JP2004078507A - Access control device, access control method and computer program - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To allow a fire wall built in each terminal unit connected to a network, to perform appropriate access control in cooperation with an application of a terminal device. <P>SOLUTION: The setting of the fire wall is dynamically changed using the contents of parameters of a used system call when using the network. The network is thereby used while enhancing safety without setting the fire wall beforehand. Furthermore, there is no need to add a special code for control to the fire wall, to the application, nor need to incorporate a unique processing mechanism corresponding to a protocol such as a file transfer protocol, in the fire wall. <P>COPYRIGHT: (C)2004,JPO

Description

[0001]
TECHNICAL FIELD OF THE INVENTION
The present invention relates to an access control device and an access control method for controlling external access to a device such as a computer, and a computer program, and more particularly to an access control device and an access control device for controlling access to a device connected to a network. The present invention relates to a control method and a computer program.
[0002]
More specifically, the present invention relates to an access control apparatus, an access control method, and a computer, which monitor a packet located at a boundary of a network and pass the packet, and perform access control such as passing or discarding the packet according to a set rule. The present invention relates to a program, and more particularly to an access control device and an access control method for performing appropriate access control in cooperation with an application running on a device, and a computer program.
[0003]
[Prior art]
In recent years, computing technologies such as information processing and information communication have been dramatically improved, and computer systems have become widespread. In addition, there is an increasing demand for network computing technology for interconnecting computers. Under a network connection environment, cooperative work such as sharing of computer resources and sharing, distribution, distribution, and exchange of information can be smoothly performed.
[0004]
There are various forms of networks that interconnect computers. For example, a locally laid LAN (Local Area Network) such as Ethernet or the "Internet" (literally, a world-wide network as a result of repeatedly interconnecting networks) ( The Internet).
[0005]
The Internet is, literally, a network of networks that has grown into a huge network as a result of servers installed at universities and research institutions voluntarily repeating interconnections. Currently, countless servers are connected on the Internet, and each server publishes various resource objects to countless clients. Servers on the Internet are usually interconnected according to TCP / IP (Transmission Control Protocol / Internet Protocol) protocol.
[0006]
Many services / applications such as WWW (World Wide Web), News, TELNET (Teletypewriter NETwork), FTP (File Transfer Protocol), and Gopher are disclosed on the Internet.
[0007]
Recently, with the laying of high-speed network lines such as telephone lines (ADSL (Asymmetric Digital Subscriber Line)) and cable televisions, the always-on connection environment has been enhanced. Also, it is expected that many devices will be connected to the Internet by IPv6, which is expected to spread in the future.
[0008]
However, with the widespread use of such wide area networks, security concerns have arisen. This is because devices are illegally accessed without knowing through the network, and the data in the system is improperly copied, stolen, or tampered with, and the system is no longer required due to virus infection. This is because they may be attacked without intervention. For this reason, Internet users must take some security measures.
[0009]
Generally, a firewall provided on a communication path performs control of who is allowed to use what kind of device or service connected to the network, that is, access control.
[0010]
The firewall is disposed at the boundary of the network, monitors a passing packet, and performs processing such as passing or discarding the packet according to a set rule.
[0011]
As a general usage form of such a firewall, a network is classified into a reliable range (for example, an internal network) and an unreliable range (for example, an external network such as the Internet), and communication between the two is basically performed. There is a usage method that makes it impossible and allows only a small number of exceptional communications (for example, communications with an HTTP server on the Internet).
[0012]
However, with the development of IPv6 technology in recent years, a configuration based on “end-to-end” communication in which a terminal and a communication partner terminal are directly connected is desired as a future network. As one of the motivations, in order to allow the designer of the terminal device application to freely create the application, the network is basically a simple, unified end-to-end connectivity to all terminals. The idea is that it should be provided with a simple interface.
[0013]
In such a configuration, it is expected that there is no firewall on the communication path, and a configuration in which the function of the firewall is incorporated in the device itself is used.
[0014]
For example, a configuration is conceivable in which packet filtering software such as an IP Filter (obtainable from http://comoms.anu.edu.au/@avalon/ip-filter.html) is installed in each terminal device. Can be In this case, the configuration of the terminal device may be, for example, as shown in FIG.
[0015]
The firewall has a setting unit serving as an interface for setting rules, and is set by a setting tool of a user program. The state holding unit records the state of the TCP session to which the passing packet belongs, for example. The control unit determines whether or not the packet can be passed using the set rules and the information of the state holding unit.
[0016]
However, if a mechanism similar to a firewall is simply incorporated into a terminal device, it is necessary to set in advance a firewall necessary for an application program to use a network using a setting tool or the like, which lacks flexibility. . For example, there are difficulties such as a need to change settings when starting use of a new application.
[0017]
Also, depending on the application protocol, it is difficult to ensure security while performing end-to-end communication due to the inherent problem of the firewall that communication across the firewall cannot be performed. .
[0018]
As an example, for a protocol such as ftp (File Transfer Protocol) that newly establishes a TCP connection using a dynamically determined port number, the operation of the protocol must be known. That is, when a designer of a terminal device creates an application using a new protocol, a situation occurs in which communication over a firewall cannot be performed. Therefore, there is a problem in realizing the firewall function incorporated in the terminal device itself as described above.
[0019]
In the normal operation of the ftp client, communication is performed according to a sequence as shown in FIG. First, a TCP connection is made to port 21 of the ftp server for control communication, and various commands are transmitted. On the other hand, since another TCP connection is used for data transfer, a child process is generally created and designated as a parameter of a PORT command. For example, when the client sends a RETR command to acquire data, the ftp server connects to the port specified by the PORT command and transfers the data.
[0020]
Therefore, in order to pass ftp communication through a firewall or a wall, it is necessary to allow a connection for data transfer from the ftp server. If such settings are to be made in advance, there are many ftp servers and their addresses cannot be determined in advance, so settings must be made to accept connections from all addresses. Such a setting increases the vulnerability and is difficult to realize.
[0021]
In the conventional firewall-related technology, the following method is used to pass ftp communication.
[0022]
The firewall monitors the packet of the 21st port, finds and analyzes the PORT command transmitted by the ftp client, and obtains a port number for data transfer. Then, the setting of the firewall is changed so that the port for data transfer is permitted to establish a TCP connection from the server to the client.
[0023]
This method has a problem that a program having a process specialized for FTP is required. Further, similarly to ftp, for a protocol that creates another connection based on a port number dynamically allocated during communication, it is necessary to individually add processing in accordance with the specification of the protocol. There is also.
[0024]
As a technique for solving such a problem, for example, a port access control system disclosed in JP-A-2000-349821 can be cited. According to the publication, an FTP client requests a firewall to permit access from an external network to a port for a data connection dynamically allocated by an operating system, thereby enabling the FTP client to access the port. Establish a data connection between servers. When releasing the data connection, the access permission for the port on the firewall is revoked. Therefore, even when the FTP file transmission is performed through the firewall, the port used for the FTP file transmission does not need to be set in advance as an accessible port on the firewall, and the data connection of the FTP file transmission is not required. The establishment can be efficiently performed through the firewall, and the convenience of the network can be improved while maintaining the security by the firewall.
[0025]
However, the technique described in this publication has a problem that the ftp application must be changed.
[0026]
[Problems to be solved by the invention]
An object of the present invention is to provide an excellent access control device that monitors packets passing at a network boundary and that can appropriately perform access control such as passing or discarding packets according to a set rule, and an excellent access control device. An object of the present invention is to provide an access control method and a computer program.
[0027]
A further object of the present invention is to provide an excellent access control device, an excellent access control method, and a computer program capable of appropriately performing appropriate access control in cooperation with an application running on a device.
[0028]
A further object of the present invention is to provide an excellent access control device and an access control method, and a computer, which can dynamically change settings when a rule set for performing communication by an application becomes necessary. To provide a program.
[0029]
A further object of the present invention is to provide an excellent access control that can appropriately perform access control even when performing data communication using a protocol that newly establishes a network connection using a dynamically determined port number. A control device, an access control method, and a computer program are provided.
[0030]
A further object of the present invention is to provide an excellent access control device and an access control device in which a firewall built in each terminal device connected to a network can perform appropriate access control in cooperation with an application of the terminal device. A control method and a computer program are provided.
[0031]
A further object of the present invention is to set the initial state of the firewall to a state in which communication is not permitted, and to dynamically set when the application needs to change the setting of the firewall in order to perform communication. An object of the present invention is to provide an excellent access control device, an access control method, and a computer program capable of performing a change.
[0032]
Means and Action for Solving the Problems
The present invention has been made in view of the above problems, and a first aspect thereof is an access control device that controls access to a device connected to a network,
A firewall that monitors input / output packets to and from the network interface and controls whether or not packets can pass based on a predetermined control rule;
A system call comprising a setting unit for interpreting a call parameter that the application program calls during communication and changing the control rule;
An access control device characterized by comprising:
[0033]
Here, the firewall may determine whether or not the packet can be passed according to a state holding unit that holds a communication state related to a network connection to which a passing packet belongs and a state of the communication held in the state holding unit. A control unit.
[0034]
The state holding unit records a source address and port, a destination address and port, a communication state, and an application ID related to a network connection to which a passing packet belongs, and the control unit is a destination of the received packet. With reference to the status of the application ID, it is determined whether or not the packet can pass.
[0035]
More specifically, the control unit refers to a list of application IDs related to the application from the ID of the application serving as the destination of the received packet, searches for session information by the relevant application ID, and It is determined whether the source of the packet matches the source of the packet. If the source matches, the packet is permitted to pass.
[0036]
Therefore, according to the access control device according to the first aspect of the present invention, when using the network, the setting of the firewall is dynamically changed using the contents of the parameters of the system call to be used. Even without setting up a firewall in advance, the network can be used while improving security. Also, it is not necessary to add a special code for controlling the firewall to the application. Also, it is not necessary to incorporate a unique processing mechanism corresponding to a protocol such as ftp into the firewall.
[0037]
The setting unit may register, in the state holding unit, a state of a child process started from an original application when a connection request is made from the outside.
[0038]
The setting unit may register a state of the child process in the state holding unit when a child process is generated from an original application.
[0039]
In a system call for starting a network connection, a call parameter called by an application program during communication may include a parameter describing a firewall control rule.
[0040]
In a system call for waiting for a connection, a call parameter called by an application program during communication may include a parameter describing a firewall control rule.
[0041]
Further, the firewall may allow a packet for starting a connection to a destination designated by an application to pass when a communication state relating to a network connection to which the passing packet belongs is being connected.
[0042]
Further, the firewall may allow bidirectional communication from a designated source to a destination when a communication state regarding a network connection to which a passing packet belongs is in communication.
[0043]
Further, the firewall may allow a connection from a source specified for an application when a communication state regarding a network connection to which a passing packet belongs is standby.
[0044]
Also, the firewall may allow connection only when a program already in a communication state dynamically establishes a new connection when a communication state regarding a network connection to which a passing packet belongs is a conditional standby. It may be.
[0045]
Further, the firewall may indicate that the communication is in the middle of a procedure for terminating the connection when the state of communication regarding the network connection to which the passing packet belongs is waiting for termination.
[0046]
According to a second aspect of the present invention, there is provided a computer program described in a computer-readable form so as to execute a process for controlling access to a device connected to a network on a computer system,
A packet passing control step of monitoring input / output packets to / from the network interface and controlling whether or not the packet can pass based on a predetermined control rule;
A control rule change step of interpreting a call parameter called by the application program during communication and changing the control rule,
A computer program characterized by comprising:
[0047]
The computer program according to the second aspect of the present invention defines a computer program described in a computer-readable format so as to realize a predetermined process on a computer system. In other words, by installing the computer program according to the second aspect of the present invention in a computer system, a cooperative action is exerted on the computer system, and the access control device according to the first aspect of the present invention. The same operation and effect as described above can be obtained.
[0048]
Further objects, features, and advantages of the present invention will become apparent from more detailed descriptions based on embodiments of the present invention described below and the accompanying drawings.
[0049]
BEST MODE FOR CARRYING OUT THE INVENTION
Hereinafter, embodiments of the present invention will be described in detail with reference to the drawings. However, it is assumed that the terminal device performs access control using a packet filter type firewall.
[0050]
FIG. 1 schematically shows a configuration example of a communication system to which the present invention is applied.
[0051]
In the figure, a network 6 is a local area network (LAN) such as a network limitedly laid in a specific organization such as a company or a home, to which a terminal 4 is connected, and an IPv6 address addr4 is assigned. Have been.
[0052]
The terminal 4 is a device on which an application using a network is installed, and is constituted by a computer such as a personal computer (PC) as an example. Of course, other forms of information such as home electric appliances having a network communication function are provided. It may be a device. In this specification, a device having the FTP client 14 in the terminal device 4 will be taken as an example.
[0053]
The network 6 is interconnected with another network 5 via a wide area network such as the Internet. The terminal 3 is connected to the network 5.
[0054]
The terminal 3 is a device that can communicate according to the IPv6 protocol, and is assigned an address addr3. The terminal 3 is configured by a computer such as a personal computer (PC) as an example, but may be another type of information device such as a home appliance having a network communication function. In this specification, a device having the FTP server 13 in the terminal device 3 will be described as an example.
[0055]
FIG. 2 schematically illustrates the functional configuration of the terminal device 4. As shown in FIG. 1, a terminal device 4 includes an FTP client 14 which is an application program that communicates using a network, an IP processing unit 15 which performs a data transfer process in accordance with an IP (Internet Protocol) protocol, and a network. And a firewall 16 for controlling whether or not a packet can pass through the firewall 6.
[0056]
An application such as the FTP client 14 calls a system call which is a part of the function of the operating system (OS) when using the network, and transmits an instruction to the IP processing unit 15.
[0057]
The IP processing unit 15 converts the data passed from the application into an IP packet format, determines whether or not the data can be output by a firewall, and outputs the data. Also, the input / output of the IP packet received from the network is determined by the firewall, the format is converted, and the IP packet is passed to the application.
[0058]
The firewall 16 includes a setting unit 16A serving as an interface for setting rules, a state holding unit 16B for holding a communication state, and a control unit 16C. Rules are set through the setting unit 16A from a system call, which is an OS function called by the application during communication.
[0059]
In the state holding unit 16B, a source address and port, a destination address and port, a communication state, and an application ID are recorded as information on a connection such as TCP to which a passing packet belongs. As the application ID, an ID of each application using the network connection is recorded. For example, a process ID in a Unix-based operating system can be used as an application ID. In addition, as the network connection state, five states of “connected”, “standby”, “conditional standby”, “communicating”, and “end wait” are used.
[0060]
The control unit 16C in the firewall 16 uses the information in the state holding unit 16B to determine whether or not the packet can pass.
[0061]
In the “connected” state, a packet for starting a connection to a destination specified by an application in the terminal is allowed to pass.
[0062]
In the "communicating" state, two-way communication from the specified source to the destination is permitted.
[0063]
In the “standby” state, the application in the terminal is permitted to connect from the specified source.
[0064]
In the case of "conditional standby", the connection is permitted only when a program already in the communication state dynamically establishes a new connection.
[0065]
"Waiting for termination" indicates that the connection is being terminated.
[0066]
The operation of the terminal device 4 according to the embodiment shown in FIG. 2 will be described with reference to an example of a communication procedure of connecting to the FTP server 13 of the terminal 3 interconnected via the Internet 5 and acquiring a file. 3 and 4 show the operation procedure of the terminal device 4 at this time in the form of a flowchart. FIG. 5 shows an operation sequence between the terminal device 4 and the terminal device 3 at this time.
[0067]
In the present embodiment, the firewall 16 on the terminal 4 is initially set so as to prohibit all communication. However, this initial setting is only an example, and if the server has a server function that is open to the public on the Internet 5, the communication of the port number used by the server for receiving the request is not inconsistent with the following description. It is possible to make an appropriate setting so as to allow.
[0068]
The ftp client 14 connects to the 21st port (command port) of the IP address addr3 of the terminal 3 in order to connect to the ftp server 13 (step S1).
[0069]
During the processing of the connect system call, the OS of the terminal 4 sets the TCP connection information such as the connection destination address addr3 and the port number 21 as its arguments and the process ID of the ftp client 14 as a set, and The information is registered in the state holding unit 16B (step S2). At this time, information on this connection is registered in the state holding unit 16B as a “connected” state.
[0070]
After the TCP connection is established between the ftp client 14 and the ftp server 13, the firewall 16 changes the information on the connection to the port 21 of the addr3 of the state holding unit 16B to the “communicating” state (step S3).
[0071]
The ftp client 14 starts up a child process and prepares a new TCP connection for data transfer (step S4). Here, a case where port number 5001 is used as a data transfer port will be described as an example.
[0072]
The child process executes listen so as to wait for a TCP connection at port 5001 (step S5).
[0073]
Next, the child process executes the system call "accept" and blocks until the child process is connected to the port 5001 (step S6).
[0074]
Next, the ftp client 14 transfers a PORT command designating a port for data transfer using the TCP connection already established for the 21st port for control (step S7).
[0075]
On the other hand, the ftp server 13 receives the PORT command and records the port number 5001 as a parameter (step S8).
[0076]
Next, the ftp client 14 transmits a RETR command to acquire data (step S9).
[0077]
Upon receiving the RETR command, the ftp server 13 transmits data to port 5001 of addr4 (step S10).
[0078]
The firewall 16 detects the arrival of the TCP packet from the addr 3 to the port 5001 (step S11).
[0079]
Next, the firewall 16 obtains a list of ports currently being listened to by the terminal 4 from the state held by the IP processing unit 15 (step S12), and determines whether there is a number 5001 in the list. Is checked (step S13). Such an operation is realized, for example, by acquiring information using a socktat command in a Unix-based operating system.
[0080]
Here, if there is no port 5001 in the list of ports currently listened on the terminal 4, the packet is discarded (step S14), and the RST is returned (step S15). As a result, the attempt of the TCP connection from the ftp server 13 fails.
[0081]
When the port 5001 is waiting, the process ID of the process using the port and the list of IDs of its child processes are acquired (step S16).
[0082]
Next, the firewall 16 uses the list of IDs for each of the above processes or their child processes to determine whether or not there is information on the connection in the “communicating” state with the addr 3 in the state holding unit 16B. Search (step S17).
[0083]
If not (step S18), the firewall 16 discards the packet (step S14) and returns RST (step S15). As a result, the attempt of the TCP connection from the ftp server 13 fails.
[0084]
On the other hand, if there is information on the connection in the “communicating” state with the addr 3 in the state holding unit 16B (step S18), the firewall 16 continues the packet receiving process and simultaneously sets the number 5001. The information of the TCP connection to the port is registered as the "communicating" state, and the passage of the packet is permitted (step S19).
[0085]
Thereafter, when a TCP connection to the number 5001 waiting for the child process is established (step S20), data transfer is performed between the child process and the ftp server (step S21).
[0086]
The firewall 16 detects the arrival of the FIN packet to the port 5001 (step S22).
[0087]
The ftp client 14 transmits an ACK to the FIN as TCP termination processing (step S23).
[0088]
When the child process on the terminal 14 ends, close is executed (step S24).
[0089]
During the processing of the close system call, the operating system obtains the information of the destination address, the destination port, and the destination port of the corresponding TCP connection from the socket descriptor specified by the close, and obtains the information (for data transfer). The information on the connection of port 5001 (as a port) is deleted from the state holding unit 16B of the firewall 16 (step S25).
[0090]
Thus, the process for the data transfer connection is completed.
[0091]
When the ftp client 14 ends, the ftp client 14 issues a close system call (step S26).
[0092]
During the close processing, the operating system deletes the connection information of the 21st port as the command port from the state holding unit 16B of the firewall 16 (step S27), and prohibits the passage of the packet.
[0093]
As can be seen from the above description, in the terminal 4 having the configuration as shown in FIG. 2, even if there is no firewall function for performing an operation specialized for ftp in advance, the conventional terminal 4 can be connected through the firewall. It can be used without changing the ftp protocol. In addition to the ftp, the illustrated terminal 4 can be similarly applied to a protocol such as RTSP (Real Time Streaming Protocol) that newly creates a connection using a dynamically determined port number.
[0094]
FIG. 6 schematically illustrates another example of the functional configuration of the terminal device 4. As shown in FIG. 1, a terminal device 4 includes an FTP client 14 which is an application program that communicates using a network, an IP processing unit 15 which performs a data transfer process in accordance with an IP (Internet Protocol) protocol, and a network. And a firewall 16 for controlling whether or not a packet can pass through the firewall 6.
[0095]
An application such as the FTP client 14 calls a system call, which is a function of the operating system (OS), when using the network, and transmits an instruction to the IP processing unit 15.
[0096]
The IP processing unit 15 converts the data passed from the application into an IP packet format, determines whether or not the data can be output by a firewall, and outputs the data. Also, the input / output of the IP packet received from the network is determined by the firewall, the format is converted, and the IP packet is passed to the application.
[0097]
The firewall 16 includes a setting unit 16A serving as an interface for setting rules, a state holding unit 16B for holding a communication state, and a control unit 16C. The setting is performed through a setting unit 16A from a system call, which is an OS function called by the application during communication.
[0098]
In the state holding unit 16B, a source address and port, a destination address and port, a communication state, and an application ID are recorded as information on a connection such as TCP to which a passing packet belongs. As the application ID, an ID of each application using the network connection is recorded. For example, a process ID in the Unix OS can be used as an application ID. In addition, five states such as “connecting”, “standby”, “conditional standby”, “communicating”, and “end wait” are used.
[0099]
The control unit 16C in the firewall 16 uses the information in the state holding unit 16B to determine whether or not the packet can pass.
[0100]
The operation of the terminal device 4 according to the embodiment shown in FIG. 6 will be described with reference to an example of a communication procedure of connecting to the FTP server 13 of the terminal 3 interconnected via the Internet 5 and acquiring a file. 7 and 8 show the operation procedure of the terminal device 4 at this time in the form of a flowchart. FIG. 9 shows an operation sequence between the terminal device 4 and the terminal device 3 at this time.
[0101]
In the present embodiment, the firewall 16 on the terminal 4 is initially set so as to prohibit all communication. However, this initial setting is only an example, and if the server has a server function that is open to the public on the Internet 5, the communication of the port number used by the server for receiving the request is not inconsistent with the following description. It is possible to make an appropriate setting so as to allow.
[0102]
In order for the ftp client 14 to connect to the ftp server 13, the ftp client 14 executes a connect to the 21st port as the command port of the IP address addr3 of the terminal 3 (step S31).
[0103]
During the process of the connect system call, the OS of the terminal 4 sets the information of the TCP connection such as the connection destination address addr3 and the port 21 as its arguments and the process ID of the ftp client 14 as a set, and The information is registered in the state holding unit 16B (step S32). At this time, information on this connection is registered in the state holding unit 16B as a “connected” state.
[0104]
After the TCP connection is established between the ftp client 14 and the ftp server 13, the firewall 16 changes the information on the connection to the port 21 of the addr3 of the state holding unit 16B to the “communicating” state (step S33).
[0105]
The ftp client 14 starts up a child process and prepares a new TCP connection for data transfer (step S34). Here, a case where port number 5001 is used as a data transfer port will be described as an example.
[0106]
The child process executes listen so as to wait for a TCP connection at port 5001 (step S35).
[0107]
Next, the child process executes the system call "accept" and blocks until the child process is connected to the port 5001 (step S36).
[0108]
During the processing of the accept system call, the OS of the terminal 4 sets the TCP connection information and the process ID of the child process as a set and registers them in the state holding unit 16B of the firewall 16. At this time, information on the connection of addr4 to the number 5001 is registered as “waiting for conditional connection” (step S37).
[0109]
Next, the ftp client 14 transfers a PORT command designating a port for data transfer using a TCP connection already established for the 21st port for control (step S38).
[0110]
On the other hand, the ftp server 13 receives the PORT command and records the port number 5001 as a parameter (step S39).
[0111]
Next, the ftp client 14 transmits a RETR command to acquire data (step S40).
[0112]
Upon receiving the RETR command, the ftp server 13 transmits data to port 5001 of addr4 (step S41).
[0113]
The firewall 16 detects the arrival of the TCP packet from the addr 3 to the port 5001 (step S42).
[0114]
Next, the firewall 16 searches the state holding unit 16B in the firewall 16 for the port 5001 in the “standby” or “conditional standby” state (step S43).
[0115]
If there is no “standby” or “conditional standby” state for port 5001 (step S44), the packet is discarded (step S45), and RST is returned (step S46). . As a result, the attempt of the TCP connection from the ftp server 13 fails.
[0116]
If any of the ports 5001 is in the "standby" or "conditional standby" state (step S44), only when a program that is already communicating dynamically makes a new connection. Allow connection. For this purpose, first, the firewall 16 acquires the ID of the parent process from the process ID of the process waiting for the number 5001 (step S47).
[0117]
Next, the firewall 16 searches each of the above processes or their parent processes for information indicating that there is information in the state holding unit 16B in the “communicating” state with the addr3 (step S48).
[0118]
If it does not exist (step S49), the firewall 16 discards the packet (step S45) and returns RST (step S46). As a result, the attempt of the TCP connection from the ftp server 13 fails.
[0119]
On the other hand, if there is information on the connection in the “communicating” state with the addr 3 in the state holding unit 16B (step S49), the firewall 16 continues the packet receiving process and simultaneously sets the number 5001. The information of the TCP connection to the port is registered as the “communicating” state, and the passage of the packet is permitted (step S50).
[0120]
As a result, when a TCP connection to the 5001 which the child process has been waiting for is established (step S51), data transfer is performed between the child process and the ftp server (step S52).
[0121]
When the data transfer ends, the ftp server 13 transmits a FIN packet (step S53).
[0122]
When the firewall 16 detects the arrival of the FIN packet to the port 5001, the firewall 16 changes the corresponding information in the state holding unit 16B to the “end waiting” state. The ftp client 14 transmits an ACK packet for the FIN as TCP termination processing (step S54). Then, upon termination of the child process on the terminal 14, close is executed (step S55).
[0123]
When detecting the transmission of the ACK packet from the 5001 port, the firewall 16 deletes the information of the connection of the 5001 port as the data transfer port from the state holding unit 16B (step S56). Then, the firewall 16 changes the setting of the firewall 16 so as to prohibit communication.
[0124]
Thus, the process for the data transfer connection is completed. When the ftp client 14 newly generates a data transfer connection, the same processing procedure as described above is repeatedly performed.
[0125]
When the ftp client 14 ends, the ftp client 14 issues a close system call (step S57).
[0126]
During the processing of the close system call, the operating system obtains information on the destination address, destination port, and destination port of the corresponding TCP connection from the socket descriptor specified by close, and performs communication of the corresponding TCP session. The connection information of the 21st port as the command port is deleted from the state holding unit 16B in the firewall 16 (step S58), and the passage of the packet is prohibited.
[0127]
As can be seen from the above description, in the terminal 4 having the configuration as shown in FIG. 6, even if there is no firewall function for performing an operation specialized for ftp in advance, the conventional terminal 4 can be connected through the firewall. It can be used without changing the ftp protocol. In addition to the ftp, the illustrated terminal 4 can be similarly applied to a protocol such as RTSP (Real Time Streaming Protocol) that newly creates a connection using a dynamically determined port number.
[0128]
FIG. 10 schematically shows another configuration example of the communication system to which the present invention is applied.
[0129]
In the figure, a network 6 is a local area network (LAN) such as a network which is laid in a specific organization such as a company or a home in a limited manner, to which a terminal 7 is connected and an Ipv6 address addr7 is assigned. Has been.
[0130]
The terminal 7 is a device equipped with an application that uses a network, and is configured by a computer such as a personal computer (PC) as an example. Of course, other forms of information such as home electric appliances having a network communication function are provided. It may be a device. In this specification, a device having an HTTP server 17 in the terminal device 7 will be described as an example.
[0131]
The network 6 is interconnected with another network 5 via a wide area network such as the Internet. A terminal 8 that can communicate with the network 5 according to the IPv6 protocol is connected to the network 5.
[0132]
The terminal 8 is a device that can communicate according to the IPv6 protocol, and is assigned an address addr8. The terminal 8 is configured by a computer such as a personal computer (PC) as an example, but may be another type of information device such as a home appliance having a network communication function. In this specification, a device having an HTTP client 18 in the terminal device 8 will be taken as an example.
[0133]
FIG. 11 schematically illustrates a functional configuration of the terminal device 7 that operates in the network illustrated in FIG. As shown in FIG. 1, a terminal device 7 includes an HTTP server 17 which is an application program for communicating using a network, an IP processing unit 15 for performing a data transfer process in accordance with an IP (Internet Protocol) protocol, and a network. And a firewall 16 for controlling whether or not a packet can pass through the firewall 6.
[0134]
An application such as the HTTP server 17 calls a system call which is a part of the function of the operating system (OS) when using the network, and transmits an instruction to the IP processing unit 15.
[0135]
The IP processing unit 15 converts the data passed from the application into an IP packet format, determines whether or not the data can be output by a firewall, and outputs the data. Also, the input / output of the IP packet received from the network is determined by the firewall, the format is converted, and the IP packet is passed to the application.
[0136]
The firewall 16 includes a setting unit 16A serving as an interface for setting rules, a state holding unit 16B for holding a communication state, and a control unit 16C. Rules are set through the setting unit 16A from a system call, which is an OS function called by the application during communication.
[0137]
In the state holding unit 16B, a source address and port, a destination address and port, a communication state, and an application ID are recorded as information on a connection such as TCP to which a passing packet belongs. As the application ID, an ID of each application using the network connection is recorded. For example, a process ID in the Unix OS can be used as an application ID. In addition, five states such as “connecting”, “standby”, “conditional standby”, “communicating”, and “end wait” are used.
[0138]
The control unit 16C in the firewall 16 uses the information in the state holding unit 16B to determine whether or not the packet can pass.
[0139]
The operation of the terminal device 7 according to the embodiment shown in FIG. 10 will be described with reference to an example of a communication procedure of connecting to the HTTP client 18 of the terminal 8 interconnected via the Internet 5 and providing a file. FIG. 12 shows the operation procedure of the terminal device 7 at this time in the form of a flowchart. FIG. 13 shows an operation sequence between the terminal device 7 and the terminal device 8 at this time.
[0140]
In the present embodiment, the firewall 16 on the terminal 7 is initially set so as to prohibit all communication.
[0141]
The HTTP server 17 executes a listen so as to wait for a TCP connection on the 80th port (step S61).
[0142]
Next, the HTTP server 17 executes an accept system call (step S62).
[0143]
The OS of the terminal 7 performs a process of waiting for a TCP connection at the 80th port as a process of the accept system call, and furthermore, establishes a “waiting” state for the connection to the connection destination port number of 80 and sets the firewall 16 to The information is registered in the state holding unit 16B (step S63).
[0144]
The HTTP server 17 makes a connection in response to a connection request to the port 80 from the HTTP client 18. The HTTP client 18 transmits data to port 80 of addr7 (step S64).
[0145]
The firewall 16 detects the arrival of the TCP packet from the addr 8 to the 80th port (step S65).
[0146]
Next, the firewall 16 searches the state holding unit 16B for a connection waiting for the port 80 (step S66).
[0147]
If a device waiting for connection to port 80 cannot be found (step S67), RST is returned (step S68), and the packet is discarded (step S69). As a result, the TCP connection attempt from the HTTP server 17 fails.
[0148]
On the other hand, if a connection waiting for the connection to the 80th port can be found (step S67), the passage of the packet is permitted, and the information on the connection of the state holding unit 16B is changed to the “communicating” state ( Step S70).
[0149]
As a result, a TCP connection to the port 80 in the "standby" state is established (step S71), and data transfer is performed between the HTTP server 17 and the HTTP client 18 (step S72).
[0150]
When the data transfer by the HTTP protocol ends, the HTTP server 17 transmits a FIN packet (Step S73).
[0151]
The HTTP client 18 transmits an ACK packet for the FIN as TCP termination processing (step S74).
[0152]
The firewall 16 detects the end of the TCP connection with the HTTP client 18 by detecting the reception of the ACK packet on the 80th port (step S75).
[0153]
Next, the firewall 16 returns the information on the 80th port in the state holding unit 16B to the “standby” state (step S76), and permits the HTTP server 17 to connect from the designated source.
[0154]
The operation of the firewall 16 described with reference to FIGS. 12 and 13 can be similarly applied to all programs that wait for a connection using the listen and accept system calls. The settings of the wall 16 can be dynamically changed.
[0155]
FIG. 14 schematically shows another functional configuration of the terminal device 7 operating in the network shown in FIG. As shown in FIG. 1, a terminal device 4 includes an HTTP server 17 which is an application program for communicating using a network, an IP processing unit 15 for performing a data transfer process in accordance with an IP (Internet Protocol) protocol, and a network. And a firewall 16 for controlling whether or not a packet can pass through the firewall 6.
[0156]
An application such as the HTTP server 17 calls a system call which is a part of the function of the operating system (OS) when using the network, and transmits an instruction to the IP processing unit 15.
[0157]
The IP processing unit 15 converts the data passed from the application into an IP packet format, determines whether or not the data can be output by a firewall, and outputs the data. Also, the input / output of the IP packet received from the network is determined by the firewall, the format is converted, and the IP packet is passed to the application.
[0158]
The firewall 16 includes a setting unit 16A serving as an interface for setting rules, a state holding unit 16B for holding a communication state, and a control unit 16C. Rules are set through the setting unit 16A from a system call, which is an OS function called by the application during communication.
[0159]
In the state holding unit 16B, a source address and port, a destination address and port, a communication state, and an application ID are recorded as information on a connection such as TCP to which a passing packet belongs. As the application ID, an ID of each application using the network connection is recorded. For example, a process ID in a Unix-based operating system can be used as an application ID. In addition, five states such as “connecting”, “standby”, “conditional standby”, “communicating”, and “end wait” are used.
[0160]
The control unit 16C in the firewall 16 uses the information in the state holding unit 16B to determine whether or not the packet can pass.
[0161]
The main difference between the terminal 7 shown in FIG. 14 and the terminal shown in FIG. 11 is that the process in which the HTTP server 17 waits for the TCP connection on the 80th port is different.
[0162]
The operation of the terminal device 7 according to the embodiment shown in FIG. 14 will be described with reference to an example of a communication procedure of connecting to the HTTP client 18 of the terminal 8 interconnected via the Internet 5 and providing a file. FIG. 15 shows the operation procedure of the terminal device 7 at this time in the form of a flowchart. FIG. 16 shows an operation sequence between the terminal device 7 and the terminal device 8 at this time.
[0163]
In the present embodiment, the firewall 16 on the terminal 7 is initially set so as to prohibit all communication.
[0164]
The HTTP server 17 executes listen so as to wait for a TCP connection at the 80th port (step S81).
[0165]
Next, the HTTP server 17 executes a fw_accept system call (step S82). fw_accept is an extension of the function of the accept system call, and the argument of fw_accept specifies addr3 as an address permitting connection in addition to the argument of accept.
[0166]
The conventional system call accept is
int accept (int s, structure sockaddr * addr, socklen_t * addrlen);
[0167]
And the argument addr is used to receive the address of the communication partner after connection. On the other hand, fw_accept is
[0168]
fw_accept (int s, structure sockaddr * accept_addr, structure sockaddr * accept_mask, socklen_t * addrlen, structure sockaddr * addr, t * ndr; n * sdr)
[0169]
, And the address permitted to be connected is specified by the argument accept_addr. Then, the HTTP server 17 specifies addr8 as an address for permitting the connection, in addition to the argument at the time of calling the normal accept as the argument of fw_accept.
[0170]
The OS of the terminal 7 performs the same processing as that of the normal accept system call as the processing of the fw_accept system call, and furthermore, from the addr3 passed as its argument, the connection for the connection destination port number 80 is "standby". The state is registered in the state holding unit 16B of the firewall 16 (step S83).
[0171]
The HTTP client 18 transmits data to port 80 of addr7 (step S84).
[0172]
The firewall 16 detects the arrival of the TCP packet from the addr 8 to the 80th port (step S85).
[0173]
Next, the firewall 16 refers to the state holding unit 16B and compares the information in the “standby” state with the address specified as the source address in the information and the address that sent the packet. (Step S86).
[0174]
If a device waiting for connection to the 80th port cannot be found (step S87), RST is returned (step S88), and the packet is discarded (step S89). As a result, the TCP connection attempt from the HTTP server 17 fails.
[0175]
On the other hand, if addr8 is specified, a server waiting for a connection to port 80 is found (step S87). In this case, it is further determined whether or not the source address is permitted (step S90).
[0176]
Since the firewall 16 has already been set to allow this connection, it allows the passage of the packet and changes the information on the connection of the state holding unit 16B to the “communicating” state (step S91). As a result, a TCP connection to port 80 in the "standby" state is established (step S92), and data transfer is performed between the HTTP server 17 and the HTTP client 18 (step S93).
[0177]
When the data transfer ends, the HTTP server 17 transmits a FIN packet (Step S94).
[0178]
The HTTP client 18 transmits an ACK packet for the FIN as TCP termination processing (step S95).
[0179]
The firewall 16 detects the end of the TCP connection with the HTTP client 18 by detecting the reception of the ACK packet on the 80th port (step S96).
[0180]
Next, the firewall 16 returns the information on the 80th port in the state holding unit 16B to the “standby” state (step S97), and permits the HTTP server 17 to connect from the designated source.
[0181]
FIG. 17 schematically illustrates a functional configuration of the terminal device 8 that operates in the network illustrated in FIG. As shown in the figure, a terminal device 8 includes an HTTP client 18 which is an application program for communicating using a network, an IP processing unit 15 for performing a data transfer process according to an IP (Internet Protocol) protocol, A firewall 16 for controlling whether or not packets can pass through the network 6;
[0182]
An application such as the HTTP client 18 calls a system call which is a part of the function of the operating system (OS) when using the network, and transmits an instruction to the IP processing unit 15.
[0183]
The IP processing unit 15 converts the data passed from the application into an IP packet format, determines whether or not the data can be output by a firewall, and outputs the data. Also, the input / output of the IP packet received from the network is determined by the firewall, the format is converted, and the IP packet is passed to the application.
[0184]
The firewall 16 includes a setting unit 16A serving as an interface for setting rules, a state holding unit 16B for holding a communication state, and a control unit 16C. Rules are set through the setting unit 16A from a system call, which is an OS function called by the application during communication.
[0185]
In the state holding unit 16B, a source address and port, a destination address and port, a communication state, and an application ID are recorded as information on a connection such as TCP to which a passing packet belongs. As the application ID, an ID of each application using the network connection is recorded. For example, a process ID in the Unix OS can be used as an application ID. In addition, five states such as “connecting”, “standby”, “conditional standby”, “communicating”, and “end wait” are used.
[0186]
The control unit 16C in the firewall 16 uses the information in the state holding unit 16B to determine whether or not the packet can pass.
[0187]
The operation of the terminal device 8 according to the embodiment shown in FIG. 17 will be described using an example of a communication procedure for connecting to the HTTP server 17 of the terminal 8 interconnected via the Internet 5 and acquiring a file. FIG. 18 shows the operation procedure of the terminal device 8 at this time in the form of a flowchart. FIG. 19 shows an operation sequence between the terminal device 7 and the terminal device 8 at this time.
[0188]
In the present embodiment, the firewall 16 on the terminal 8 is initially set so as to prohibit all communication.
[0189]
The HTTP client 18 executes a connect to the 80th port of the IPv6 address addr7 of the terminal 7 for connecting to the HTTP server 17 (step S101).
[0190]
During the processing of the connect system call, the OS of the terminal 8 sets the information of the TCP connection such as the connection destination address addr7 and the port number 80 as its arguments and the process ID of the HTTP client 18 as a set, and It is registered in the state holding unit 16B (step S102). At this time, information on this connection is registered in the state holding unit 16B as a “connected” state.
[0191]
The SYN packet is transmitted from the HTTP client 18 to the port 80 of the addr 7 and received by the HTTP server 17. The HTTP server 17 transmits an ACK packet to establish a TCP connection (Step S103).
[0192]
The firewall 16 finds an ACK packet from the port 80 of the addr 7 (step S104), and searches the state holding unit 16B for a corresponding state (step S105).
[0193]
If a device waiting for a connection to the 80th port cannot be found (step S106), RST is returned (step S107), and the packet is discarded (step S108). As a result, an attempt to make a TCP connection to the HTTP server 17 fails.
[0194]
On the other hand, if a device waiting for a connection to the 80th port can be found (step S106), it is further determined whether or not the source address is permitted (step S109).
[0195]
If the source address is not permitted, RST is returned (step S107), and the packet is discarded (step S108). As a result, an attempt to make a TCP connection to the HTTP server 17 fails.
[0196]
If the source address is permitted, the passage of the packet is permitted, and the information on the connection of the state holding unit 16B is changed to the “communicating” state (step S110).
[0197]
Subsequently, an ACK packet is transmitted from the HTTP client 18, and the HTTP server 17 receives the ACK packet, thereby establishing a TCP connection to the 80th port (step S111), and transmitting data between the HTTP server 17 and the HTTP client 18. The transfer is performed (Step S112).
[0198]
When the data transfer by the HTTP protocol ends, the HTTP server 17 sends a FIN packet (step S113).
[0199]
Upon detecting the end of the TCP connection with the HTTP client 18 by detecting the reception of the ACK packet on the 80th port, the firewall 16 sets the information on the 80th port of the state holding unit 16B to the “end wait” state. It is changed (step S114).
[0200]
The HTTP client 18 transmits an ACK packet for the FIN to the HTTP server 17 as TCP termination processing (step S115).
[0201]
Subsequently, the HTTP client 18 transmits a FIN packet to the HTTP server 17 (Step S116). In response, the HTTP server 17 transmits an ACK packet (step S117).
[0202]
The firewall 16 detects the end of the TCP connection with the HTTP client 18 by detecting the reception of the ACK packet on the 80th port (step S118).
[0203]
The firewall 16 deletes the information on the connection of the 80th port from the state holding unit 16B (step S119). Then, the firewall 16 changes the setting of the firewall 16 so as to prohibit communication.
[0204]
The operation of the firewall 16 described with reference to FIGS. 18 and 19 can be similarly applied to all programs that wait for a connection using a connect system call. Can be dynamically changed.
[0205]
[Supplement]
The present invention has been described in detail with reference to the specific embodiments. However, it is obvious that those skilled in the art can modify or substitute the embodiment without departing from the scope of the present invention. That is, the present invention has been disclosed by way of example, and the contents described in this specification should not be interpreted in a limited manner. In order to determine the gist of the present invention, the claims described at the beginning should be considered.
[0206]
【The invention's effect】
As described above in detail, according to the present invention, it is possible to monitor a packet located at the boundary of a network and pass the packet, and appropriately perform access control such as passing or discarding the packet according to a set rule. , An excellent access control device and access control method, and a computer program can be provided.
[0207]
Further, according to the present invention, even when data communication is performed using a protocol that newly establishes a network connection using a dynamically determined port number, an excellent access control can be performed. An access control device, an access control method, and a computer program can be provided.
[0208]
Further, according to the present invention, there is provided an excellent access control device in which a firewall built in each terminal device connected to a network can perform appropriate access control in cooperation with an application of the terminal device. An access control method and a computer program can be provided.
[0209]
Further, according to the present invention, the initial setting of the firewall is set to a state where communication is not permitted, and dynamically changed when the setting of the firewall becomes necessary for the application to perform communication. An excellent access control device, an excellent access control method, and a computer program capable of changing settings can be provided.
[0210]
According to the present invention, when using a network, by dynamically changing the setting of the firewall using the contents of the parameters of the system call to be used, it is not necessary to set the firewall in advance. In addition, the network can be used while enhancing security.
[0211]
Further, according to the present invention, it is not necessary to add a special code for controlling the firewall to the application. Also, it is not necessary to incorporate a unique processing mechanism corresponding to a protocol such as ftp into the firewall.
[Brief description of the drawings]
FIG. 1 is a diagram schematically showing a configuration example of a communication system to which the present invention is applied.
FIG. 2 is a diagram schematically showing a functional configuration of a terminal device 4 operating on the network shown in FIG.
FIG. 3 is a flowchart showing an operation procedure in the terminal device 4 according to the embodiment shown in FIG.
4 is a flowchart showing an operation procedure in the terminal device 4 according to the embodiment shown in FIG.
FIG. 5 is a sequence diagram showing an operation between the terminal device 4 and the terminal device 3 according to the embodiment shown in FIG.
FIG. 6 is a diagram schematically showing another functional configuration of the terminal device 4 operating on the network shown in FIG. 1;
7 is a flowchart showing an operation procedure in the terminal device 4 according to the embodiment shown in FIG.
8 is a flowchart showing an operation procedure in the terminal device 4 according to the embodiment shown in FIG.
9 is a sequence diagram showing an operation between the terminal device 4 and the terminal device 3 according to the embodiment shown in FIG.
FIG. 10 is a diagram schematically illustrating another configuration example of a communication system to which the present invention is applied;
11 is a diagram schematically showing a functional configuration of a terminal device 7 operating on the network shown in FIG.
FIG. 12 is a flowchart showing an operation procedure in the terminal device 7 according to the embodiment shown in FIG.
13 is a sequence diagram showing an operation between the terminal device 7 and the terminal device 8 according to the embodiment shown in FIG.
FIG. 14 is a diagram schematically showing a functional configuration of a terminal device 7 operating on the network shown in FIG. 10;
15 is a flowchart showing an operation procedure in the terminal device 7 according to the embodiment shown in FIG.
FIG. 16 is a sequence diagram showing an operation between the terminal device 7 and the terminal device 8 according to the embodiment shown in FIG.
FIG. 17 is a diagram schematically showing a functional configuration of a terminal device 8 operating on the network shown in FIG. 10;
18 is a flowchart showing an operation procedure in the terminal device 8 according to the embodiment shown in FIG.
FIG. 19 is a sequence diagram showing an operation between the terminal device 7 and the terminal device 8 according to the embodiment shown in FIG.
FIG. 20 is a diagram showing a functional configuration (conventional example) of a terminal device in which packet filtering software is installed.
FIG. 21 is a sequence diagram showing an operation of a normal ftp client (conventional example).
[Explanation of symbols]
3. Terminal equipment (FTP server)
4: Terminal equipment (FTP client)
5. Network (Internet)
6. Network (LAN)
13 ... FTP server
14 ... FTP client

Claims (27)

An access control device for controlling access to a device connected to a network,
A firewall that monitors input / output packets to and from the network interface and controls whether or not packets can pass based on a predetermined control rule;
A system call comprising a setting unit for interpreting a call parameter that the application program calls during communication and changing the control rule;
An access control device, comprising: The firewall is a state holding unit that holds a state of communication related to a network connection to which a passing packet belongs, and a control unit that determines whether or not to allow a packet to pass according to the state of communication held in the state holding unit. ,
The access control device according to claim 1, further comprising: The state holding unit records a source address and port, a destination address and port, a communication state, and an application ID regarding a network connection to which a passing packet belongs,
The control unit determines whether or not the packet can pass by referring to the state of the ID of the application that is the destination of the received packet.
3. The access control device according to claim 2, wherein: The control unit refers to a list of application IDs related to the application from the ID of the application that is the destination of the received packet, searches for session information by the relevant application ID, and determines whether the destination of the session and the source of the packet are Judge whether they match, and if they match, allow the packet to pass.
3. The access control device according to claim 2, wherein: The setting unit registers the state of the child process started from the original application at the time of a connection request from the outside in the state holding unit,
3. The access control device according to claim 2, wherein: The setting unit, when generating a child process from the original application, to register the state in the state holding unit,
3. The access control device according to claim 2, wherein: In a system call for starting a network connection, a call parameter called by an application program during communication includes a parameter describing a firewall control rule,
The access control device according to claim 1, wherein: In a system call for waiting for a connection, a call parameter called by an application program during communication includes a parameter describing a firewall control rule,
The access control device according to claim 1, wherein: The firewall allows the passage of a packet for initiating a connection to a destination specified by the application when a communication state regarding a network connection to which a passing packet belongs is being connected.
The access control device according to claim 1, wherein: The firewall is configured to permit two-way communication from a specified source to a destination when a communication state of a network connection to which a passing packet belongs is in communication.
The access control device according to claim 1, wherein: The firewall allows a connection from a source specified for an application when a communication state regarding a network connection to which a passing packet belongs is a standby.
The access control device according to claim 1, wherein: The firewall is configured to permit connection only when a communication state relating to a network connection to which a passing packet belongs is a conditional standby, and when a program already in a communication state dynamically makes a new connection,
The access control device according to claim 1, wherein: The firewall indicates that the state of the communication regarding the network connection to which the passing packet belongs is waiting for termination, that the connection is in the middle of a procedure for terminating the connection,
The access control device according to claim 1, wherein: An access control method for controlling access to a device connected to a network,
A packet passing control step of monitoring input / output packets to / from the network interface and controlling whether or not the packet can pass based on a predetermined control rule;
A control rule change step of interpreting a call parameter called by the application program during communication and changing the control rule,
An access control method, comprising: In the packet passing control step, while holding the state of communication related to the network connection to which the passing packet belongs, to determine whether to allow the packet passage according to the held state of the communication,
The access control method according to claim 14, wherein: As the communication status, the source address and port, the destination address and port, the communication status, and the application ID regarding the network connection to which the passing packet belongs are recorded.
Determine whether or not the packet can pass by referring to the state of the ID of the application that is the destination of the received packet.
The access control method according to claim 15, wherein: From the information on the communication state held, the application refers to a list of application IDs related to the application from the ID of the application that is the destination of the received packet, and searches for session information by the relevant application ID. Determines whether the destination of the packet matches the source of the packet, and if so, allows the packet to pass.
The access control method according to claim 15, wherein: As the communication status, the status of the child process launched from the original application when a connection request is received from the outside,
The access control method according to claim 15, wherein: As the state of communication, hold that state when creating a child process from the original application,
The access control method according to claim 15, wherein: In a system call for starting a network connection, a call parameter called by an application program during communication includes a parameter describing a firewall control rule,
The access control method according to claim 14, wherein: In a system call for waiting for a connection, a call parameter called by an application program during communication includes a parameter describing a firewall control rule,
The access control method according to claim 14, wherein: In the packet passing control step, if the communication state regarding the network connection to which the passing packet belongs is connecting, allowing the passage of the packet for starting the connection to the destination specified by the application,
The access control method according to claim 14, wherein: In the packet passing control step, if the communication state regarding the network connection to which the passing packet belongs is in communication, permit bidirectional communication from the designated source to the destination,
The access control method according to claim 14, wherein: In the packet passing control step, when the communication state regarding the network connection to which the passing packet belongs is a standby, the connection from the source specified for the application is permitted.
The access control method according to claim 14, wherein: In the packet passing control step, if the communication state relating to the network connection to which the passing packet belongs is conditional waiting, only when the program already in the communication state dynamically establishes a new connection, the connection is permitted.
The access control method according to claim 14, wherein: In the packet passing control step, if the state of communication related to the network connection to which the passing packet belongs is waiting for termination, it indicates that the connection is in the middle of a procedure for terminating the connection,
The access control method according to claim 14, wherein: A computer program written in a computer-readable format to execute a process for controlling access to a device connected to a network on a computer system,
A packet passing control step of monitoring input / output packets to / from the network interface and controlling whether or not the packet can pass based on a predetermined control rule;
A control rule change step of interpreting a call parameter called by the application program during communication and changing the control rule,
A computer program comprising:

Images