JP2006197360A - Access control system, access control method, and access control program - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To enhance security of subscriber information between different connection service enterprisers. <P>SOLUTION: An access control system includes operation terminals and a pair processing apparatus which is disposed between operation terminals and subscriber information set storage device and has pairs of connection service network designation information and set designation information stored therein in the case that sets of subscriber information include connection service network designation information for designating respective connection service networks and set designation information for designating respective sets of subscriber information. When a person in charge of operation designates a pair from an operation terminal to attempt access to a set of subscriber information stored in a subscriber information set storage device, the set processing apparatus inspects whether the pair designated from the operation terminal exists among sets stored in the apparatus itself or not and permits the access when finding the existence as a result of inspection but rejects the access when not finding the existence. <P>COPYRIGHT: (C)2006,JPO&NCIPI

Description

  The present invention relates to an access control system, an access control method, and an access control program. For example, access control when an operator of each ISP (Internet connection operator) accesses information stored in a location server for an IP phone. It is suitable for application to the case of execution.

  According to the following non-patent document 1, the configuration around the location server 14 in the VoIP communication system 10 when SIP (Session Initiation Protocol) is used as a call control protocol is as shown in FIG.

  In FIG. 2, subscriber data provided by the UA (User Agent) unit 16 using the REGISTER method is registered in the location server 14 via a registrar among the functions of the SIP server 15. Similarly, subscriber data related to other UA units in the IP telephone network 11 is also registered in the location server 14.

  The subscriber data includes an ID for identifying the user (subscriber) U1, a telephone number, a password, a domain name, and the like.

  When the user U1 transmits a call setting message (INVITE message) using the UA unit 16 to make a call with a desired party (another user) in the IP telephone network 11, the call setting message is a function of the SIP server. Relayed by a proxy. At this time, the proxy acquires the location information (such as the IP address of the UA unit) of the other user from the location server 14 and delivers the call setting message to the UA unit of the other party of the call.

  On the other hand, the subscriber information management devices 12 and 13 in FIG. 2 are communication devices installed in the networks (ISP networks) of the respective Internet connection providers (ISPs) E1 and E2. That is, the subscriber information management device 12 is installed in the ISP network of the Internet connection operator E1, and the subscriber information management device 13 is installed in the ISP network in the Internet connection operator E2.

  The subscriber information management device 12 is a communication used when the operator M1 of the Internet connection provider E1 accesses the subscriber data stored in the location server 14 in order to manage the users registered in the Internet connection provider E1. Device. Similarly, the subscriber information management device 13 is used when the operator M2 of the internet connection operator E2 accesses the subscriber data stored in the location server 14 in order to manage the users registered with the internet connection operator E2. It is a communication device to be used.

All users in the IP telephone network 11 such as the user U1 are registered with one of the Internet connection operators (here, E1 or E2), and physically, ISPs operated by each Internet connection operator. Communication including transmission / reception of the above-described call setting message is performed via the network.
J. et al. Rosenberg ed., “SIP: Session Initiation Protocol” [online], June 2002, [December 16, 2004 search] Internet <URL = http: // www. ietf. org / rfc / rfc3261. text? number = 3261>

  However, since the non-patent document 1 described above lacks security considerations, when taking a configuration faithful to the technology of the non-patent document 1, the operators M1 and M2 of the Internet connection operators E1 and E2 Even the subscriber data of the user registered in another Internet connection provider (for example, E1 for E2) can be accessed.

  For example, even if the user U1 is registered with the Internet connection provider E1, not only the operator M1 but also the operator M2 can access the subscriber data of the user U1, so the security is low.

  Specifically, information related to charging may be included in the subscriber data. Each of the operators M1 and M2 who have accessed the subscriber data can not only browse the subscriber data but also rewrite it, which may cause a serious problem. It can be said that it is low.

  In order to solve this problem, in the first aspect of the present invention, a plurality of connection service networks operated by a connection service provider that provides a connection service for ensuring network connectivity to a plurality of subscribers are provided. And a communication service provider that provides a predetermined communication service to each subscriber using the connection service network includes a subscriber information set composed of predetermined types of information for the communication service. In an access control system comprising an existing subscriber information set storage device storing for each subscriber, (1) arranged on the side of each connection service network, and an operator in charge of the connection service provider is a subscriber information set An operation terminal used for browsing and operating a subscriber information set stored in the storage device; and (2) each of the connection services in the subscriber information set. When connection service network designation information for designating a network and set designation information for designating each subscriber information set are included, it is arranged between the operation terminal and a subscriber information set storage device, and the connection service network designation information and (3) Subscriber information stored in the subscriber information set storage device by the operator in charge specifying a set from the operation terminal. When trying to access a set, the set processing device checks whether there is a set specified by the operation terminal among the sets stored in its own device. If it does, the access is permitted, and if it does not exist, the access is denied.

  In the second aspect of the present invention, a plurality of connection service networks operated by each connection service provider providing a connection service for securing network connectivity to a plurality of subscribers, and the connection service A communication service provider that provides a predetermined communication service to each subscriber using the network stores a subscriber information set made up of a plurality of types of predetermined information for each subscriber for the communication service. In the access control method using the existing subscriber information set storage device, (1) an operation person of the connection service provider uses the operation terminal arranged on each connection service network side to obtain subscriber information. Browse and manipulate the subscriber information set stored in the set storage device, and (2) connection service network designation information for designating each connection service network in the subscriber information set and each In the case where set designation information for designating an entrance information set is included, a set of the connection service network designation information and set designation information is set in a set processing device arranged between the operation terminal and the subscriber information set storage device. (3) When the operator in charge designates a set from the operation terminal and tries to access a subscriber information set stored in the subscriber information set storage device, the set processing device Checks whether the group specified by the operation terminal exists among the groups stored in its own device, and if it exists as a result of the inspection, permits access and exists. If not, the access is denied.

  Furthermore, in the third aspect of the present invention, a plurality of connection service networks operated by each connection service provider providing a connection service for securing network connectivity to a plurality of subscribers, and the connection service A communication service provider that provides a predetermined communication service to each subscriber using the network stores a subscriber information set made up of a plurality of types of predetermined information for each subscriber for the communication service. In the access control program related to the existing subscriber information set storage device, (1) In the operation terminal arranged on the side of each connection service network, the person in charge of operation of the connection service provider is a subscriber. A function for browsing and operating a subscriber information set stored in the information set storage device is realized, and (2) each connection server is included in the subscriber information set. When the connection service network specifying information for specifying the network and the set specifying information for specifying each subscriber information set are included, the set processing device intervenes between the operation terminal and the subscriber information set storage device in the computer. And (3) the operator in charge designates the set from the operation terminal and stores it in the subscriber information set storage device. When trying to access the stored subscriber information set, the set processing device checks whether the set specified by the operation terminal exists in the set stored in its own device. As a result of the inspection, if it exists, access is permitted, and if it does not exist, access is denied.

  According to the present invention, it is possible to improve the security of subscriber information between different connection service providers.

  Further, in the present invention, by newly installing a set processing device for managing a set of connection service network designation information and set designation information between the operation terminal and the subscriber information set accumulation device, between different connection service providers Since the security of subscriber information can be improved, the cost and feasibility are also excellent.

(A) Embodiment Hereinafter, an embodiment will be described with reference to an example in which the access control system, the access control method, and the access control program according to the present invention are applied to a VoIP communication system that uses SIP as a call control protocol.

(A-1) Configuration of Embodiment FIG. 3 shows an example of the overall configuration of the VoIP communication system 20 according to the present embodiment. Of course, servers (not shown) such as a DHCP server and a DNS server may exist in the VoIP communication system 20.

  In FIG. 3, the VoIP communication system 20 includes an IP telephone network 21, subscriber information management devices 22 and 23, a location server 24, a SIP server 25, UA units 26 and 27, and a grouping device 28. I have.

  Of these, the UA unit 26 is a function possessed by the VoIP gateway, IP telephone software, and the like, and is installed in the end terminal. The UA unit 27 is similar to this. The UA unit 26 is used by the user U11, and the UA unit 27 is used by the user U12.

  The SIP server 25 is a server that relays messages coming from the UA unit, and has a function as a proxy server and a function as a registrar (registration server). The relay destination (supply destination) of the message by the SIP server 25 can be divided into two depending on the type of message. One is the other UA unit, and the other is the location server 24.

  The relay destination is another UA unit or the like when the SIP server 25 functions as a proxy server and relays a call control message. The relay destination is the location server 24 when the SIP server 25 functions as a registrar and relays the REGISTER message. The REGISTER message includes subscriber data. Therefore, when the UA unit (for example, 26) delivers the REGISTER message to the SIP server 25, the subscriber data included in the REGISTER message is registered in the location server 24 by the registrar function of the SIP server 25.

  The subscriber data includes a plurality of types of information. The type of information included in the subscriber data may be, for example, as shown in FIG.

  In FIG. 4, the subscriber data includes a subscriber data key (Userid), a subscriber name (Subscriber), a domain name (Domain), an alias (Alia), and a user identification name (Username). , A password is included.

  Among these, the subscriber data key is identification information for uniquely identifying each subscriber data.

  The subscriber name is the name of the subscriber (for example, user U11). Specifically, for example, the name of the subscriber may be used.

  The domain name is information for identifying the ISP network of the Internet service provider registered by the subscriber. This domain name may be obtained by removing the host name from the FQDN.

  The alias is information indicating an alias. Specifically, for example, the subscriber's telephone number may be registered as an alias.

  The name for identifying the user is information for uniquely identifying the subscriber. Any information may be used as long as the subscriber can be uniquely identified.

  The password is a password for each subscriber. For example, the user authentication of the subscriber may be performed using this password when logging into a presence server (not shown).

  However, the types of information included in the subscriber data are not limited to those described here. For example, billing information regarding each subscriber may be included in the subscriber data. In addition, due to the nature of the location server, it is natural that the location information (IP address, etc.) of each UA unit is included in the subscriber data.

  The subscriber information management device 22 is a communication device installed in the network (ISP network) of each Internet connection provider (ISP) E11. When the operator M11 of the Internet connection provider E11 accesses the subscriber data stored in the location server 24 in order to manage the users registered in the Internet connection provider E11, the subscriber information management device 22 is used. The subscriber information management device 22 belongs to a domain (referred to as domain name D11) corresponding to the ISP network of the Internet connection provider E11.

  Similarly, the subscriber information management device 23 is a communication device installed in the network (ISP network) of each Internet connection operator (ISP) E12, and the operator M12 of the Internet connection operator E12 is connected to the Internet connection business. When accessing the subscriber data stored in the location server 24 in order to manage the users registered in the subscriber E12, the subscriber information management device 23 is used. The subscriber information management device 23 belongs to a domain (referred to as domain name D12) corresponding to the ISP network of the Internet connection provider E12.

  The device itself of the subscriber information management devices 22 and 23 may be, for example, a normal personal computer equipped with a web browser.

  Access from the subscriber information management device (for example, 22) to the location server 24 includes not only access for browsing subscriber data but also access for changing subscriber data.

  All users in the IP telephone network 21 such as the users U11 and U12 are registered with one of the Internet connection providers (here, E11 or E12) and are physically operated by each Internet connection provider. The communication including the transmission / reception of the call setting message and the transmission of the REGISTER message is performed via the ISP network.

  The location server 24 is a database for storing the subscriber data including the location information of each UA unit. That is, the location server 24 is a server for address resolution required in the process of call control by SIP, and is used for address resolution by the proxy server function in the SIP server 25. Among the users registered in any of a plurality of ISPs such as Internet connection providers E11 and E12, all users who use the IP telephone service are registered in the location server 24. The amount of information (number of subscriber data) to be stored is usually enormous.

  When the subscriber information management apparatuses 22 and 23 use the above-described Web browser, the location server 24 has a Web server function and communicates with the subscriber information management apparatuses 22 and 23 via the Web server.

  All the components 21 to 27 described so far can basically be used as they are. In particular, since the location server 24 stores a large amount of information, the location server 24 does not require a configuration change (for example, a change in the type of information included in the subscriber data (including addition)). , Greatly contribute to the improvement of feasibility. A characteristic component in the present embodiment is a grouping device 28.

  The grouping device 28 is interposed between each subscriber information management device 22, 23 and the location server 24, and executes access control for access from each subscriber information management device (for example, 22) to the location server 24. It is a communication device. In order to execute this access control, the grouping device 28 stores a combination of a domain name and a subscriber data key. The grouping device 28 can be implemented as part of a so-called provisioning system.

  Details of the relationship between the information stored in the grouping device 28 and the subscriber data stored in the location server 24 are shown in FIG.

  In FIG. 1, the grouping device 28 includes an access control table TB1, and the access control table TB1 includes a set of a domain name D11 and a subscriber data key K1, and a domain name D12 and a subscriber data key K2. A set of domain name D11 and subscriber data key K3 is stored.

  On the other hand, the location server 24 includes a subscriber data table TB2, and the subscriber data table TB2 includes subscriber data DT1 including a subscriber data key K1, and subscriber data DT2 including a subscriber data key K2. The subscriber data DT3 including the subscriber data key K3 is stored.

  In this embodiment, when the subscriber information management devices 22 and 23 access the location server 24, the access information from the subscriber information management device to the grouping device 28 is selected from among a plurality of types of information included in the subscriber data. At least a domain name and a subscriber data key are supplied. The domain name is also the domain name of the domain to which the subscriber information management apparatus itself belongs, and the subscriber data key is information necessary for designating the subscriber data to be accessed. It is easy to supply from the subscriber information management apparatus.

  If user authentication has been performed when accessing the location server 25 from the subscriber information management apparatus before the grouping device 28 is installed, the domain name and the like are input by the operator during the user authentication process. You can also. In order to obtain OK as a result of user authentication, each operator cannot spoof the domain name.

  In any case, when the subscriber information management device (for example, 22) tries to access the location server 25 by designating a combination of the domain name and the subscriber data key, the grouping device 28 determines that the access is the access group. It is checked whether or not it is registered in the control table TB1, and access is permitted only when it is registered, and when it is not registered, it is rejected.

  The operation of the present embodiment having the above configuration will be described below.

(A-2) Operation of Embodiment Each UA unit in the IP telephone network 21 such as the UA units 26 and 27 transmits the REGISTER message containing subscriber data at the time of initialization or periodically. When receiving the REGISTER message, the registrar function in the SIP server 25 registers the subscriber data included in the REGISTER message in the subscriber data table TB2 of the location server 24.

  For example, when location information (such as an IP address) of a certain UA unit (for example, 26) varies, the variation is reflected in the registration contents of the subscriber data table TB2 by this registration.

  Thus, when a call control message for requesting call setting is transmitted from another UA unit (for example, 27) in the IP telephone network 21 to the UA unit 26, the proxy server function of the SIP server 25 When relaying the control message, appropriate address resolution can be performed by referring to the subscriber data corresponding to the UA unit 26 in the subscriber data table TB2.

  On the other hand, the registered contents of the location server 24 are managed by the operators M11 and M12 of the Internet access providers E11 and E12 accessing them using the subscriber information management devices 22 and 23.

  For example, when the operator M11 of the Internet connection operator E11 tries to access the subscriber data DT1 of the subscriber data key K1, the domain name D11 of the ISP network of the Internet connection operator E11 and the subscriber data key K1. Attempt access by specifying a pair.

  Since this set is registered in the access control table TB1, the grouping device 28 permits the access. With this permission, the operator M11 can view or rewrite the registered contents of the subscriber data table TB2 registered in the location server 24.

  When the operator M11 attempts to access by specifying the combination of the domain name D11 and the subscriber data key K3, since this combination is registered in the access control table TB1, it is similarly permitted.

  However, when the operator M11 designates a set of the domain name D11 and the subscriber data key K2 and attempts to access the subscriber data DT2, the operator M11 is rejected because the set is not registered in the access control table TB1. Is done.

  The same applies when the operator M12 of the other Internet operator E12 tries to access the subscriber data.

  That is, since the domain name of the ISP network of the Internet connection provider E12 is D12 and not D11, only when trying to access the subscriber data corresponding to the subscriber data key that forms a pair with the domain name D12. Access is never allowed. In the example of FIG. 1, since the subscriber data key that forms a pair with the domain name D12 is only K2, only the subscriber data DT2 is allowed to be accessed by the operator M12, and other subscriber data DT1. , DT3 is rejected when attempting to access.

  The grouping device 28 having such an access control function can be effectively used when constructing the VoIP communication system 20 in a place where nothing exists, but the components 21 other than the grouping device 28 have already been used. When the grouping device 28 is added when the VoIP communication system configured by ˜27 exists and is actually operated, it is more effective. The fact that there is no need to change the type of information included in the subscriber data table TB2 actually registered in the location server 24 greatly contributes to the improvement of feasibility. Because it can.

(A-3) Effect of Embodiment According to the present embodiment, an operator (for example, M11) accesses (views and browses) only the subscriber data specified by the domain name to which the operator belongs and the subscriber data key constituting the pair. It is possible to improve security because it cannot be changed.

  Moreover, in the present embodiment, since the existing components other than the grouping device (28) can be used as they are, it is excellent in feasibility.

(B) Other Embodiments Regardless of the embodiment described above, it is natural that the number of subscriber information management devices (or the number of ISP networks) connected to the same grouping device is not limited to two. It is also desirable that three or more subscriber information management devices are connected to the same grouping device and are subjected to access control by the grouping device.

  In addition, the present invention can be applied to communication protocols other than those used in the above embodiment.

  For example, there is a possibility that the IPX protocol or the like can be used instead of the IP protocol as a network layer communication protocol. Furthermore, there is a possibility that a communication protocol other than SIP can be used as the call control protocol.

  In the above description, most of the functions realized in hardware can be realized in software, and almost all the functions realized in software can be realized in hardware.

It is the schematic which shows the relationship between the grouping apparatus and location server which are used with the VoIP communication system concerning embodiment. It is the schematic which shows the whole structure of the conventional VoIP communication system. It is the schematic which shows the example of whole structure of the VoIP communication system concerning embodiment. It is the schematic which shows the structural example of the subscriber data used by embodiment.

Explanation of symbols

  DESCRIPTION OF SYMBOLS 10, 20 ... VoIP communication system 11, 21 ... IP telephone network, 12, 13, 22, 23 ... Subscriber information management apparatus, 14, 24 ... Location server, 15, 25 ... SIP server, 16, 26, 27 ... UA section, 28 ... grouping device, TB1 ... access control table, TB2 ... subscriber data table, D11, D12 ... domain name, K1-K3 ... subscriber data key, DT1-DT3 ... subscriber data.

Claims (3)

A plurality of connection service networks operated by a connection service provider that provides a connection service for ensuring network connectivity for a plurality of subscribers, and each subscriber using the connection service network is provided. Existing subscriber information set storage in which a communication service provider providing a predetermined communication service stores, for each subscriber, a subscriber information set made up of a plurality of types of predetermined information for the communication service In an access control system comprising a device,
An operation terminal that is disposed on each connection service network side and used by a person in charge of operation of the connection service provider to browse and operate a subscriber information set stored in a subscriber information set storage device;
When the subscriber information set includes connection service network designation information for designating each connection service network and set designation information for designating each subscriber information set, the operation terminal and the subscriber information set storage device And a set processing device for storing a set of the connection service network specification information and set specification information.
When the person in charge of operation designates a set from the operation terminal and tries to access a subscriber information set stored in the subscriber information set storage device, the set processing device is stored in the own device. In the set, it is checked whether or not the set specified by the operation terminal exists. As a result of the check, if it exists, access is permitted, and if it does not exist, access is permitted. An access control system characterized by denying. A plurality of connection service networks operated by each connection service provider that provides a connection service for ensuring network connectivity to a plurality of subscribers, and each subscriber using the connection service network Existing subscriber information set storage in which a communication service provider providing a predetermined communication service stores, for each subscriber, a subscriber information set made up of a plurality of types of predetermined information for the communication service In an access control method using a device,
Using an operation terminal arranged on the side of each connection service network, the person in charge of operation of the connection service provider browses and operates the subscriber information set stored in the subscriber information set storage device,
When the subscriber information set includes connection service network designation information for designating each connection service network and set designation information for designating each subscriber information set, the operation terminal and the subscriber information set storage device In the set processing device arranged between the above, the set of the connection service network specification information and the set specification information is accumulated,
When the person in charge of operation designates a set from the operation terminal and tries to access a subscriber information set stored in the subscriber information set storage device, the set processing device is stored in the own device. In the set, it is checked whether or not the set specified by the operation terminal exists. As a result of the check, if it exists, access is permitted, and if it does not exist, access is permitted. An access control method characterized by denying. A plurality of connection service networks operated by each connection service provider that provides a connection service for ensuring network connectivity to a plurality of subscribers, and each subscriber using the connection service network Existing subscriber information set storage in which a communication service provider providing a predetermined communication service stores, for each subscriber, a subscriber information set made up of a plurality of types of predetermined information for the communication service In an access control program associated with a device,
In the operation terminal arranged on each connection service network side, a person in charge of operation of the connection service provider browses and operates a subscriber information set stored in a subscriber information set storage device on a computer. Realize the function,
When the subscriber information set includes connection service network designating information for designating each connection service network and set designating information for designating each subscriber information set, the set processing device causes the computer to execute the operation. Intervening between the terminal and the subscriber information set storage device, realizing the function of storing the set of connection service network specification information and set specification information,
When the person in charge of operation designates a set from the operation terminal and tries to access a subscriber information set stored in the subscriber information set storage device, the set processing device is stored in the own device. In the set, it is checked whether or not the set specified by the operation terminal exists. As a result of the check, if it exists, access is permitted, and if it does not exist, access is permitted. An access control program characterized by denying.

Images