and password are authenticated by the authentication server, and the IP address is assigned to the user who is assigned the IP address,
Data that stores application type information and data direction information in association with each other, transmits the stored IP address, application type information, and data direction information to the relay device, and the user transmits and receives data in the relay device. Determines whether or not the application type information and the data direction information match, and allows transmission / reception of the data determined to match, so users without security knowledge can install it without installing equipment such as a firewall for each user. It is possible to provide a secure internet connection service. That is, the user registers the application type to be used and the data direction in the ISP or the like in advance to prevent the unauthorized access from the Internet to the user's information terminal device and the possibility of inadvertent data leakage from the information terminal device to the Internet. Can be lowered.

The management server device of the internet connection system according to the next invention is an IP server which invalidates the assigned IP address when the user disconnects from the internet in the above invention.
It is characterized by further comprising address invalidation means.

According to the present invention, when the user disconnects from the Internet, the assigned IP
Since the address is invalidated, the user information set in the ISP or the like can be deleted.

The management server device of the Internet connection system according to the next invention further comprises contract changing means for changing the application type information and the data direction information registered by the contract registering means in the above invention. Characterize.

According to the present invention, since the registered application type information and the data direction information are changed, the user can change the application or data direction permitted to be used at any time.

In the management server device of the internet connection system according to the next invention, in the above invention, the contract registration means is rejected application type information regarding an application type that the user refuses to use, and the user transmits and receives. Refusal data direction information regarding the direction of the data to be rejected is further registered, and the user information storage means further stores the IP address of the user, the rejection application type information, and the rejection data direction information in association with each other. Then, the user information transmitting means further transmits the IP address of the user, the rejection application type information, and the rejection data direction information to the relay device, and the user transmits and receives in the relay device. The data is the rejection application It determines whether to meet the emission type information and the reject data direction information, when it is determined that the matching is characterized in that discards the data.

According to the present invention, the rejected application type information regarding the type of application the user refuses to use, and the rejected data direction information regarding the direction of the data that the user refuses to send and receive are further registered, and the data sent and received by the user is registered. Is determined to match the registered rejection application type information and rejection data direction information, and if it is determined to match the rejection application type information and rejection data direction information by the condition determination, the data is discarded. The user can register in advance an ISP or the like with an application that refuses to use and a data direction that refuses to send and receive data.

A management server device of an internet connection system according to the next invention is the management server device according to the above invention, wherein the contract changing means is capable of mutually changing the registered application type information and rejected application type information. It is characterized by further comprising a changing means and a direction changing means for mutually changing the registered data direction information and the rejected data direction information.

According to the present invention, the registered application type information and the rejected application type information can be mutually changed, and the registered data direction information and the rejected data direction information can be mutually changed. Will be able to flexibly select applications or data directions to allow or deny use.

In order to achieve the above object, the internet connection method according to the present invention is an internet connection method executed by using an internet connection system for connecting a user's information terminal device to the internet. A contract registration step of registering application type information regarding the type of application permitted, and data direction information regarding the direction of data that the user permits transmission and reception; and an issuing step of issuing a user ID and password to the user.
Whether the user receives the user ID and the password from the information terminal device of the user when connecting to the Internet, and the user ID and the password are issued to the user by the issuing step. An authentication step of authenticating whether or not, an IP allocation step of assigning an IP address to the information terminal device of the user when authenticated by the authentication step, and the contract registration of the data transmitted and received by the user. A condition determining step of determining whether or not the application type information registered in the step and the data direction information match, and permitting transmission and reception of the data determined to match in the condition determining step. To do.

According to the present invention, the application type information relating to the type of application the user is permitted to use and the data direction information relating to the direction of the data the user is permitted to send and receive are registered, and the user ID and password for the user are registered. Is issued, and when the user connects to the Internet, the user ID and password are received from the user's information terminal device, and it is authenticated whether the user ID and password have been issued to the user. In the case of data, an IP address is assigned to the user's information terminal device, it is determined whether the data transmitted / received by the user matches the registered application type information and data direction information, and the data determined to match About sending and receiving about Without introducing equipment such as Le, it is possible to provide a secure Internet connection services to users without security knowledge. That is,
By pre-registering the application type and data direction to be used by the user in the ISP or the like, the possibility of unauthorized access from the Internet to the user's information terminal device and the possibility of inadvertent data leakage from the information terminal device to the Internet are reduced. be able to.

In the internet connection method according to the next invention, in the above invention, the IP address invalidation step of invalidating the IP address assigned by the IP assignment step when the user disconnects from the internet. Is further included.

According to the present invention, when the user disconnects from the Internet, the IP address assigned in the IP assigning step is invalidated, so that the user information set in the ISP or the like can be deleted. become able to.

The internet connection method according to the next invention is characterized in that, in the above invention, the method further comprises a contract changing step of changing the application type information and the data direction information registered in the contract registration step.

According to the present invention, since the registered application type information and the data direction information are changed, the user can change the application or data direction permitted to be used at any time.

In the internet connecting method according to the next invention, in the above invention, when the condition judging step judges that the data does not match, a warning message is sent to the information terminal device of the user transmitting and receiving the data. Is further included in the step of transmitting a warning message.

According to the present invention, when it is determined by the condition determination that they do not match, a warning message is sent to the information terminal device of the user who sends and receives data, so that the rejected application, data direction, etc. The user can be notified.

In the internet connection method according to the next invention, in the above invention, the contract registration step includes reject application type information regarding a type of an application that the user refuses to use, and data that the user rejects transmission and reception. Is further registered in the condition determining step, and whether the data transmitted and received by the user matches the rejection application type information and the rejection data direction information registered in the contract registration step. It is characterized in that the data is discarded when it is determined whether or not it matches the rejection application type information and the rejection data direction information in the condition determination step.

According to the present invention, the rejected application type information relating to the type of application the user refuses to use and the rejected data direction information relating to the direction of the data the user refuses to send and receive are further registered, and the data sent and received by the user are registered. Is determined to match the registered rejection application type information and rejection data direction information, and if it is determined to match the rejection application type information and rejection data direction information by the condition determination, the data is discarded. The user can register in advance an ISP or the like with an application that refuses to use and a data direction that refuses to send and receive data.

In the internet connection method according to the next invention, in the above invention, the contract changing step includes a type changing step for mutually changing the registered application type information and the rejected application type information, The method may further include a direction changing step of mutually changing the registered data direction information and the rejected data direction information.

According to the present invention, the registered application type information and the rejected application type information can be mutually changed, and the registered data direction information and the rejected data direction information can be mutually changed. Will be able to flexibly select applications or data directions to allow or deny use.

A program according to the next invention is a program for causing a computer to execute the Internet connection method described in any one of the above inventions, and the program becomes machine-readable.
The operation of any one of the above inventions can be executed by a computer.

[0045]

BEST MODE FOR CARRYING OUT THE INVENTION Preferred embodiments of an internet connection system, a management server device, an internet connection method, and a program for causing a computer to execute the method according to the present invention will be described in detail below with reference to the accompanying drawings. To do.

Embodiment 1. 1 is a block diagram showing a network configuration of an internet connection system according to a first embodiment of the present invention. In FIG. 1, the information terminal device 200 has a RAS (Remote Access).
The server 400 is connected to the ISP network 600. The RAS 400 is the information terminal device 200 of the user.
In response to the connection request from the device, the data is relayed to the ISP network 600. The ISP network 600 is configured to include an authentication server device 300 that checks a user ID and password, and a management server device 100 that manages information of contracted users. The management server device 100 stores user information such as application type and data direction applied by the user at the time of contract. The ISP network 600 includes the relay device 500.
Is connected to the Internet 700 via. Here, in the present embodiment, a device that relays and transfers data, such as a RAS or a relay device, is called a network device.

FIG. 2 is a block diagram showing an example of the configuration of the management server device 100 to which the present invention is applied, and conceptually shows only the portion related to the present invention in the configuration. The management server apparatus 100 in FIG.
CPU that controls the entire management server apparatus 100 as a whole
Etc., a communication control interface unit 104 connected to a communication device (not shown) such as a router connected to a communication line, and a storage unit 106 storing various databases (user information database 106a). And each of these parts are communicatively connected via an arbitrary communication path. Further, this server device is communicatively connected to the ISP network 600 via a communication device such as a router and a wired or wireless communication line such as a dedicated line.

Various databases (user information database 106a) stored in the storage unit 106 of FIG. 2 are storage means such as a fixed disk device, and various programs, tables and files used for various processes and website provision. Stores database and web page files.

Of these constituent elements of the storage unit 106,
The user information database 106a is a user information storage unit that stores information about the user (user information), and the user ID and password are authenticated by the authentication server, and the IP address and the application are assigned to the user who is assigned the IP address. The user information storage means stores the type information and the data direction information in association with each other. Here, FIG. 7 shows the user information database 1
It is a figure which shows an example of the user information stored in 06a.

As shown in FIG. 7, the information stored in the user information database 106a includes a user name (user ID) 40 for uniquely identifying each user, an assigned IP address 41 assigned to the user, and a user. It is composed of application type information 42 regarding an application type to be used, data direction information 43 regarding a direction of data transmitted and received by a user, a flag 44 for designating whether the user permits or rejects use of the application and data transmission and reception.

Further, as other information, the storage unit 106 of the management server apparatus 100 stores various Web data and CG for providing a website to the information terminal apparatus 200.
I program etc. are recorded.

The Web data includes data for displaying various Web pages, which will be described later, and these data are formed as a text file described in HTML or XML, for example. The storage unit 1 also stores parts files, work files, and other temporary files for creating these Web data.
It is stored in 06.

In addition, if necessary, the information terminal device 20
The audio for transmission to 0 is stored as an audio file such as WAVE format or AIFF format, and still images and moving images can be stored in JP
It can be stored as an image file such as EG format or MPEG2 format.

Further, in FIG. 2, the communication control interface unit 104 includes the management server device 100 and the ISP network 6.
00 (or a communication device such as a router). That is, the communication control interface unit 1
04 has a function of communicating data with other terminals via a communication line.

Further, in FIG. 2, the control unit 102 controls the O
A control program such as an S (Operating System), a program that defines various processing procedures, and an internal memory for storing required data, and information processing for executing various processes by these programs and the like. I do. Conceptually, the control unit 102 includes a contract registration unit 102a, a contract changing unit 102b, an ID / password issuing unit 102c, an IP address invalidation unit 102d, and a user information transmitting unit 102e.

Of these, the contract registration unit 102a is a contract registration means for registering application type information relating to the type of application the user is permitted to use and data direction information relating to the direction of data the user is permitted to send and receive. The contract changing unit 102b is a contract changing unit that changes the application type information and the data direction information registered by the contract registration unit.
The ID / password issuing unit 102c is an issuing unit that issues a user ID and password to the user.

The IP address invalidation unit 102d is an IP address invalidation unit that invalidates the assigned IP address when the user disconnects from the Internet. The user information transmission unit 102e is a user information transmission unit that transmits the IP address stored in the user information storage unit, the application type information, and the data direction information to the relay device. The details of the processing performed by these units will be described later.

FIG. 3 is a block diagram showing an example of the configuration of the authentication server device 300 to which the present invention is applied.
Only the portion related to the present invention in the configuration is conceptually shown. In FIG. 3, the authentication server device 300 schematically has a C that generally controls the entire authentication server device 300.
A control unit 302 such as a PU, a communication control interface unit 304 connected to a communication device (not shown) such as a router connected to a communication line, and various databases (user authentication information database 306a and IP address information database) The storage unit 306 for storing 306b) is provided, and these units are communicably connected via an arbitrary communication path. Further, this server device is communicatively connected to the ISP network 600 via a communication device such as a router and a wired or wireless communication line such as a dedicated line.

Various databases (user authentication information database 306a and IP address information database 306b) stored in the storage unit 306 of FIG. 3 are storage means such as a fixed disk device, and are used for various processes and website provision. Stores programs, tables, files, databases, files for web pages, etc.

Of the respective constituent elements of the storage unit 306,
The user authentication information database 306a is a user authentication information storage unit that stores information related to user authentication (user authentication information). This user authentication information database 3
The information stored in 06a includes a user ID for uniquely identifying each user and a password.

Further, the IP address information database 30
Reference numeral 6b is an IP address information storage means for storing IP address information for managing the usage status of IP addresses available in the system. The information stored in the IP address information database 306b is composed of the IP address and the user ID of the user who is using the IP address.

Further, in FIG. 3, the communication control interface unit 304 includes an authentication server device 300 and an ISP network 6.
00 (or a communication device such as a router). That is, the communication control interface unit 3
04 has a function of communicating data with other terminals via a communication line.

Further, in FIG. 3, the control unit 302 controls the O
A control program such as an S (Operating System), a program that defines various processing procedures, and an internal memory for storing required data, and information processing for executing various processes by these programs and the like. I do. The control unit 302 is functionally conceptually composed of a user authentication unit 302a and an IP address assignment unit 302.
b.

Of these, the user authentication unit 302a receives the user ID and password from the information terminal device of the user when the user connects to the Internet, and the user ID and password are issued to the user by the issuing means. It is an authentication means for authenticating whether or not there is. Further, when the IP address assigning unit 302b is authenticated by the authenticating means, the IP address assigning unit 302b sends the I
It is an IP assigning means for assigning a P address. The details of the processing performed by these units will be described later.

FIG. 4 is a block diagram showing an example of the configuration of the relay device 500 to which the present invention is applied, and conceptually shows only the portion related to the present invention in the configuration. In FIG. 4, the relay device 500 schematically includes a control unit 5 such as a CPU that generally controls the entire relay device 500.
02, a communication control interface unit 50 connected to a communication device (not shown) such as a router connected to a communication line
4 and a storage unit 506 that stores various databases (user information database 506a), and these units are communicably connected via an arbitrary communication path. Furthermore, this server device is connected to the ISP network 600 or the Internet 70 via a communication device such as a router and a wired or wireless communication line such as a dedicated line.
0 is communicatively connected.

Various databases (user information database 506a) stored in the storage unit 506 of FIG. 4 are storage means such as a fixed disk device, and various programs, tables and files used for various processes and website provision. Stores database and web page files.

Among the constituent elements of the storage unit 506, the user information database 506a is a user information storage means transmitted from the management server apparatus 100, and stores the same contents as the user information database 106a.

Further, in FIG. 4, the communication control interface section 504 controls communication between the relay device 500 and the ISP network 600 or the Internet 700 (or communication device such as router). That is, the communication control interface unit 504 has a function of communicating data with other terminals via a communication line.

Further, in FIG. 4, the control unit 502 controls the O
A control program such as an S (Operating System), a program that defines various processing procedures, and an internal memory for storing required data, and information processing for executing various processes by these programs and the like. I do. The control unit 502 is functionally conceptually configured to include a data receiving unit 502a, a user specifying unit 502b, a condition determining unit 502c, a data transmitting unit 502d, a warning message transmitting unit 502e, and a user information updating unit 502f. .

Of these, the data receiving section 502a is a data receiving means for receiving data transmitted and received by the user. The user specifying unit 502b is a user specifying unit that specifies a user who sends / receives data based on an IP address of a destination or a source of data to be sent / received. The condition determination unit 502c is a condition determination unit that determines whether the data transmitted and received by the user matches the application type information and the data direction information registered by the contract registration unit.

The data transmitting section 502d is a data transmitting means for transmitting the data which is judged by the condition judging means to meet the condition permitted (or does not match the rejected condition). Further, when the warning message transmitting unit 502e determines that the condition determining unit does not match the permitted condition (or matches the rejected condition), the warning message transmitting unit 502e transmits the data to the information terminal device of the user. It is a warning message transmitting means for transmitting a warning message. The user information updating unit 502f is a user information updating unit that updates the user information database 506a based on the user information received from the management server device 100. The details of the processing performed by these units will be described later.

FIG. 5 is a block diagram showing an example of the configuration of the information terminal device 200 to which the present invention is applied, and conceptually shows only the portion related to the present invention in the configuration. As shown in FIG. 5, the information terminal device 200 is
Schematically, the control unit 210, the ROM 220, and the HD 23
0, RAM 240, input device 250, output device 260,
The I / O control IF 270 and the communication control IF 280 are provided, and these units are connected via a bus so that data communication is possible.

The control unit 210 of this information terminal device 200
Includes a web browser 211 and an electronic mailer 212. Of these, the web browser 211
Basically interprets Web data and performs display control (browsing processing) to be displayed on the monitor 261 described later. In addition, the electronic mailer 212 uses a predetermined communication protocol (for example, SMTP (Simple Mail T
According to the transfer protocol)), the electronic mail is transmitted and received.

As the input device 250, a keyboard, a mouse, a microphone or the like can be used.
The monitor 261 described later also realizes a pointing device function in cooperation with the mouse.

As the output device 260, a monitor (including a home-use television) 261 and a printer 26 are provided.
Two are provided. In addition, a speaker or the like can be used as the output device 260. Output device 260
Is output means for outputting information received via the communication control IF 280.

The communication control IF 280 is connected to the information terminal device 200 and a network (or a communication device such as a router).
It controls communication between and. This communication control IF 28
Reference numeral 0 is a receiving means for receiving the information transmitted from the management server device 100.

The information terminal device 200 configured in this way
Is connected to a network through a telephone line or a communication line such as a modem, a TA, a router or the like, or a predetermined communication protocol (for example, TCP / IP).
The RAS 400 can be accessed according to the Internet Protocol).

Next, an example of the processing of the present system configured as described above in the present embodiment will be described below with reference to FIG.
~ It demonstrates in detail with reference to FIG. FIG. 6 is a flowchart showing an example of an operation when a user uses an internet service by using the system of this embodiment.

First, when using the Internet service, the user makes a contract with the Internet connection system that provides the Internet connection service to the user such as ISP. That is, the user notifies the address, name, and telephone number at the time of contract, and also indicates, for example, the application type used by the user such as e-mail and homepage reference, the data direction transmitted and received by the user, and the application type and data direction. The ISP is notified of user information including a flag for designating whether to permit or reject (step SA-1). ISP
Registers the notified information in the user information database 106a by the process of the contract registration unit 102a of the management server device 100.

Here, FIG. 7 shows the user name (user ID).
As the application type, E-mail as the application type, the Internet as the data direction from the user, permission as the flag, and homepage browsing as the application type and the user as the data direction to the Internet. Is specified and rejection is specified as the flag in the user information, the user information database 106 of the management server apparatus 100.
It is an example of the information stored in a.

Note that the ISP provides application menus (E-mail, WWW, etc.), data direction (from user to Internet, or from Internet to user), flag (permit, reject) as a recommended menu for Internet novice users. ) May be prepared and displayed on the information terminal device 200 of the user. As a result, even a beginner user can use this system with peace of mind.

Next, the ISP is the management server device 100.
By the processing of the ID / password issuing unit 102c, the user ID used for the Internet connection to the user,
A password is issued and these user authentication information are registered in the user authentication information database 306a of the authentication server device 300 (step SA-2).

Next, the user connects to the RAS 400 when using the Internet service and notifies the ID and password (step SA-3).

Then, the authentication server device 300 accesses the user authentication information database 306a to verify the notified ID and password by the process of the user authentication unit 302a, and cuts off the connection if the user ID is incorrect. On the other hand, when it is correct, one is selected from the available IP addresses held in the IP address information database 306b by the processing of the IP address assigning unit 302b,
It is assigned to this user (step SA-4).

The authentication server device 300 notifies the management server device 100 of the IP address allocated to the user, and the management server device 100 registers the notified allocation IP address in the user information database 106a.

Then, the management server device 100 processes the user information stored in the user information database 106a by the processing of the user information transmitting unit 102e, and relay device 500.
To ship to.

Then, when the user transmits the data to the ISP (step SA-5), the relay device receives the data and the processing shown in FIG. 8 is executed. Figure 8
7 is a flowchart showing an example of the operation of the relay device 500 when receiving data.

Here, the data reception in the relay device 500 is performed for both the data transmitted by the user to the Internet or the data received from the Internet side.

First, the relay device 500 includes the data receiving unit 5
When data is received by the processing of 02a (step S
B-1), the user identification unit 502b processes to identify the user from the source or destination address of the received data (step SB-2).

Next, the relay device 500 includes the condition determining unit 50.
By the process of 2c, the user information database 506a is referred to for the specified user, and it is checked whether the acquired application type, communication direction, and flag conditions match the received data (step S).
B-3).

Here, if the conditions match (that is, if the conditions are allowed or not rejected), the relay device 500 transfers the data by the process of the data transmitting unit 502d. Send (Step SB
-4) On the other hand, when the conditions do not match (that is, when the conditions do not match the permitted conditions or the rejected conditions), the data is discarded by the processing of the warning message transmission unit 502e, The user is notified as a warning message that the data other than the contract registered in advance is received (step SB-5).

As in the above example, it is possible to send the ones that match the application condition specified by the user and discard all the others, or discard the ones that match the condition and send the other data. May be.

Returning to FIG. 6 again, by the processing of the relay device 500, only the data that matches the conditions registered by the user in advance is contracted (step SA-6 to step S-6).
A-8).

Finally, when the user disconnects from the Internet, the RAS 400 detects this and notifies the management server device 100.

The management server device 100 causes the user information database 1 to be processed by the IP address invalidation unit 102d.
By invalidating the IP address in the user information stored in 06a, and by the processing of the user information transmitting unit 102e,
The fact is notified to the relay device 500. In the relay device 500, the user information in the corresponding user information database 506a is deleted by the process of the user information updating unit 502f (step SA-9).

As described above, it is possible to provide a secure Internet service without introducing a security device individually on the user side. In addition, by preparing a typical menu, even users without security knowledge and novice users can safely use the Internet.

In the present embodiment, the configuration has been shown in which the user connects to the RAS, but it is also possible to use an ADSL modem instead of the RAS for a constant connection.

Embodiment 2. Next, a second embodiment of the present invention will be described. In the second embodiment, an operation when the user changes the contract registered application type, such as when a network game is played as a new application, will be described. FIG. 9 is a flowchart showing an example of the operation of the system according to the second embodiment. The network configuration and the configuration of each device are the same as those shown in FIGS. 1 to 5 in the first embodiment.

First, the user inputs the user ID and password (step SC-1), and the information terminal device 200
From the ISP network 600 (step SC-
2), the authentication server device 300 includes the user authentication unit 302a.
The user ID and password are checked by the process (step SC-3).

If the check is OK, the management server apparatus 100 executes the processing of the contract changing unit 102b.
The user is allowed to change the application type information, the data direction information, or the flag of the user information stored in the user information database 106a (step SC-
4).

As a result, the user can change the registered application type information and data direction information, and the user can change the applications and data directions permitted to be used at any time.

Further, the contract changing unit 102b allows the registered application type information and the rejected application type information to be mutually changed by changing the flag to the user, and the registered data direction information and the rejected data can be changed. Since the direction information and the direction information can be changed with each other, the user can flexibly select the application and the data direction for which the use is permitted or denied.

Next, the management server device 100 updates the user information database 106a with the result of the user change by the process of the contract change unit 102b, and then the user information transmission unit 102e processes the user information to the relay device 500. It is delivered to the client (step SC-5).

On the other hand, if the check result is NG in step SC-3, the management server device 100 displays the error information on the information terminal device 200 of the user (step SC-6) and ends the process. As described above, the user can safely change the application to be used.
Further, this makes it possible to easily deal with the case where a user wants to use a new application.

Although the embodiments of the present invention have been described so far, the present invention is not limited to the above-described embodiments, and various different implementations are possible within the scope of the technical idea described in the claims. May be implemented in the form of.

Of the processes described in the embodiments, all or part of the processes described as being automatically performed can be manually performed, or
All or part of the processing described as being manually performed can be automatically performed by a known method. In addition, the processing procedure, control procedure, and
For specific names, information including parameters such as various registration data and search conditions, screen examples, database configuration,
It can be changed arbitrarily unless otherwise specified.

Further, regarding the management server device 100, the constituent elements shown in the drawings are functionally conceptual, and do not necessarily have to be physically configured as shown. For example, the management server device 100, the authentication server device 300, R
With regard to the processing functions provided in each server of the AS 400 and the relay device 500, etc., in particular, all or some of the processing functions performed by the control unit are controlled by the CPU (Center).
al Processing Unit) and the relevant C
It can be realized by a program that is interpreted and executed by the PU, or can be realized as hardware by a wired logic.

The program is recorded in a recording medium described later, and if necessary, the management server 100,
Authentication server device 300, RAS 400, relay device 500
Read mechanically.

Further, the management server device 100, the authentication server device 300, the RAS 400, and the relay device 500, as further components, various input devices such as a pointing device such as a mouse, a keyboard, an image scanner and a digitizer (not shown). , A display device (not shown) used to monitor the input data, a clock generator (not shown) that generates a system clock, and an output device (not shown) such as a printer that outputs various processing results and other data. May be provided.

The input device, the display device, and the output device may be connected to the control unit via the input / output interfaces.

Various databases stored in the storage unit are memory devices such as RAM and ROM, fixed disk devices such as hard disks, storage means such as flexible disks and optical disks, and various databases used for various processes and website provision. Store programs, tables, files, databases, web page files, etc.

Further, the management server device 100, the authentication server device 300, the RAS 400, and the relay device 500 are information processing devices such as known information processing terminals such as personal computers and workstations, and peripheral devices such as printers, monitors and image scanners. May be implemented by connecting the above and mounting software (including programs, data, etc.) for implementing the method of the present invention on the information processing apparatus.

Further, the management server device 100, the authentication server device 300, the RAS 400, and the relay device 500 are distributed / distributed.
The state of integration is not limited to that shown in the drawings, and all or part of the integration may be functionally or physically distributed / integrated in arbitrary units according to various loads and the like.

For example, each database may be independently configured as an independent database device, and a part of the processing may be performed by a CGI (Common Gateway Int).
interface).

Further, the IP address assigning unit 302b is set to DH.
It may be executed by a CP server (not shown).

The information terminal device 200 is a known personal computer, workstation, home game device, Internet TV, home information appliance, PHS terminal, mobile phone terminal, mobile communication terminal or information processing terminal such as PDA. If necessary, connect peripheral devices such as printers, monitors, and image scanners to the information processing device, and provide the information processing device with software (including programs, data, etc.) that realizes the web information browsing function and electronic mail function. It may be realized by mounting.

The control unit of the information terminal device 200 can be realized in whole or in part by a CPU and a program interpreted and executed by the CPU.
That is, in the ROM or HD, the OS (Operat)
ing System), a computer program for giving commands to the CPU and performing various processes is recorded. This computer program is RAM
It is executed by being loaded into the CPU and configures a control unit in cooperation with the CPU.

However, this computer program may be recorded in an application program server connected to the information terminal device 200 via an arbitrary network, and the whole or a part thereof may be downloaded as necessary. It is possible. Alternatively, all or an arbitrary part of each control unit can be realized as hardware such as a wired logic.

Further, the program according to the present invention can be stored in a computer-readable recording medium. Here, the "recording medium" means a floppy (registered trademark) disc, a magneto-optical disc, a ROM, an EPRO.
Any "portable physical medium" such as M, EEPROM, CD-ROM, MO, DVD, etc., any "fixed physical medium" such as ROM, RAM, HD, etc. built into various computer systems, or A "communication medium" that holds the program in a short period of time is included, such as a communication line or a carrier wave when transmitting the program through a network typified by LAN, WAN, and the Internet.

The "program" is a data processing method described in an arbitrary language or description method, and may take any form such as source code or binary code. In addition,
The "program" is not necessarily limited to a single configuration, but may be configured as a plurality of modules or libraries distributed, or an OS (Operating System).
It also includes a program that cooperates with a separate program represented by m) to achieve its function. Note that a specific configuration for reading a recording medium in each device described in the embodiments,
Well-known configurations and procedures can be used for the reading procedure, the installation procedure after the reading, and the like.

Further, the ISP network 600 is, for example, a LAN
(Including both wired / wireless), VAN, personal computer communication network, public telephone network (including both analog / digital), leased line network (including both analog / digital), CATV network, etc. , IMT2000 system, GSM system or PDC / PDC-P system, etc.
Cellular packet switching network, wireless calling network, Bluetooth
Any of a local wireless network such as th, a PHS network, a satellite communication network such as CS, BS, or ISDB may be included. That is, the present system can send and receive various data via any network whether wired or wireless.

[0122]

As described above, according to the present invention, the application type information relating to the type of application the user is permitted to use and the data direction information relating to the direction of the data the user is allowed to send and receive are registered, Issuing a user ID and password to the user, when the user connects to the Internet,
The user ID and the password are received from the user's information terminal device, and it is authenticated whether the user ID and the password are issued to the user. If the user ID and the password are authenticated, the IP address is sent to the user's information terminal device. An address is assigned, it is determined whether or not the data that the user sends and receives matches the registered application type information and data direction information, and the data that is determined to match is allowed to be sent and received. It is possible to provide a secure Internet connection service to a user who does not have security knowledge without introducing. That is, the user registers the application type to be used and the data direction in the ISP or the like in advance to prevent the unauthorized access from the Internet to the user's information terminal device and the possibility of inadvertent data leakage from the information terminal device to the Internet. Can be lowered.

According to the next invention, when the user disconnects from the Internet, the IP address assigned by the IP assigning means is invalidated.
It becomes possible to delete the user information set in "etc."

According to the next invention, since the registered application type information and the data direction information are changed, the user can change the application or data direction permitted to be used at any time.

According to the next invention, when it is determined by the condition determination that they do not match, a warning message is sent to the information terminal device of the user who sends and receives data, so that the rejected application, data direction, etc. Will be able to be notified to the user.

According to the next invention, rejected application type information regarding the type of application the user refuses to use, and rejected data direction information regarding the direction of data the user refuses to send and receive are further registered,
It is determined whether or not the data transmitted / received by the user matches the rejected application type information and the rejected data direction information registered, and if it is determined by the condition determination that it matches the rejected application type information and the rejected data direction information, the data Since the data is discarded, the user can previously register the application whose use is rejected and the data direction which is rejected the transmission / reception of data in the ISP or the like in advance.

According to the next invention, the registered application type information and the rejected application type information can be mutually changed, and the registered data direction information and the rejected data direction information can be mutually changed. The user can flexibly select the application or data direction to be permitted or denied.

According to the next invention, application type information relating to the type of application the user is permitted to use and data direction information relating to the direction of data the user is allowed to send and receive are registered, and the user ID and The password is issued, the user ID and the password are authenticated by the authentication server, and the IP address, the application type information, and the data direction information are stored in association with each other for the user to whom the IP address is assigned and stored. The IP address, the application type information, and the data direction information are transmitted to the relay device, and the relay device determines whether the data transmitted / received by the user matches the application type information and the data direction information. Sending and receiving the data determined to be Since the permit, without introducing the equipment of the firewall, such as to each individual user, it is possible to provide a secure Internet connection services to users without security knowledge. That is, the user registers the application type to be used and the data direction in the ISP or the like in advance to prevent unauthorized access from the Internet to the user's information terminal device or inadvertent data leakage from the information terminal device to the Internet. Can be lowered.

According to the next invention, when the user disconnects from the Internet, the IP address assigned by the IP assigning means is invalidated.
It becomes possible to delete the user information set in "etc."

According to the next invention, since the registered application type information and the data direction information are changed, the user can change the application or data direction permitted to be used at any time.

According to the next invention, rejected application type information regarding the type of application the user refuses to use, and rejected data direction information regarding the direction of data the user refuses to send and receive are further registered.
It is determined whether or not the data transmitted / received by the user matches the rejected application type information and the rejected data direction information registered, and if it is determined by the condition determination that it matches the rejected application type information and the rejected data direction information, the data Since the data is discarded, the user can previously register the application whose use is rejected and the data direction which is rejected the transmission / reception of data in the ISP or the like in advance.

According to the next invention, the registered application type information and the rejected application type information can be mutually changed, and the registered data direction information and the rejected data direction information can be mutually changed. The user can flexibly select the application or data direction to be permitted or denied.

According to the next invention, the application type information relating to the type of application the user is permitted to use and the data direction information relating to the direction of the data the user is permitted to transmit and receive are registered, and the user ID and Issue a password, receive a user ID and password from the user's information terminal device when the user connects to the Internet, and authenticate whether the user ID and password have been issued to the user, and authenticate If so, an IP address is assigned to the user's information terminal device, it is determined whether the data transmitted / received by the user matches the registered application type information and data direction information, and it is determined that they match. Since data can be sent and received, each user can Without the introduction of equipment such as Lumpur,
It is possible to provide a secure Internet connection service to users who have no security knowledge. That is, the user registers the application type to be used and the data direction in the ISP or the like in advance to prevent unauthorized access from the Internet to the user's information terminal device or inadvertent data leakage from the information terminal device to the Internet. Can be lowered.

According to the next invention, when the user disconnects from the Internet, the IP address assigned in the IP assigning step is invalidated.
It becomes possible to delete the user information set in "etc."

According to the next invention, since the registered application type information and the data direction information are changed, the user can change the application or data direction permitted to be used at any time.

According to the next invention, when it is determined by the condition determination that they do not match, a warning message is sent to the information terminal device of the user who sends and receives data, so that the rejected application, data direction, etc. Will be able to be notified to the user.

According to the next invention, rejected application type information regarding the type of application the user refuses to use, and rejected data direction information regarding the direction of data the user refuses to send and receive are further registered,
It is determined whether or not the data transmitted / received by the user matches the rejected application type information and the rejected data direction information registered, and if it is determined by the condition determination that it matches the rejected application type information and the rejected data direction information, the data Since the data is discarded, the user can previously register the application whose use is rejected and the data direction which is rejected the transmission / reception of data in the ISP or the like in advance.

According to the next invention, the registered application type information and the rejected application type information can be mutually changed, and the registered data direction information and the rejected data direction information can be mutually changed. The user can flexibly select the application or data direction to be permitted or denied.

According to the next invention, a program for causing a computer to execute the Internet connection method described in any one of the above inventions, and the program becomes machine-readable, whereby any one of the above inventions can be realized. This has the effect that one operation can be executed by a computer.

[Brief description of drawings]

FIG. 1 is a block diagram showing a network configuration of an internet connection system according to a first embodiment of the present invention.

FIG. 2 is a block diagram showing an example of a configuration of a management server device 100 to which the present invention is applied.

FIG. 3 is a block diagram showing an example of a configuration of an authentication server device 300 to which the present invention is applied.

FIG. 4 is a block diagram showing an example of a configuration of a relay device 500 to which the present invention is applied.

FIG. 5 is a block diagram showing an example of a configuration of an information terminal device 200 to which the present invention is applied.

FIG. 6 is a flowchart showing an example of an operation when a user uses an internet service by using the system of the present embodiment.

FIG. 7 is a diagram showing an example of user information stored in a user information database 106a.

FIG. 8 is a flowchart showing an example of the operation of relay device 500 when receiving data.

FIG. 9 is a flowchart showing an example of the operation of the present system which is the second embodiment.

FIG. 10 is a network configuration diagram to which a firewall according to the related art is connected.

[Explanation of symbols]

40 user name, 41 assigned IP address, 42
Application type information, 43 Data direction information, 4
4 flag, 60 internal network 1, 61 internal network 2, 62 internal network 3, 63
Organization network, 64 router, 65 Internet, 66 ISP, 67 terminal, 100 management server device, 102 storage unit, 102a contract registration unit, 102
b Contract change section, 102c ID / password issue section,
102d IP address invalid part, 102e user information transmission part, 104 communication control interface part, 106
Storage unit, 106a user information database, 200
Information terminal device, 210 control unit, 211 Web browser, 212 electronic mailer, 220 ROM, 230 H
D, 240 RAM, 250 input device, 260 output device, 270 input / output control interface, 280
Communication control interface, 300 authentication server device,
302 control unit, 302a user authentication unit, 302b
IP address assignment unit, 304 communication control interface unit, 306 storage unit, 306a user authentication information database, 306b IP address information database, 5
00 relay device, 502 control unit, 502a data receiving unit, 502b user specifying unit, 502c condition determining unit, 502d data transmitting unit, 502e warning message transmitting unit, 502f user information updating unit, 504 communication control interface unit, 506 storage unit, 506a
User information database, 600 ISP network, 700
the Internet.

   ─────────────────────────────────────────────────── ─── Continued front page    F term (reference) 5B085 AE01 AE23 BC00 BG07 CA04                 5B089 GA11 GA21 GB02 HA10 KA17                 5K030 GA15 HB16 HB21 HC01 HC14                       HD03 HD08 JA07 JA11 JL07                       JT03 JT06 KA06 KA07 KX24                       LB02 LC15 LC18 LD19 LD20                       MA04 MC08                 5K033 AA08 BA04 BA15 CA19 CB09                       CC02 DA05 DB14 DB18 DB20                       EA02 EA06 EC04

Claims (18)

[Claims] 1. An Internet connection system for connecting a user's information terminal device to the Internet, in which application type information relating to the type of application permitted by the user, and direction of data permitted to be transmitted and received by the user Contract registration means for registering data direction information, issuing means for issuing a user ID and password to the user, and the user ID and the user ID from the information terminal device of the user when the user connects to the Internet. An authentication unit that receives the password and authenticates whether the user ID and the password are issued to the user by the issuing unit, and, if authenticated by the authentication unit, IP for the information terminal device An IP assigning unit that assigns a dress, and a condition determining unit that determines whether or not the data transmitted and received by the user matches the application type information and the data direction information registered by the contract registration unit, An internet connection system, which permits transmission and reception of the data determined to match by the condition determination means. 2. The apparatus according to claim 1, further comprising an IP address invalidating unit that invalidates the IP address assigned by the IP assigning unit when the user disconnects from the Internet. Internet connection system described. 3. The Internet connection system according to claim 1, further comprising a contract changing unit that changes the application type information and the data direction information registered by the contract registration unit. 4. A warning message transmitting means for transmitting a warning message to the information terminal device of the user transmitting / receiving the data, when the condition determining means determines that the conditions do not match. The internet connection system according to any one of claims 1 to 3, characterized in that: 5. The contract registration means further registers refusal application type information regarding the type of application that the user refuses to use, and refusal data direction information regarding the direction of data that the user refuses to send and receive, The condition determining means determines whether or not the data transmitted and received by the user matches the rejection application type information and the rejection data direction information registered by the contract registration means, and the condition determining means rejects the rejection. The internet connection system according to any one of claims 1 to 4, wherein when the application type information and the rejection data direction information are determined to match, the data is discarded. 6. The contract changing means, a type changing means for mutually changing the registered application type information and the rejected application type information, the registered data direction information and the rejected data direction information. The internet connection system according to any one of claims 3 to 5, further comprising: a direction changing unit that can mutually change and. 7. An Internet connection system for connecting an information terminal device of the user to the Internet, which is configured by communicably connecting an authentication server for authenticating a user and a relay device connected to the Internet. In the server device, contract registration means for registering application type information regarding the type of application the user is permitted to use, and data direction information regarding the direction of data the user is allowed to send and receive, and a user ID for the user And an issuing unit that issues a password, and the IP address, the application type information, and the data direction information for the user who is authenticated with the user ID and the password by the authentication server and is assigned an IP address. And associate with User information storage means for storing, the IP address stored by the user information storage means, the application type information, and the user direction transmission means for transmitting the data direction information to the relay device. The relay device determines whether or not the data transmitted and received by the user matches the application type information and the data direction information, and permits transmission and reception of the data determined to match. Management server device. 8. The management server according to claim 7, further comprising an IP address invalidating unit that invalidates the assigned IP address when the user disconnects from the Internet. apparatus. 9. The management server device according to claim 7, further comprising a contract changing unit that changes the application type information and the data direction information registered by the contract registration unit. 10. The contract registration means further registers refusal application type information relating to the type of application the user refuses to use, and refusal data direction information relating to the direction of data the user refuses to send and receive, The user information storage means further stores the IP address of the user, the rejection application type information, and the rejection data direction information in association with each other, and the user information transmission means stores the IP address of the user. The rejection application type information and the rejection data direction information are further transmitted to the relay device, and in the relay device, the data transmitted and received by the user matches the rejection application type information and the rejection data direction information. It is determined whether or not to perform, and it is determined that they match The management server device according to any one of claims 7 to 9, wherein the data is discarded in the case of doing so. 11. The contract changing means is a type changing means for mutually changing the registered application type information and the rejected application type information, the registered data direction information and the rejected data direction information. The management server device according to claim 9 or 10, further comprising: a direction changing unit that can mutually change and. 12. An internet connection method executed in an internet connection system for connecting a user's information terminal device to the internet, wherein application type information regarding an application type permitted by the user and transmission / reception by the user. A contract registration step of registering data direction information regarding the direction of data to be permitted, an issuing step of issuing a user ID and a password to the user, and the information of the user when the user connects to the Internet. An authentication step of receiving the user ID and the password from the terminal device and authenticating whether or not the user ID and the password are issued to the user by the issuing step, and authenticated by the authentication step. in case of An IP assignment step of assigning an IP address to the information terminal device of the user, and whether or not the data transmitted and received by the user matches the application type information and the data direction information registered in the contract registration step. A condition determining step, and permitting transmission and reception of the data determined to match in the condition determining step. 13. The method according to claim 12, further comprising an IP address invalidation step of invalidating the IP address assigned by the IP assignment step when the user disconnects from the Internet. Internet connection method. 14. The internet connection method according to claim 12, further comprising a contract changing step of changing the application type information and the data direction information registered in the contract registration step. 15. A warning message transmitting step of transmitting a warning message to the information terminal device of the user transmitting and receiving the data when the condition determining step determines that they do not match. The internet connection method according to any one of claims 12 to 14, which is characterized in that. 16. The contract registration step further registers refusal application type information relating to the type of application the user refuses to use, and refusal data direction information relating to the direction of data the user refuses to send and receive, The condition determination step determines whether or not the data transmitted and received by the user matches the rejection application type information and the rejection data direction information registered in the contract registration step, and the rejection is performed by the condition determination step. 16. The internet connection method according to claim 12, wherein when it is determined that the application type information and the rejection data direction information match, the data is discarded. 17. The contract changing step includes a type changing step of mutually changing the registered application type information and the rejected application type information, the registered data direction information and the rejected data direction information. The internet connection method according to any one of claims 14 to 16, further comprising: a direction changing step that enables mutual changes between and. 18. A program for causing a computer to execute the Internet connection method according to any one of claims 12 to 17.