JP2006195924A - Network compatible electronic device - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To provide an electronic device capable of preventing traffic increase and controlling a threshold to restrict communication according to an operating state even when a large amount of abnormal data is transmitted from a networked household electric appliance itself. <P>SOLUTION: The electronic device 1 comprises a traffic measurer 105 for measuring the amount of data to transmit, a threshold controller 106 for controlling a restrictive threshold to restrict the amount of data to transmit, a traffic controller 104 for controlling the amount of data to transmit when the amount of data measured by the traffic measurer 105 exceeds the restrictive threshold, and a traffic change signal detector 103 for detecting a signal of change in traffic to/from a network 2. Upon detecting the signal of change in traffic, the traffic change signal detector 103 prompts the threshold controller 106 to change the restrictive threshold to a value suitable for the operating state after traffic change. <P>COPYRIGHT: (C)2006,JPO&NCIPI

Description

  The present invention relates to an electronic device connectable to a network, and more particularly to an electronic device capable of controlling traffic on the network.

  In recent years, with the spread of computer networks and network connection devices typified by the Internet, an environment for constant connection to the Internet such as ADSL and FTTH has been actively introduced into businesses and homes. Along with this, many appliances used in homes and the like have begun to have an interface for network connection, and network connection has become possible (hereinafter, electric appliances that can be connected to a network are referred to as network appliances). ).

  However, when the home appliance is always connected to the outside network, the home appliance connected to the home may be an attack target such as unauthorized access. Unauthorized access is an unauthorized attack made from an external network. For example, as unauthorized access, there are illegal intrusions into internet home appliances, attacks that disable services by sending large amounts of data to internet home appliances (DDoS Attack), attacks targeting vulnerabilities in home systems, etc. . By receiving such an attack, the user of the home appliance may become aware of the unauthorized access to other devices without being aware of the user of the home appliance. There is sex. For example, when an internet home appliance is infected with a virus or a worm, the infected internet home appliance may cause a DoS attack to an external device. In addition, external unauthorized access may occur due to problems or software bugs existing in the Internet home appliance itself. Such unauthorized access generally transmits a large amount of data, and increases traffic abnormally.

  Conventionally, an intrusion detection system (Intrusion Detection System) has been proposed as a system for preventing unauthorized access. For example, in order to detect unauthorized access, the intrusion detection system uses pattern data (signature) obtained by patterning the characteristics of a packet that is presumed to be an attack, and compares the packet flowing over the network with the signature. If they match, it is possible that an attack has occurred and measures are taken to prevent unauthorized access. Intrusion detection systems that use signatures are called signature types.

Also, by measuring traffic between networks and devices, it can be determined whether or not an attack has occurred, and if traffic exceeds a certain limit, it is determined that the attack has occurred and is used to prevent unauthorized access. A system for taking measures has been proposed (see Patent Document 1). As a means for preventing unauthorized access, the system described in Patent Literature 1 calculates the amount of data transmitted from the Internet to an Internet home appliance and the IP address of the transmission source that transmitted the data at predetermined time intervals. When the measured data amount is equal to or greater than a preset specified value, the data from the specific source IP address that has transmitted the data amount equal to or greater than the specified value is discarded.
JP 2002-16633 A

  As described above, the conventional signature-type intrusion detection system and the system described in Patent Document 1 can detect that traffic has increased abnormally due to abnormal data transmitted to network home appliances. However, in such a conventional system, traffic is abnormally increased by sending a large amount of abnormal data from the Internet home appliance itself due to the Internet home appliance becoming a stepping stone or due to a software bug on the Internet home appliance. I could not cope with the situation.

  In addition, in the system described in Patent Document 1, since the specified value for detecting an abnormality is a fixed value, when the traffic fluctuates greatly depending on the operating state of the Internet home appliance, erroneous detection or overdetection may occur. May occur. In such a situation, because the default value for determining an abnormality is too high, even if an abnormal increase in traffic occurs, the communication is permitted as a result of determining that the communication is normal. Occurs when Alternatively, such a situation occurs when the default value for determining an abnormality is too small, and communication is restricted as a result of being determined to be abnormal communication despite normal communication. To do.

  Therefore, an object of the present invention is to prevent an increase in traffic even when a large amount of abnormal data is transmitted from the network home appliance itself, and to limit communication according to the operation state. An electronic device capable of controlling a threshold value is provided.

  In order to solve the above problems, the present invention has the following features. The present invention is a network compatible electronic device capable of communicating with a device connected to a network, and controls a traffic measurement means for measuring the amount of data to be transmitted and a limit threshold for limiting the amount of data to be transmitted. If the amount of data measured by the threshold control means and the traffic measurement means exceeds the limit threshold, a traffic control means for controlling the amount of data to be transmitted and a sign of change in traffic between the networks are detected. Traffic change sign detection means. The traffic change sign detection means, when detecting a sign that the traffic changes, causes the threshold control means to change the limit threshold value to a value suitable for the operation state after the traffic change.

  According to the present invention, when the amount of data to be transmitted exceeds the limit threshold, the amount of data to be transmitted is limited. Therefore, even if a large amount of abnormal data is transmitted, traffic increases. Will be prevented. Furthermore, according to the present invention, when a sign of traffic change is detected, the limit threshold is changed to a value suitable for the operation state after the traffic change, so that the communication is limited according to the operation state. An electronic device capable of controlling the threshold value is provided.

  Preferably, the threshold control means stores information on a trigger packet that is a precursor to changing traffic and a candidate threshold corresponding to the trigger packet as threshold information, and the traffic change precursor detection means is based on the threshold information, It is determined whether or not a packet to be transmitted / received is a trigger packet. When the packet is a trigger packet, a candidate threshold corresponding to the trigger packet may be set as a limit threshold.

  Thereby, the limit threshold suitable for the operation state after the traffic change is set only by setting the candidate threshold corresponding to the trigger packet as the limit threshold.

  For example, the traffic control means may control the amount of data to be transmitted by discarding all of the data to be transmitted.

  As a result, the electronic device does not transmit any abnormally large amount of data.

  For example, the traffic control means may control the amount of data to be transmitted by discarding part of the data to be transmitted.

  Thereby, the electronic device can ensure a certain amount of communication.

  For example, the traffic control means may control the amount of data to be transmitted by not transmitting data for a specific destination.

  As a result, the electronic device does not send a large amount of data to a specific destination.

  Preferably, the threshold control unit may return the current limit threshold to the limit threshold before the change when a state in which the amount of data measured by the traffic measurement unit is below the limit threshold continues for a certain period of time.

  As a result, the electronic device returns the limit threshold to the original limit threshold after a certain period of time has elapsed.

  Preferably, the threshold control unit is configured so that only when the current limit threshold is larger than the limit threshold before the change, when the state in which the amount of data measured by the traffic measurement unit is below the limit threshold continues for a certain period of time, The limit threshold value may be returned to the limit threshold value before the change.

  Thus, the electronic device can be changed to a state with a low limit threshold if the state with a high limit threshold continues for a certain period. Therefore, if a worm or computer virus that abuses a state with a high limit threshold value illegally transmits a large amount of data, it can be avoided.

  Preferably, the traffic measurement unit measures an average value of the amount of data to be transmitted, and the traffic control unit controls the amount of data to be transmitted when the average value measured by the traffic measurement unit exceeds a limit threshold. Good.

  Thereby, an electronic device that operates stably is provided.

  According to the present invention, when the amount of data to be transmitted exceeds the limit threshold, the amount of data to be transmitted is limited. Therefore, even if a large amount of abnormal data is transmitted, traffic increases. Will be prevented. Furthermore, according to the present invention, when a sign of traffic change is detected, the limit threshold is changed to a value suitable for the operation state after the traffic change, so that the communication is limited according to the operation state. An electronic device capable of controlling the threshold value is provided. Therefore, even when the traffic fluctuates greatly according to the operation mode of the electronic device, the electronic device can control the traffic without erroneous detection or overdetection.

  Hereinafter, embodiments of the present invention will be described with reference to the drawings.

  FIG. 1 is a block diagram illustrating a configuration of an entire system to which an electronic device 1 according to an embodiment of the present invention is applied and a functional configuration of the electronic device 1. In FIG. 1, an electronic device 1 is connected to a PC 3 via a network 2. Here, although the number of PCs connected to the electronic device 1 is one, it may be two or more.

  The electronic device 1 is an electronic device such as a network camera, a TV, a DVD device, an HD-DVD device, an audio component, a PC, a portable information terminal, a mobile phone, and the like, and is connected to the network 2 by wire and / or wireless. This is a network-compatible electronic device that can communicate with other connected devices.

  The PC 3 is an electronic device that can communicate with the electronic device 1 via the network 2.

  The network 2 is, for example, the Internet network.

  In FIG. 1, the electronic device 1 includes a communication control unit 101 and a device application unit 102. The communication control unit 101 includes a traffic change sign detection unit 103, a traffic control unit 104, a traffic measurement unit 105, and a threshold control unit 106.

  The communication control unit 101 receives a packet transmitted via the network 2, transmits the packet to the device application unit 102, and transmits a packet from the device application unit 102 to the network 2. Further, the communication control unit 101 controls traffic between the electronic device 1 and the network 2 by controlling the amount of packets to be transmitted. The traffic is controlled in order to prevent an abnormal increase in traffic due to data transmitted from the electronic device 1 to the network 2.

  The device application unit 102 executes an application included in the electronic device 1. Basically, the application to be executed is an application desired by the user. However, in this embodiment, the device application unit 102 executes undesired processing due to a worm, a computer virus, or the like. The device application unit 102 receives a packet from the communication control unit 101 and transmits the packet to the communication control unit 101 as necessary.

  The traffic change sign detection unit 103 detects a sign that the traffic between the network 2 and the electronic device 1 changes. Specifically, the traffic change sign detection unit 103 analyzes whether a packet is sent from the network 2 or the traffic control unit 104, and detects whether the packet is a trigger packet. Here, the trigger packet refers to a packet including information that is a precursor to traffic change. For example, a packet (moving image transfer request packet) from the PC 3 to the electronic device 1 including a moving image transfer request, a packet (moving image transfer end request packet) from the PC 3 to the electronic device 1 including a moving image transfer end request, an electronic A packet (for example, an MPEG2-TS header) containing information indicating the start of moving image transmission by the device 1 or a packet (for example, the last in MPEG2-TS) including information indicating the end of moving image transmission by the electronic device 1 Packet) becomes the trigger packet.

  When the traffic change sign detection unit 103 detects a trigger packet, the traffic change sign detection unit 103 instructs the threshold control unit 106 to control the threshold. The traffic change sign detection unit 103 transmits a packet from the traffic control unit 104 to the network 2 and transmits a packet from the network 2 to the device application unit 102.

  The traffic measurement unit 105 measures the amount of packets from the device application unit 102, that is, the amount of data to be transmitted, and transmits the measured data amount to the traffic control unit 104 as a measured traffic value. Are sent to the traffic control unit 104.

  The traffic control unit 104 compares the measured traffic value from the traffic control unit 104 with the limit threshold set in the threshold control unit 106, and determines the packet sent from the traffic measurement unit 105 as the traffic change sign detection unit 103. Or the amount of data to be transmitted is controlled by determining whether to discard the packet transmitted from the traffic control unit 104. Here, the limit threshold is a threshold set to limit the amount of data to be transmitted.

  The threshold control unit 106 stores threshold information in which a threshold corresponding to the type of trigger packet is registered as a candidate threshold. The threshold control unit 106 sets the candidate threshold registered in the threshold information as a limit threshold according to an instruction from the traffic change sign detection unit 103, and sets the limit threshold according to an instruction from the traffic control unit 104. Pass to the traffic control unit 104.

  FIG. 2 is a diagram illustrating an example of threshold information. As illustrated in FIG. 2, the threshold information includes information related to the trigger packet and a candidate threshold in association with the list number. Here, it is assumed that the information regarding the trigger packet includes the transmission source IP address, the transmission destination IP address, and the packet contents. The transmission source IP address is information indicating the transmission source of the trigger packet. When the transmission source is not particularly specified, “any” is registered. When specifying a transmission source, an IP address is registered. The transmission destination IP address is information indicating the transmission destination of the trigger packet. When the transmission destination is not particularly specified, “any” is registered. When specifying a transmission destination, an IP address is registered. The packet content is information indicating the content of the trigger packet. For example, the contents of the packet include a moving image transfer request, a moving image transfer end request, moving image start information, moving image end information, and the like. The candidate threshold is a threshold for determining packet discard in the traffic control unit 104, and is the total number of packets measured within a certain time, the total packet size measured within a certain time, or the like. The candidate threshold value is set to a value suitable for the operation state after the traffic changes due to transmission / reception of the corresponding trigger packet. In the example shown in FIG. 2, the total size of the packets measured per second is used as the threshold value. As described above, the threshold information describes information about the trigger packet that is a precursor to changing the traffic and the candidate threshold corresponding to the trigger packet. By recognizing the feature described in the threshold information, the electronic device 1 can determine whether or not the received packet is a trigger packet.

  In the list number “1” shown in FIG. 2, the candidate threshold is set to 2.5 Mbps when the packet content is “video transfer request”. As described above, when the video transfer request is issued from another device, the electronic device 1 transmits a large amount of data to the other device after the request, which is suitable for the operation state after the traffic change. As a value, the candidate threshold is set high.

  In the list number “2”, the candidate threshold is set to 0.5 Mbps when the packet content is “video transfer end request”. When the video transfer end request is received from another device, the electronic device 1 ends the transmission of a large amount of data, so the candidate threshold is set low as a value suitable for the operation state after the traffic change.

  In the list number “3”, the candidate threshold is set to 2.5 Mbps when the content of the packet is “moving image start information”. In the list number “3”, unlike the list number “1”, it is assumed that the electronic device 1 transmits moving image data by itself. The “moving picture start information” is, for example, MPEG2-TS header information. When the start information of the moving image is input to the traffic control unit 104, a large amount of data is output from the device application unit 102 after that. As a value suitable for the operation state after the traffic change, the candidate threshold value is It is set high.

  In the list number “4”, unlike the list number “2”, it is assumed that the electronic device 1 has transmitted moving image data by itself. “Movie end information” is, for example, information included in the last packet of MPEG2-TS. When the end information of the moving image is input to the traffic control unit 104, transmission of a large amount of data is thereafter terminated, so that the candidate threshold is set low as a value suitable for the operation state after the traffic change.

  FIG. 3 is a flowchart showing the operation of the electronic device 1 when transmitting a packet. Hereinafter, the operation of the electronic apparatus 1 when transmitting a packet will be described with reference to FIG.

  First, the device application unit 102 outputs a packet to be transmitted (step S101). Next, the traffic measurement unit 105 counts the number of packets output by the device application unit 102, obtains the number of packets output per fixed time, and sets the data size according to the number of packets per fixed time. The measured traffic value is set (step S102).

  Next, the traffic control unit 104 determines whether or not the measured traffic value obtained by the traffic measurement unit 105 is equal to or greater than the limit threshold set in the threshold control unit 106 (step S103). If the measured traffic value is greater than or equal to the limit threshold, the traffic control unit 104 discards all packets sent from the traffic measurement unit 105 (step S104) and ends the process. On the other hand, if the measured traffic value is not equal to or greater than the limit threshold, the traffic control unit 104 sends the packet sent from the traffic measurement unit 105 to the traffic change sign detection unit 103, and proceeds to the operation of step S105.

  In step S105, the traffic change sign detection unit 103 determines whether or not the packet transmitted from the traffic control unit 104 is a trigger packet. If the packet is a trigger packet, the threshold value registered in the threshold control unit 106 is determined. With reference to the information, control is performed so that the candidate threshold corresponding to the trigger packet becomes the limit threshold, and the process is terminated.

  FIG. 4 is a flowchart showing a detailed operation of the traffic change sign detection unit 103 in step S105 of FIG. The detailed operation of the traffic change sign detection unit 103 in step S105 of FIG. 3 will be described below with reference to FIG.

  First, the traffic change sign detection unit 103 determines whether or not the packet sent from the traffic control unit 104 is a trigger packet, that is, whether or not there is a sign that traffic between the network 2 and the network 2 changes. (Step S201). Specifically, the traffic change sign detection unit 103 recognizes the content of the packet, determines whether or not the recognized packet content is registered in the threshold information in the threshold control unit 106, and is registered. If it is, it is determined that it is a trigger packet. If the packet is not a trigger packet, the traffic change sign detection unit 103 sends the packet to the network 2 (step S202) and ends the process. On the other hand, if the packet is a trigger packet, the traffic change sign detection unit 103 proceeds to the operation of step S203.

  In step S203, the traffic change sign detection unit 103 refers to the threshold information and recognizes a candidate threshold corresponding to the content of the packet of the trigger packet. Next, the traffic change sign detection unit 103 controls the threshold control unit 106 so that the candidate threshold recognized in step S203 is set as the limit threshold. In response, the threshold control unit 106 changes the limit threshold (step S204). As a result, the limit threshold is changed to a value suitable for the operation state after the traffic change. Next, the traffic change sign detection unit 103 sends the packet sent from the traffic control unit 104 to the network 2 (step S205), and ends the process.

  FIG. 5 is a flowchart showing the operation of the electronic device 1 when receiving a packet sent from the network 2. Hereinafter, the operation of the electronic apparatus 1 when receiving a packet will be described with reference to FIG.

  When a packet is sent from the network 2, the traffic change sign detection unit 103 receives the sent packet (step S301). Next, the traffic change sign detection unit 103 determines whether or not the received packet is a trigger packet (step S302). Specifically, the traffic change sign detection unit 103 recognizes the content of the packet, determines whether or not the recognized packet content is registered in the threshold information in the threshold control unit 106, and is registered. If it is, it is determined that it is a trigger packet. If the packet is not a trigger packet, the traffic change sign detection unit 103 sends the packet to the device application unit 102 (step S303) and ends the process. On the other hand, if the packet is a trigger packet, the traffic change sign detection unit 103 proceeds to the operation of step S304.

  In step S304, the traffic change sign detection unit 103 refers to the threshold information and recognizes a candidate threshold corresponding to the content of the packet of the trigger packet. Next, the traffic change sign detection unit 103 instructs the threshold control unit 106 to set the candidate threshold recognized in step S304 as the limit threshold. In response, the threshold control unit 106 changes the limit threshold (step S305). As a result, the limit threshold is changed to a value suitable for the operation state after the traffic change. Next, the traffic change sign detection unit 103 sends the packet sent from the network 2 to the device application unit 102 (step S306), and ends the process.

  Thus, in this embodiment, when the amount of data transmitted by the electronic device 1 exceeds the limit threshold, the data to be transmitted is discarded. Therefore, even when the electronic device 1 itself transmits a large amount of abnormal data, an increase in traffic can be prevented. Furthermore, in the present embodiment, the electronic device 1 determines whether the data to be transmitted and the received data are trigger packets that serve as a precursor to a change in traffic. If it is a trigger packet, the electronic device 1 changes the limit threshold value so as to be a value suitable for the operation state after the trigger packet is transmitted (after reception). Thus, when a large amount of data must be transmitted, the electronic device 1 increases the limit threshold and transmits the large amount of data without discarding it. On the other hand, when it is not necessary to transmit a large amount of data, the electronic device 1 lowers the limit threshold value and discards the packet when a large amount of abnormal data is transmitted. Therefore, an electronic device capable of controlling a threshold for restricting communication according to an operation state is provided.

  In the above embodiment, the traffic change sign detection unit 103 detects whether or not the traffic change sign by determining whether or not the transmission or reception packet is a trigger packet. The detection of whether or not traffic is a precursor is not limited to this. The traffic change sign detection unit 103 may detect a sign that traffic changes by recognizing information included in a transmission or reception packet, such as a packet header. Further, the traffic change sign detection unit 103 may detect a sign that traffic changes by a direct instruction from the device application unit 102. Further, the traffic change sign detection unit 103 may detect a sign that the traffic changes by a direct instruction from the PC 3. As described above, the traffic change sign detection unit 103 is not limited to the above-described operation as long as it can detect a sign that traffic changes. When transmitting and receiving moving images, the device requesting the moving image requests the device that transmits the moving image to change the limit threshold because the traffic changes, and accordingly detects a traffic change precursor. The unit 103 may detect a sign of traffic change and cause the threshold control unit 106 to change the limit threshold.

  Note that the communication control unit 101 in the above-described embodiment may be realized by hardware or may be realized by software.

  When implemented in hardware, the traffic change sign detection unit 103, the traffic control unit 104, the traffic measurement unit 105, and the threshold control unit 106 are typically implemented as an LSI that is an integrated circuit. Each of these may be made into one chip, or may be made into one chip so as to include some or all of them. Here, the integrated circuit is an LSI, but depending on the degree of integration, it may be called an IC, a system LSI, a super LSI, or an ultra LSI. Further, the method of circuit integration is not limited to LSI's, and implementation using dedicated circuitry or general purpose processors is also possible. An FPGA (Field Programmable Gate Array) that can be programmed after manufacturing the LSI, or a reconfigurable processor that can reconfigure the connection and setting of circuit cells inside the LSI may be used. Furthermore, if integrated circuit technology that replaces LSI emerges as a result of advances in semiconductor technology or other technologies derived from it, naturally, using this technology, a traffic change sign detection unit 103, a traffic control unit 104, and a traffic measurement unit 105 and the threshold control unit 106 may be integrated. As the derivative technology, biotechnology can be applied.

  When implemented in software, the communication control unit is implemented by executing a program stored in a storage device on a computer device that is hardware including a storage device and a central processing unit. The program can cause the computer apparatus to execute the operations described in the above embodiment.

  In the above embodiment, when the measured traffic value is equal to or greater than the limit threshold, the traffic control unit 104 discards all data to be transmitted (see step S104 in FIG. 3). However, the operation when the measured traffic value is equal to or greater than the limit threshold is not limited to this. For example, when the measured traffic value is equal to or greater than the limit threshold, the traffic control unit 104 may transmit the data by thinning out so that the data to be transmitted has a traffic amount equal to or less than the limit threshold, or the worm or computer virus Only abnormal specific data generated due to the above or the like may be discarded. Further, the traffic control unit 104 may control the amount of data to be transmitted by not transmitting data for a specific destination.

  In the above embodiment, the data size corresponding to the number of packets per fixed time is used as the measured traffic value, but the number of packets per fixed time may be used. In this case, the threshold set in the threshold information is the number of packets per fixed time.

  In the above embodiment, when a trigger packet is received, a limit threshold is set, and thereafter, using the set limit threshold, it is determined whether to discard the packet. In an initial state in which the trigger packet is not received, the threshold control unit 106 may use a value set by the user or an initial value set in advance as the limit threshold. Further, each time the communication control unit 101 is turned on, the threshold control unit 106 may initialize the limit threshold.

  In the embodiment, the threshold control unit 106 does not change the limit threshold unless the trigger packet is detected by the traffic change sign detection unit 103. However, if the state in which the amount of data measured by the traffic measurement unit 105 falls below the limit threshold continues for a certain time, the threshold control unit 106 may return the current limit threshold to the limit threshold before the change. However, when the trigger packet is a moving image transfer end request packet and there is no problem even if the limit threshold is set low, there is no problem even if the state where the limit threshold is lower is continued for a certain period of time. Therefore, only when the current limit threshold is larger than the limit threshold before the change, the threshold control unit 106, when the state in which the amount of data measured by the traffic measurement unit 105 is below the limit threshold continues for a certain period of time, The current limit threshold value may be returned to the limit threshold value before the change. As a result, the state where the electronic device 1 transmits a large amount of abnormal data due to a worm or a computer virus that abuses the state where the restriction threshold is high continues for a long time when the restriction threshold is high. Can do.

  The traffic measurement unit 105 may measure an average value of the amount of data to be transmitted and set the average value as a measured traffic value. In this case, the traffic control unit 104 determines whether or not the average value exceeds the limit threshold value, and controls the amount of data to be transmitted when the average value exceeds the limit threshold value. As a result, when data that increases traffic for a certain moment is output from the device application unit 102, the limit threshold is not changed, and the electronic device 1 operates stably.

  Examples of the above embodiment include the following examples.

  For example, the electronic device 1 is connected to a network, can receive a data transmission request from the PC 3, and is an electronic device that continues to transmit large data such as moving image data until there is a data transmission end request. To do.

  The electronic device 1 is assumed to have a low traffic limit threshold in the initial state. In the initial state, it is assumed that the PC 3 transmits a packet including a data transmission request (hereinafter referred to as a data transmission request packet) to the electronic device 1 via the network 2. The electronic device 1 receives the data transmission request packet. The communication control unit 101 causes the traffic change sign detection unit 103 to analyze the received data transmission request packet and determine whether or not it is a trigger packet detection. Here, it is assumed that the data transmission request packet is a trigger packet because it is a packet that indicates a traffic increase. The traffic change sign detection unit 103 recognizes a candidate threshold corresponding to the data transmission request packet based on threshold information in the threshold control unit 106. Then, the traffic change sign detection unit 103 instructs the threshold control unit 106 to set the recognized candidate threshold as the limit threshold. In response to this, the threshold control unit 106 sets a limit threshold. The limit threshold here is, for example, an upper limit value of traffic generated in response to a data transmission request.

  When the traffic change sign detection unit 103 causes the threshold control unit 106 to set a limit threshold, the traffic change sign detection unit 103 sends a data transmission request packet that is a trigger packet to the device application unit 102. The device application unit 102 receives the data transmission request packet, and accordingly, starts transmission of data to the transmission destination IP address described in the data transmission request packet.

  Data transmitted from the device application unit 102 passes through the traffic measurement unit 105 and the traffic control unit 104. The traffic measurement unit 105 measures the traffic value by counting the number of packets transmitted from the device application unit 102. If the traffic value measured here does not exceed the limit threshold, the traffic control unit 104 causes the traffic change sign detection unit 103 to transmit the packet to the network 2.

  In the above example, since the limit threshold is set to the upper limit value of traffic generated during data transfer, the packet from the device application unit 102 is transmitted to the network 2 without delay.

  When the PC 3 transmits a data transmission end request packet to the electronic device 1 to end data transmission, the traffic change sign detection unit 103 of the electronic device 1 detects the “data transmission end request packet” as a trigger packet. Then, the threshold control unit 106 is caused to change the limit threshold. Thereby, the limit threshold is set to a value lower than the threshold at the time of data transfer. Thereby, it is avoided that the limit threshold remains high even though the data transfer is completed. If the data transmission end request packet cannot be received, the state where the limit threshold is high continues. In such a case, the electronic device 1 may transmit abnormal data. Therefore, the traffic change sign detection unit 103 returns the limit threshold to the value before being changed by the trigger packet when the data transmission end request packet cannot be received after a data transmission request packet has been received for a certain period of time. May be. The above is a normal communication sequence.

  As an abnormal communication sequence, an attack on the electronic device 1 or a software bug may be considered. Consider a case where the electronic device 1 tries to transmit a large amount of data to the network 2 because of such abnormal communication. Since data transmitted from the electronic device 1 always passes through the traffic measurement unit 105 and the traffic control unit 104, such a large amount of data is discarded by the traffic control unit 104 if the amount exceeds the limit threshold. It will be. Therefore, an abnormally large amount of data is prevented from being transmitted from the electronic device 1.

  The network-compatible electronic device according to the present invention can prevent an increase in traffic even when a large amount of abnormal data is transmitted, and sets a threshold for restricting communication according to the operation state. It can be controlled and is useful for Internet home appliances and various communication devices.

1 is a block diagram illustrating a configuration of an entire system to which an electronic device 1 according to an embodiment of the present invention is applied and a functional configuration of the electronic device 1. The figure which shows an example of threshold information The flowchart which shows operation | movement of the electronic device 1 in the case of transmitting a packet The flowchart which shows the detailed operation | movement of the traffic change precursor detection part 103 in FIG.3 S105. The flowchart which shows operation | movement of the electronic device 1 in the case of receiving the packet sent from the network 2

Explanation of symbols

1 Electronic equipment 2 Network 3 PC
101 Communication Control Unit 102 Device Application Unit 103 Traffic Change Prediction Detection Unit 104 Traffic Control Unit 105 Traffic Measurement Unit 106 Threshold Control Unit

Claims (8)

A network compatible electronic device capable of communicating with a device connected to a network,
A traffic measurement means that measures the amount of data you want to send,
Threshold control means for controlling a limit threshold for limiting the amount of data to be transmitted;
Traffic control means for controlling the amount of data to be transmitted when the amount of data measured by the traffic measurement means exceeds the limit threshold;
Traffic change sign detection means for detecting a sign of traffic change with the network,
When the traffic change sign detection unit detects a sign that the traffic changes, the network control type electronic device causes the threshold control unit to change the limit threshold value to a value suitable for an operation state after the traffic change. . The threshold control means stores information about a trigger packet that is a precursor to changing traffic and a candidate threshold corresponding to the trigger packet as threshold information,
The traffic change sign detection means determines whether or not a packet to be transmitted / received is a trigger packet based on the threshold information. If the packet is a trigger packet, the traffic change sign detection unit determines a candidate threshold corresponding to the trigger packet The network compatible electronic device according to claim 1, wherein the network compatible electronic device is a limit threshold.   The network compatible electronic device according to claim 1, wherein the traffic control unit controls the amount of data to be transmitted by discarding all of the data to be transmitted.   The network-compatible electronic device according to claim 1, wherein the traffic control unit controls the amount of data to be transmitted by discarding a part of the data to be transmitted.   The network compatible electronic device according to claim 1, wherein the traffic control unit controls the amount of data to be transmitted by not transmitting data to a specific destination.   2. The threshold value control unit according to claim 1, wherein, when a state in which the amount of data measured by the traffic measurement unit is below the limit threshold value continues for a certain period of time, the threshold value control unit returns the current limit threshold value to the limit threshold value before the change. Network-compatible electronic equipment.   The threshold control means is provided only when the current limit threshold is larger than the limit threshold before the change, and when the state in which the amount of data measured by the traffic measurement means is below the limit threshold continues for a certain period of time. The network-compatible electronic device according to claim 6, wherein the restriction threshold value is returned to the restriction threshold value before change. The traffic measuring means measures an average value of the amount of data to be transmitted,
The network-enabled electronic device according to claim 1, wherein the traffic control unit controls the amount of data to be transmitted when the average value measured by the traffic measurement unit exceeds the limit threshold.

Images