JP2007259384A - Communication control system, communication control apparatus, terminal, communication control method, and program therefor - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To make it possible to be connected to a server dynamically variable of an IP address, while ensuring the security of the server against an attack. <P>SOLUTION: When a user requests a connection to an information provision device 2 to an information receiver 1, the information receiver 1 transmits a connection request mail to the information provision device 2 via a mail server 3. When the connection request mail is received, the information provision device 2 selects and opens a port for accepting the connection at random and a number of the opened port, own IP address and a client certificate are redirected to the information receiver 1 via the mail server 3, as an answer mail. When the information receiver 1 receives the answer mail, an application client 11 connects to the answered IP address and port by using the client certificate. <P>COPYRIGHT: (C)2008,JPO&INPIT

Description

  The present invention relates to a communication technology for connecting to a server whose IP address dynamically changes, and more particularly to a communication technology for connecting using a mail server.

  Conventionally, a technique called dynamic DNS has been proposed as a method of accessing a device that is dynamically assigned an IP address by DHCP (Dynamic Host Configuration Protocol) or the like (Patent Document 1).

  When dynamic DNS is used, an IP address assigned by DHCP or the like is registered in a DNS server at regular intervals, so that even a device that is dynamically assigned an IP address can accept access from a client terminal. it can.

  In addition, a technology called DNSSEC (DNS Security Extension) that encrypts IP address information registered in a DNS server has been proposed in order to prevent an outsider from searching for an IP address and to prevent alteration of DNS information. (Non-Patent Document 1).

  When DNSSEC is used, the IP address registered in the DNS server cannot be decrypted without the key delivered in advance, so that the searchable persons of the IP address of the device registered in the DNS server can be limited, and unauthorized intrusion Can be reduced.

  Conventionally, as another method of accessing a device that is dynamically assigned an IP address by DHCP or the like, the dynamically assigned IP address is transmitted to the client terminal by e-mail, and the client Has proposed a technique for accessing an IP address received from an e-mail (Patent Document 2).

  When this technology is used, the IP address assigned by DHCP or the like is registered in the client terminal table via the mail server, so that even a device that has been dynamically assigned an IP address can receive from the client terminal. Can accept access.

Conventionally, a client certificate (Client Certificate) has been proposed as a method in which a server authenticates a client. (Non-Patent Document 2)
When the client certificate is used, the server can check whether the client that has accessed using the SSL protocol is a legitimate user having access authority.
JP 2000-112851 A JP 2004-282506 A DNSSEC-DNS Security Extensions http: // www. dnssec. net / (searched on September 27, 2005) T.A. Dierks et al., “The TLS Protocol”, Internet RFC 2246, IETF, January 1999.

  In the prior art 1 described above, a dynamic DNS server is required. However, since a dynamic DNS server is not a general server, a new one is installed on its own, or a new usage contract is made with an Internet service provider (ISP) or the like. It was necessary to tie. For this reason, there is a problem that the installation and contract of the dynamic DNS server are expensive and time consuming.

  Moreover, although the prior art 2 can solve the problem of the prior art 1, it is necessary to always open the port and wait for the connection because the device waiting for the connection cannot know when it is connected from the other party. For this reason, there is a problem that a device waiting for connection is easily attacked by an outsider such as a DOS attack (Denial of Service).

  Moreover, in the prior art 3, since the persons who can browse the IP address of the server can be limited as compared with the prior art 1, the possibility that the server is attacked can be slightly reduced. However, if this IP address becomes widely known in general due to an IP address search or the like, users who can access the server cannot be limited. Therefore, there is a problem in that complete access restriction to the server, that is, complete client authentication cannot be performed.

  Further, in the prior art 4, since access from a client having no certificate can be completely denied, complete client authentication is possible as compared with the prior art 3. However, in addition to distributing the certificate to the client in advance, there is a problem that the client side must select and present the necessary certificate to the server side when accessing the server. It was.

  The problem to be solved by the present invention is to solve the above-mentioned problem, and it is possible to connect to a server whose IP address dynamically changes while ensuring the safety of the server against attacks. A communication apparatus, a communication system, a communication method, and a communication program are provided.

A first invention for solving the above problem is a communication control system,
A terminal that transmits a connection request mail indicating a connection request to the information providing device;
A mail server for holding the transmitted connection request mail;
The connection request mail is acquired from the mail server, and the response mail having the information of the port number and IP address opened by the port management unit randomly selected from a plurality of ports in response to the connection request mail is encrypted. And control means for transmitting.

According to a second invention for solving the above-mentioned problem, in the first invention,
The port management unit is configured to permit connection of a terminal connected using information of the transmitted port number and IP address.

According to a third invention for solving the above-described problem, in the first or second invention,
The control means is configured to periodically connect to the mail server and check whether there is a connection request mail.

According to a fourth invention for solving the above-mentioned problem, in the second or third invention,
The port management unit is configured to open a port only to a terminal that has transmitted the connection request mail.

A fifth invention for solving the above-described problems is any one of the first to fourth inventions,
The terminal transmits the encrypted connection request mail.

A sixth invention for solving the above-mentioned problems is any one of the second to fifth inventions,
The port management unit is configured to permit connection of a terminal connected by presenting a client certificate transmitted by the control unit together with the port number and IP address information.

A seventh invention for solving the above-mentioned problems is any one of the second to sixth inventions,
The terminal transmits a disconnection request mail indicating a request to close the opened port when it does not connect using the information of the transmitted port number and IP address for a certain period of time.

An eighth invention for solving the above-mentioned problems is any one of the second to seventh inventions,
When the port management unit is configured as a firewall, the port management unit converts the connection destination of the terminal connected using the information of the transmitted port number and IP address into an information providing device. It is characterized by.

According to a ninth aspect of the present invention for solving the above problems,
The port management unit converts a connection destination of a terminal connected using the information of the transmitted port number and IP address into an information providing apparatus indicated by the terminal in a connection request mail. To do.

A tenth invention for solving the above-mentioned problem is
A communication control device,
A port management unit that randomly selects from a plurality of ports and releases the port number;
A control means for acquiring a connection request mail from a mail server, receiving the connection request mail, and encrypting and transmitting a reply mail having information on the port number and IP address opened by the port management unit;
The port management unit is configured to permit connection of a terminal connected using information of the transmitted port number and IP address.

An eleventh invention for solving the above-mentioned problems is
A terminal,
Sending a connection request mail indicating a connection request to the information providing device, receiving this connection request mail, obtaining information of a port number and an IP address that are randomly selected from a plurality of ports and opened, The connection is made using the acquired port number and IP address.

A twelfth invention for solving the above-described problems is
A communication control method,
A connection request transmission step of transmitting a connection request mail indicating a connection request to the information providing device;
An acquisition step of obtaining a connection request mail from a mail server holding the transmitted connection request mail;
Upon obtaining the connection request mail, an opening step of randomly selecting and opening a port from a plurality of ports;
A transmission step of encrypting and transmitting the reply mail having the information of the opened port number and IP address.

A thirteenth invention for solving the above-mentioned problem is the above-mentioned twelfth invention,
The method includes a permission step of permitting connection of a terminal connected using the information of the transmitted port number and IP address.

A fourteenth aspect of the invention for solving the above-described problem is the twelfth or thirteenth aspect of the invention,
The obtaining step is characterized in that it is periodically connected to the mail server to check whether there is a connection request mail.

A fifteenth aspect of the invention for solving the above-described problem is the above-described thirteenth or fourteenth aspect of the invention,
In the permission step, a port is opened only to a terminal that has transmitted the connection request mail.

A sixteenth aspect of the invention for solving the above-mentioned problems is the invention according to any one of the twelfth to fifteenth aspects,
In the connection request transmission step, the encrypted connection request mail is transmitted.

The seventeenth invention for solving the above-mentioned problems is any one of the thirteenth to sixteenth inventions,
In the permission step, connection of a terminal connected by presenting the client certificate transmitted in the transmission step together with the port number and IP address information is permitted.

An eighteenth invention for solving the above-mentioned problems is any one of the thirteenth to seventeenth inventions,
In the case where the connection using the information of the transmitted port number and the IP address is not performed for a certain period of time, there is a step of transmitting a disconnection request mail indicating a request for closing the opened port.

A nineteenth aspect of the invention for solving the above-described problems is the invention according to any one of the thirteenth to eighteenth aspects,
The permission step includes a conversion step of converting a connection destination of a terminal connected using the information of the transmitted port number and IP address into an information providing apparatus.

A twentieth invention for solving the above-mentioned problems is the above-mentioned nineteenth invention,
The converting step converts the connection destination of the terminal connected using the information of the transmitted port number and IP address to the information providing apparatus indicated by the terminal in the connection request mail. .

The twenty-first invention for solving the above-mentioned problems is
A communication control system program, wherein the program controls the communication control system,
A terminal that transmits a connection request mail indicating a connection request to the information providing device;
A mail server for holding the transmitted connection request mail;
The connection request mail is acquired from the mail server, and the response mail having the information of the port number and IP address opened by the port management unit randomly selected from a plurality of ports in response to the connection request mail is encrypted. It is characterized by functioning as a control means for transmitting.

According to a twenty-second invention for solving the above-mentioned problem, in the twenty-first invention,
The port management unit permits connection of a terminal connected using the information of the transmitted port number and IP address.

The twenty-third invention for solving the above-mentioned problems is
A communication control device program, wherein the program controls the communication control device,
A port management unit that randomly selects from a plurality of ports and releases the port number;
Obtaining a connection request mail from the mail server, receiving this connection request mail, and functioning as a control means for encrypting and transmitting a reply mail having information on the port number and IP address opened by the port management unit,
The port management unit permits connection of a terminal connected using the information of the transmitted port number and IP address.

The twenty-fourth invention for solving the above-mentioned problems is
A terminal program, wherein the program
Sending a connection request mail indicating a connection request to the information providing device, receiving this connection request mail, obtaining information of a port number and an IP address that are randomly selected from a plurality of ports and opened, It is characterized by functioning to connect using the acquired port number and IP address.

  The information receiving apparatus of the present invention includes a client control unit that searches for an IP address corresponding to a special address specified based on a request from an application client, a POP client that receives an email in response to a request from the client control unit, and a client control unit. An SMTP client that sends a mail in response to the request, an encryption processing unit that performs encryption and decryption of the mail, and an address table that stores a mail address corresponding to the special address. An IP address management unit that acquires an IP address by DHCP or the like, a server control unit that stores and transmits an IP address set in the IP address management unit in a mail, and a POP client that receives a mail based on a request from the server control unit Also for server control request To the application server by the request of the SMTP client that sends the mail, the encryption processing part that performs the encryption and decryption of the mail, the port management part that opens and closes the port based on the request of the server control part, and the request of the server control part A certificate management unit that issues a certificate necessary for access to the client and verifies the certificate in response to a request from the application server. By adopting such a configuration, the object of the present invention can be achieved by requesting connection via a mail server, dynamically opening / closing and converting a port, and replying with an IP address and a client certificate. .

  The information receiving apparatus of the present invention includes a client control unit that searches for an IP address corresponding to a special address specified based on a request from an application client, a POP client that receives an email in response to a request from the client control unit, and a client control unit. An SMTP client that sends mail in response to the request, an encryption processing unit that performs encryption and decryption of the mail, and an address table that stores a mail address corresponding to the special address. Server control unit that stores and transmits an IP address set in the IP address management unit in mail, POP client that receives mail based on a request from the server control unit, and SMTP that transmits mail based on a request from the server control unit Client, email dark A certificate processing unit that performs encryption and decryption, and a certificate management unit that issues a certificate necessary for access to the application server at the request of the server control unit and verifies the certificate by a request from the application server, The firewall of the present invention includes an IP address management unit that acquires an IP address by DHCP or the like, and a port management unit that performs opening / closing and conversion of a port based on a request from a server control unit. By adopting such a configuration, a connection request via a mail server, dynamic opening / closing and conversion of the port, and replying with an IP address and a client certificate can achieve the object of the present invention. .

  Next, the effect of the present invention will be described.

  The first effect is that an attack on the server can be prevented.

  This is because the port number is randomly opened only when necessary, and the port number and IP address that have been released are sent in encrypted mail. This is because the risk of being attacked is reduced.

  This is also because the IP address translation is executed only by the necessary partner when necessary by the firewall, so that the time for accepting the address translation and the partner can be limited, and the risk of being attacked is reduced.

  The second effect is that client certificate distribution can be simplified.

  This is because the IP address information, port information and client certificate corresponding to the special address are sent together via the mail server.

  A third effect is that a plurality of application servers can be installed in the Local IP area.

  This is because, when a connection request is made, a server to which connection is desired is designated, and IP address and port conversion is executed based on the designation.

(First embodiment)
The first embodiment of the present invention uses a mail server 3 instead of a special server such as a dynamic DNS server in a network in which an IP address assigned to the information providing apparatus 2 changes. In response to a request by an encrypted mail from the information receiving apparatus 1, when necessary, the port is randomly opened only to the necessary partner, and the number of the opened port and its own IP address information are encrypted. By replying, it is possible to prevent an attack on the information providing apparatus 2 with respect to the prior art.

  In addition, when the IP address information is notified, the client certificate necessary for accessing the information providing apparatus 2 is also notified in a batch, thereby simplifying the distribution of the client certificate.

(Description of configuration)
With reference to FIG. 1, the structure in this Embodiment is demonstrated.

  The first embodiment includes an information receiving device 1, an information providing device 2, and a mail server 3.

  The information receiving device 1 is a terminal device that is connected to a network such as the Internet and browses information in the information providing device 2. Specifically, a personal computer equipped with a WEB browser corresponds to this. The information receiving device 1 accesses the information providing device 2 by a special address (for example, a device nickname, an abbreviated name, or a telephone number) assigned to the information providing device 2 and uniquely identifying the information providing device 2. When the request is received from the user, a connection request mail to the information providing apparatus 2 is transmitted to the mail server 3. The information receiving apparatus 1 receives the reply mail from the information providing apparatus 2 through the mail server 3, extracts the IP address and port number of the information providing apparatus 2 and the client certificate information from the reply mail. Connect to the providing device 2 to acquire and display information.

  The information providing apparatus 2 is an apparatus for connecting to a network such as the Internet and providing information to the information providing apparatus 1. Specifically, this is a WEB server or the like. The information providing device 2 obtains a connection request mail from the information receiving device 1 through the mail server 3 and sets the port for opening the self-confidence. The address, port number, and client certificate information are transmitted as a reply mail, and the connection from the information receiving apparatus 1 is accepted.

  The mail server 3 is connected to a network such as the Internet, and is a device for transferring, storing, and retrieving electronic mail.

  Here, details of each device will be described.

  The information receiving apparatus 1 includes an application client 11, a client control unit 12, an address table 13, a POP client 14, an SMTP client 15, and an encryption processing unit 16.

The application client 11 receives a connection instruction to the connection destination address from the user, connects to an application server or the like in the information providing apparatus 2, acquires information in the application server, and displays it to the user. Further, the application client 11 inquires about the connection destination according to the type of the connection destination address instructed by the user.
(1) When the connection destination address designated by the user is an IP address, the connection is made to the IP address as it is.
(2) When the connection destination address instructed by the user is FQDN (Fully Qualified Domain Name), an inquiry is made to the operating system, and the IP address obtained as a result is connected.
(3) When the connection destination address instructed by the user is a special address used in the present invention, the client control unit 12 is inquired and connected to the acquired IP address. At this time, if necessary, the client certificate acquired from the client control unit 12 is presented.

The client control unit 12 executes the following operations (a), (b), and (c).
(A) When a special address inquiry is received from the application client 11, the connection destination mail address is searched from the address table 13 using the special address as a key. As a result of the search, the SMTP server 15 is instructed to send a connection request mail with the mail address of the information receiving apparatus 1 as a transmission source with the mail address obtained as a destination.
(B) After the connection request mail is transmitted in (a), until the reply mail is received, the mail server 3 is periodically checked for the presence of mail through the POP client 14. If the reply mail arrives, this mail is acquired through the POP client 14, is deleted from the mail server 3, and the subsequent confirmation of whether or not mail has arrived is stopped. Then, the obtained IP address, port number, and client certificate of the information providing apparatus 2 are notified to the application client 11.
(C) If the POP client 14 is notified of the failure in decrypting the response mail when the response mail is acquired by (b), the search failure is notified to the application client 11.

  The address table 13 is a table in which a connection destination special address and a mail address corresponding to the special address are registered in association with each other. For example, when a search is received from the client control unit 12 using the special address of the information providing apparatus 2, the mail address of the information providing apparatus 2 is searched and returned based on the special address.

  In response to a request from the client control unit 12, the POP client 14 accesses the POP server 31 and acquires mail addressed to the information receiving apparatus 1 stored in the mail spool 33. Further, the POP client 14 decrypts the mail using the encryption processing unit 16 and notifies the client control unit 12 of the mail obtained as a result of the decryption. If the decryption fails, the client control unit 12 is notified accordingly.

  The SMTP client 15 receives a mail transmission request from the client control unit 12, encrypts this mail using the encryption processing unit 16, accesses the SMTP server 32 to transmit the mail after completion of the encryption, and sends a mail spool 33. Save in.

The cryptographic processing unit 16 performs the following operations (1) and (2).
(1) In response to a request from the SMTP client 15, encryption is performed using the public key received from the encryption processing unit 26 in advance, and the result is returned to the SMTP client 15.
(2) In response to a request from the POP client 14, decryption is performed using its own secret key, and the result is returned to the POP client 14.

  Next, the information providing device 2 will be described in detail.

  The information providing apparatus 2 includes an application server 21, a server control unit 22, an IP address management unit 23, an SMTP client 24, a POP client 25, an encryption processing unit 26, a port management unit 27, and a certificate management unit 28.

  The application server 21 receives a connection request from the application client 11 and returns information stored in the application server 21 in accordance with the request from the application client 11.

The server control unit 22 periodically checks the mail server 3 for the presence of mail through the POP client 25. If the connection request mail arrives, this mail is acquired through the POP client 25. Further, after acquiring the mail, the mail is deleted from the mail server 3. Further, the server control unit 22 executes the following operation.
(A) When the decrypted mail can be received from the POP client 25, the IP address management unit 23 is inquired about the information of its own IP address acquired by DHCP or set by manual setting, and assigned to itself An electronic mail is created from the correspondence between the special address and the IP address acquired by the inquiry to the IP address management unit, and further attached with a client certificate and transmitted through the SMTP client 24.
(B) If the decrypted mail cannot be received from the POP client 25, the mail is discarded because decryption has failed.

  The IP address management unit 23 is a function of an operating system (OS) such as Windows (registered trademark) or Linux, and accepts an IP address setting by automatic setting by DHCP or manual setting by a user. to manage.

  The SMTP client 24 receives a mail transmission request from the server control unit 22, encrypts this mail using the encryption processing unit 26, accesses the mail after the encryption is completed, accesses the SMTP server 32, and transmits the mail. It is stored in the spool 33.

  In response to a request from the server control unit 22, the POP client 25 accesses the POP server 31 to acquire a mail addressed to the information providing apparatus 2 stored in the mail spool 33, and uses the encryption processing unit 26 to send this mail. The server control unit 22 is notified of the mail obtained as a result of decryption. If the decryption fails, the server control unit 22 is notified accordingly.

The cryptographic processing unit 26 performs the following operations (1) and (2).
(1) In response to a request from the SMTP client 24, encryption is performed using the public key received from the encryption processing unit 16 in advance, and the result is returned to the SMTP client 24.
(2) In response to a request from the POP client 25, decryption is performed using its own secret key, and the result is returned to the POP client 25.

  The port management unit 27 blocks or permits communication from the outside of the information providing apparatus 2 to the application server 21 in response to a request from the server control unit 22.

  The certificate management unit 28 issues a client certificate necessary for accessing the application server 21 in response to a request from the server control unit 22. Further, the validity of the certificate is verified in response to a request from the application server 21 and the result is returned to the application server 21.

  Next, the mail server 3 will be described in detail.

  The mail server 3 includes a POP server 31, an SMTP server 32, and a mail spool 33.

  In response to the mail reception request from the POP client 14, the POP server 31 retrieves mail from the mail spool 33 and transfers it to the POP client 14.

  The SMTP server 32 receives mail from the SMTP client 24 in response to a mail transmission request from the SMTP client 24 and stores the mail in the mail spool 33.

  The mail spool 33 stores the mail in response to a request from the SMTP server 32, retrieves the mail in response to a request from the POP server 31, and deletes the mail if requested.

(Description of operation)
Hereinafter, the operation in the present embodiment will be described with reference to FIG. 1 divided into connection request transmission, connection request reception, response transmission, response reception, disconnection notification transmission, and disconnection notification reception.

  It is assumed that each of the information receiving apparatus 1 and the information providing apparatus 2 has a unique mail address, and a special address is set in the server control unit 22 in the information providing apparatus 2.

  Further, it is assumed that the cryptographic processing unit 16 and the cryptographic processing unit 26 have the other party's public key in advance, and the association between the special address and the mail address is registered in the address table 13 in advance.

(Send connection request)
Hereinafter, an operation example when the user makes an access request to the information providing apparatus 2 using the special address of the information providing apparatus 2 to the application client 11 will be described with reference to FIG.

  When the application client 11 receives a connection request to the information providing apparatus 2 using a special address indicating the information providing apparatus 2 from the user, the application client 11 inquires of the client control unit 12 about the mail address of the information providing apparatus 2 (step S1).

  The client control unit 12 searches the address table 13 for the mail address of the information providing device 2 using the special address indicating the information providing device 2 inquired from the application client 11 as a key (step S2).

  The client control unit 12 notifies the SMTP client 15 of the mail address of the searched information providing apparatus 2. Further, the client control unit 12 instructs the SMTP client 15 to transmit a connection request mail with the notified mail address as a destination and the information receiving apparatus 1 as a transmission source (step S3). In order to facilitate identification when the information providing apparatus 2 receives the connection request mail, a code indicating that it is a connection request mail may be added to the header of the connection request mail. At this time, the IP address of the information receiving device 1 may be added to the text of the connection request mail in order to limit the partners with which the information providing device 2 opens the port.

  The SMTP client 15 receives a mail transmission request from the client control unit 12 and requests the encryption processing unit 16 to encrypt the mail.

  In response to a request from the SMTP client 15, the encryption processing unit 16 encrypts the mail using the public key received from the encryption processing unit 26 in advance, and returns the encrypted mail to the SMTP client 15 (step S4).

  The SMTP client 15 accesses the SMTP server 32 and transmits an encrypted mail (step S5).

  The SMTP server 32 confirms the destination of the mail transmitted from the SMTP client 15 and requests that the mail be stored in the mail spool 33 because it is addressed to the information providing apparatus 2.

  The mail spool 33 receives the mail storage request from the SMTP server 32 and stores the mail in the spool of the information providing apparatus 2 (step S6).

(Reception of connection request)
An example of operation when receiving a connection request will be described with reference to FIG.

  The server control unit 22 periodically checks the mail server 3 through the POP client 25 for the presence of a mail addressed to the information providing apparatus 2 and confirms the arrival of a connection request mail addressed to the information providing apparatus 2. If there is a connection request mail, the POP client 25 is instructed to receive the connection request mail (step S11).

  In response to a request from the server control unit 22, the POP client 25 accesses the POP server 31, acquires the mail addressed to the information providing apparatus 2 stored in the mail spool 33, and requests the encryption processing unit 26 to decrypt it. (Step S12). At this time, the acquired mail may be limited to only the connection request mail based on the headline of the acquired mail. In this case, the information receiving apparatus 1 adds a code indicating that it is a connection request mail to the header of the connection request mail.

  In response to a request from the POP client 25, the encryption processing unit 26 performs decryption using its own secret key, and returns the result to the POP client 25 (step S13).

  The POP client 25 notifies the server control unit 22 of the mail obtained as a result of decryption.

  The server control unit 22 receives the decrypted mail from the POP client 25, and receives information on the IP address of the information providing apparatus 2 itself set in the IP address management unit 23 by DHCP or by manual setting. Inquire.

  Further, the server control unit 22 notifies the port management unit 27 of an external connection request to the application server 21.

  In response to the connection request from the server control unit 22, the port management unit 27 randomly selects a port to be opened from the free ports for the outside of the information providing device 2 and opens (for example, 9080) (step S14). ).

  Further, the port management unit 27 sets the address conversion from the available port (9080) to the standby port (for example, 80) of the application server 21 (step S15).

  Then, the server control unit 22 is notified of the released external port number (9080). At this time, when the IP address of the information receiving device 1 is notified by the connection request mail, the free port may be opened only to the notified IP address.

  The server control unit 22 requests the certificate management unit 28 to issue a client certificate. The certificate management unit 28 issues a certificate necessary for access to the application server 21 based on a request from the server control unit 22, and passes the certificate to the server control unit 22 (step S16).

(Send response)
An example of operation when a response mail is transmitted in response to a request will be described with reference to FIG.

  The server control unit 22 uses the special address assigned to itself as a headline, and displays the IP address acquired by the inquiry to the IP address management unit 23 and the port (9080) assigned by the port management unit 27 as the body text. In addition, a client certificate issued by the certificate management unit 28 is attached, and an e-mail (response mail) is created with the information receiving device 1 as the destination and the information providing device 2 as the transmission source, and SMTP It transmits through the client 24 (step S21). At this time, a sign indicating that it is a reply mail may be added to the headline of the reply mail.

  The SMTP client 24 receives a mail transmission request from the server control unit 22 and requests the encryption processing unit 26 to encrypt the mail. In response to a request from the SMTP client 24, the encryption processing unit 26 performs encryption using the public key received from the encryption processing unit 16 in advance, and returns the result to the SMTP client 24 (step S22).

  The SMTP client 24 accesses the SMTP server 32 and transmits the mail after completion of encryption (step S23).

  The SMTP server 32 confirms the destination of the mail transmitted from the SMTP client 24 and requests that the mail be stored in the mail spool 33 because it is addressed to the information receiving apparatus 1. The mail spool 33 receives the mail storage request from the SMTP server 32 and stores the mail in the spool of the information receiving apparatus 1 (step S24).

(Reply received)
An example of operation when receiving a reply mail transmitted in response to a connection request will be described with reference to FIG.

  The client control unit 12 periodically checks the mail server 3 for the presence of mail through the POP client 14 and confirms the arrival of the reply mail. Then, the POP client 14 is instructed to receive mail (step S31).

  In response to a request from the client control unit 12, the POP client 14 accesses the POP server 31, acquires the mail addressed to the information receiving apparatus 1 stored in the mail spool 33, and requests the encryption processing unit 16 to decrypt it. (Step S32). At this time, the acquired mail may be limited to only the reply mail according to the headline of the acquired mail. In this case, a sign indicating that it is a reply mail is added to the headline of the reply mail.

  In response to a request from the POP client 14, the encryption processing unit 16 performs decryption using its own secret key, and returns the result to the POP client 14 (step S33).

  The POP client 14 notifies the client control unit 12 of the mail obtained as a result of decryption.

  The client control unit 12 notifies the application client 11 of the IP address and port number of the information providing apparatus 2 obtained from the POP client 14 and the client certificate.

  The application client 11 receives notification of the IP address and port number (9080) corresponding to the special address and the client certificate from the client control unit 12, and connects to this address using SSL to receive information. Information provision request data is transmitted (step S34). At this time, the client certificate is presented.

  The port management unit 27 in the information providing device 2 receives an information provision request from the application client 11 at the port 9080, converts the destination port of the information provision request data to the standby port 80 of the application server 21, and sends it to the application server 21. Transfer (step S35). At this time, if it is set to open only to the notified IP address, the free port is opened only to that IP address.

  When the application server 21 receives the connection from the application client 11 and confirms the validity of the presented client certificate through the certificate management unit 28 (step S36), the application server 21 follows the instruction from the user after completing the connection process. 21 is acquired (step S37) and displayed to the user.

(Send notification)
An example of operation when a disconnection request is transmitted will be described with reference to FIG.

  Hereinafter, an operation example in the case where there is no access request to the information providing apparatus 2 from the user for a certain period of time after the user makes a request for access to the information providing apparatus 2 to the application client 11 using a special address. explain.

  When a predetermined time has elapsed since the last time the client control unit 12 received an inquiry about the IP address corresponding to the special address of the information providing device 2 from the application client 11 (step S41), the information providing device 2 is notified to the address table 13. The SMTP client 15 is instructed to send a disconnection notification mail with the notified mail address as the destination and the mail address of the information receiving apparatus 1 as the transmission source. (Step S42). At this time, in order to designate the port to be closed by the information providing apparatus 2, the port number of the information providing apparatus 2 received by the reply mail to the connection request is added to the body of the disconnection notification mail. At this time, in order to facilitate identification when the information providing apparatus 2 receives the disconnection notification mail, a code indicating that it is a disconnection notification mail may be added to the header of the disconnection notification mail.

  The SMTP client 15 receives a mail transmission request from the client control unit 12, and encrypts this mail using the encryption processing unit 16 (step S43).

  The encryption result is returned to the SMTP client 15.

  The SMTP client 15 accesses the SMTP server 32 and transmits the mail after completion of encryption (step S44).

  The SMTP server 32 confirms the destination of the mail transmitted from the SMTP client 15 and requests that the mail be stored in the mail spool 33 because it is addressed to the information providing apparatus 2.

  The mail spool 33 receives the mail storage request from the SMTP server 32 and stores the mail in the spool of the information providing apparatus 2 (step S45).

(Disconnect notification received)
An example of operation when receiving a disconnection request will be described with reference to FIG.

  The server control unit 22 periodically checks the mail server 3 for the presence or absence of mail through the POP client 25 and confirms the arrival of the disconnection notification mail (step S51).

  If there is a disconnection notification mail, the POP client 25 is instructed to receive the disconnection notification mail (step S52).

  In response to a request from the server control unit 22, the POP client 25 accesses the POP server 31, acquires the mail addressed to the information providing apparatus 2 stored in the mail spool 33, and requests the encryption processing unit 26 to decrypt it. . At this time, the acquired mail may be limited to only the disconnection notification mail based on the headline of the acquired mail. In this case, a code indicating that it is a disconnection notification mail is added to the header of the disconnection notification mail.

  In response to a request from the POP client 25, the cryptographic processing unit 26 performs decryption using its own secret key, and returns the result to the POP client 25 (step S53).

  The POP client 25 notifies the server control unit 22 of the mail obtained as a result of decryption.

  The server control unit 22 receives the decrypted mail from the POP client 25 and notifies the port management unit 27 of a request to close the port described in the disconnection notification mail.

  The port management unit 27 receives the port blocking request from the server control unit 22, blocks the specified external port (for example, 9080) (step 54), and further, from the external port (9080), the application server The address conversion to 21 standby ports (for example, 80) is stopped (step S55).

  The server control unit 22 requests the certificate management unit 28 to delete the client certificate issued to the information receiving apparatus 1. The certificate management unit 28 deletes the certificate issued to the information receiving device 1 based on the request from the server control unit 22 (step S56).

  As described above, the port of the information providing apparatus 2 and the certificate can be deleted by the disconnection notification mail transmitted from the information receiving apparatus.

  In this description, the disconnection notification is performed using mail. However, the application client 11 may directly request disconnection from the application server 21 without using mail. In this case, when the application server 21 receives the application client disconnection notification, the server control unit 22 notifies the server control unit 22 of the reception of the disconnection notification. The port 27 is requested to block the unit 27, and the certificate management unit 28 is requested to delete the certificate.

(The invention's effect)
Next, the effect of this embodiment will be described.
If the invention described in this embodiment is used, an attack on the server can be prevented.

  This is because the port is opened randomly only to the necessary party when necessary, and the released port number and IP address are sent by encrypted mail, so the time when the port is open, the time when the port is released This is because the target person can be limited and the risk of being attacked is reduced.

  In addition, when the invention described in this embodiment is used, distribution of a client certificate can be simplified.

  This is because the IP address information, port information and client certificate corresponding to the special address are sent together via the mail server.

(Second Embodiment)
Next, a second embodiment of the present invention will be described.
In the second embodiment of the present invention, the information providing apparatus 2 performs the IP address conversion not only on the necessary partner but also on the IP address, when necessary in the firewall 5 with respect to the first embodiment. It is different in that an attack to the information providing apparatus 2 is prevented more firmly than in the first embodiment by communicating with the communication.

  In the present embodiment, the server control unit 22 controls the IP address management unit 23 and the port management unit 27 via the UPnP client 41 and the UPnP server 51 without directly controlling the IP address management unit 23 and the port management unit 27.

(Description of configuration)
With reference to FIG. 2, the configuration of the present embodiment will be described.
In the second embodiment of the present invention, the information providing device 2 in the first embodiment is divided into an information providing device 2, an access control device 4, and a firewall 5.

  The information providing apparatus 2 includes the application server 21 in the first embodiment.

  The access control device 4 includes a server control unit 22, an SMTP client 24, a POP client 25A, an encryption processing unit 26, a certificate management unit 28, and a UPnP client 41 in the first embodiment.

  The UPnP client 41 receives control commands for the IP address management unit 23 and the port management unit 27 from the server control unit 22 and transmits them to the UPnP server 51. Further, setting information and the like issued by the IP address management unit 23 and the port management unit 27 are received from the UPnP server 51 and transmitted to the server control unit 22.

  The device on which the UPnP client 41 is mounted, that is, the access control device 4 is generally called a control point (CP).

  The firewall 5 includes the IP address management unit 23 and the port management unit 27 in the first embodiment, and further includes a UPnP server 51.

  The UPnP server 51 receives control commands for the IP address management unit 23 and the port management unit 27 from the UPnP client 41 and notifies the IP address management unit 23 or the port management unit 27 of them. In addition, setting information and the like issued by the IP address management unit 23 and the port management unit 27 are received and transmitted to the UPnP client 41.

  A device on which the UPnP server 51 is mounted, that is, the firewall 5 is generally called Internet Gateway Device (IGD).

(Description of operation)
Hereinafter, with reference to FIG. 2, the operation in the present embodiment will be described separately for connection request transmission, connection request reception, response transmission, and response reception.

  Each of the information receiving device 1 and the access control device 4 has a mail address, and the server control unit 22 in the access control device 4 has a special address that means the information providing device 2 and the IP of the information providing device 2. Assume that an address (for example, 192.168.0.2) is set.

  Further, the cryptographic processing unit 16 and the cryptographic processing unit 26 have the other party's public key in advance, and the address table 13 stores in advance the special address meaning the information providing device 2 and the mail address of the access control device 4. Assume that the association is registered.

(Send connection request)
Hereinafter, an operation example when the user makes an access request to the information providing apparatus 2 using the special address to the application client 11 will be described with reference to FIG.

  When the application client 11 receives a connection request to the information providing apparatus 2 using a special address that means the information providing apparatus 2 from the user, the application client 11 inquires of the client control unit 12 about the mail address of the communication control apparatus 4 (step S61). The client control unit 12 searches for the mail address from the address table 13 using the special address received from the application client 11 as a key (step S62).

  The client control unit 12 instructs the SMTP client 15 to transmit a connection request mail using the information receiving apparatus 1 as a transmission source with the mail address searched from the address table 13 as a destination (step S63). At this time, in order to facilitate identification when the information providing apparatus 2 receives the connection request mail, a code indicating that it is a connection request mail may be added to the header of the connection request mail. At this time, the IP address of the information receiving device 1 may be added to the text of the connection request mail in order to limit the partners with which the information providing device 2 opens the port.

  The SMTP client 15 receives a mail transmission request from the client control unit 12 and requests to encrypt this mail using the encryption processing unit 16. In response to a request from the SMTP client 15, the encryption processing unit 16 performs encryption using the public key received in advance from the encryption processing unit 26, and returns the encrypted mail to the SMTP client 15 (step S64).

  The SMTP client 15 accesses the SMTP server 32 and transmits the encrypted mail (step S65).

  The SMTP server 32 confirms the destination of the mail transmitted from the SMTP client 15 and requests that the mail be stored in the mail spool 33 because it is addressed to the access control device 4. The mail spool 33 receives the mail storage request from the SMTP server 32, and stores the mail in the spool of the access control device 4 (step S66).

(Connection request received)
An operation example when receiving a connection request will be described with reference to FIG.

  The server control unit 22 in the access control device 4 periodically checks the mail server 3 for the presence of mail through the POP client 25 (step S71) and confirms the arrival of the connection request mail. If there is a mail, the POP client 25 is instructed to receive a connection request mail (step S72).

  In response to a request from the server control unit 22, the POP client 25 accesses the POP server 31, acquires the mail addressed to the access control device 4 stored in the mail spool 33, and requests the encryption processing unit 26 to decrypt it. . At this time, the acquired mail may be limited to only the connection request mail based on the headline of the acquired mail. In this case, a code indicating connection request mail is added to the header of the connection request mail.

  In response to a request from the POP client 25, the cryptographic processing unit 26 performs decryption using its own secret key, and returns the result to the POP client 25 (step S73).

  The POP client 25 notifies the server control unit 22 of the mail obtained as a result of decryption.

  The server control unit 22 receives the decrypted mail from the POP client 25, and obtains or manually sets the IP address management unit 23 in the firewall 5 via the UPnP client 41 and the UPnP server 51 by DHCP or the like. Queries the external IP address of the set firewall 5.

  Further, the server control unit 22 requests the port management unit 27 in the firewall 5 to allocate a free port via the UPnP client 41 and the UPnP server 51.

  The IP address management unit 23 notifies the server control unit 22 of the external IP address (200.200.200.1) of the firewall 5 through the UPnP server 51 and the UPnP client 41.

  The port management unit 27 randomly assigns connection ports from among the free ports (eg, 9080 is assigned), and notifies the server control unit 22 through the UPnP server 51 and the UPnP client 41 (step S74).

  The server control unit 22 passes the UPnP client 41 and the UPnP server 51 to the port management unit 27 from the external IP address and port (for example, 200.200.200.1:9080) of the firewall 5. A setting request is sent to perform the conversion operation to the IP address and port (for example, 192.168.0.2:80) of the information providing apparatus 2 (step S75). At this time, when the IP address of the information receiving device 1 is notified by the connection request mail, the conversion operation may be requested to convert only the packet transmitted from the IP address of the information receiving device 1. .

  The port management unit 27 in the firewall 5 receives the connection request from the server control unit 22, and from the IP address and the free port (9080), the IP address and the standby port (for example, 192.168.0.2) of the application server 21. :) to start address conversion.

  The server control unit 22 requests the certificate management unit 28 to issue a client certificate (step S76).

  Based on a request from the server control unit 22, the certificate management unit 28 issues a certificate necessary for access to the application server 21 and passes it to the server control unit 22.

(Send response)
An operation example in the case of sending a reply mail in response to a connection request will be described with reference to FIG.

  The server control unit 22 in the access control device 4 uses the special address meaning the information providing device 2 assigned to itself as a headline, the IP address acquired by the inquiry to the IP address management unit 23, and the port management unit 27. The port (200.200.200.1:9080) assigned by the client is described in the text, the client certificate issued by the certificate management unit 28 is attached, the destination is the information receiving apparatus 1, and the transmission source Then, an e-mail (answer mail) is created with the access control device 4 as a key (step S81). Then, the reply mail is transmitted through the SMTP client 24. At this time, a sign indicating that it is a reply mail may be added to the headline of the reply mail.

  The SMTP client 24 receives a mail transmission request from the server control unit 22 and requests the encryption processing unit 26 to encrypt the mail. In response to a request from the SMTP client 24, the encryption processing unit 26 performs encryption using the public key received from the encryption processing unit 16 in advance, and returns the result to the SMTP client 24 (step S82).

  The SMTP client 24 accesses the SMTP server 32 and transmits the mail after completion of encryption (step S83).

  The SMTP server 32 confirms the destination of the mail transmitted from the SMTP client 24 and requests that the mail be stored in the mail spool 33 because it is addressed to the information receiving apparatus 1. The mail spool 33 receives the mail storage request from the SMTP server 32 and stores the mail in the spool of the information receiving apparatus 1 (step S84).

(Reply received)
An example of the operation when receiving an answer mail transmitted in response to a connection request will be described with reference to FIG.

  The client control unit 12 periodically checks the mail server 3 for the presence of mail through the POP client 14 (step S91), and confirms the arrival of the reply mail. If there is a mail, the POP client 14 is instructed to receive a reply mail (step S92).

  In response to a request from the client control unit 12, the POP client 14 accesses the POP server 31, acquires the mail addressed to the information receiving apparatus 1 stored in the mail spool 33, and requests the encryption processing unit 16 to decrypt it. . At this time, the acquired mail may be limited to only the reply mail according to the headline of the acquired mail. In this case, a sign indicating that it is a reply mail is added to the headline of the reply mail.

  In response to a request from the POP client 14, the encryption processing unit 16 performs decryption using its own secret key, and returns the result to the POP client 14 (step S93).

  The POP client 14 notifies the client control unit 12 of the mail obtained as a result of decryption.

  The client control unit 12 notifies the application client 11 of the IP address and port number of the firewall 5 obtained from the POP client 14.

  The application client 11 receives a notification of an IP address and a port number (address and port number for the outside of the firewall 5) corresponding to a special address meaning the information providing device 2 from the client control unit 12, and a client certificate. Information connection is requested by connecting to the address via SSL (step S94).

  The port management unit 27 in the firewall 5 receives the connection from the application client 11 at the port 9080 having the external IP address 200.200.200.1, and sets the connection destination port to 192.168.0.2:80. The data is converted and transferred to the application server 21 in the information providing apparatus 2 (step S95). At this time, when the conversion operation is set only for the packet transmitted from the IP address of the information receiving apparatus 1, the conversion is performed only for the packet transmitted from the IP address.

  When receiving the connection from the application client 11, the application server 21 verifies the validity of the certificate through the certificate management unit 28, and executes the connection process when the validity can be confirmed. Then, according to an instruction from the user, information in the application server 21 is acquired and displayed to the user (step S96).

(Send notification)
The disconnection notification transmission in the present embodiment is the same as the disconnection notification operation in the first embodiment.

(Disconnect notification received)
An example of operation when receiving a disconnection notification will be described with reference to FIG.

  The server control unit 22 periodically checks the mail server 3 for the presence of mail through the POP client 25 (step S101), and confirms the arrival of the disconnection notification mail. If there is a mail, the POP client 25 is instructed to receive the disconnection notification mail (step S102).

  In response to a request from the server control unit 22, the POP client 25 accesses the POP server 31, acquires the mail addressed to the information providing apparatus 2 stored in the mail spool 33, and requests the encryption processing unit 26 to decrypt it. . At this time, the acquired mail may be limited to only the disconnection notification mail based on the headline of the acquired mail. In this case, a code indicating that it is a disconnection notification mail is added to the header of the disconnection notification mail.

  In response to a request from the POP client 25, the cryptographic processing unit 26 decrypts the mail using its own secret key, and returns the result to the POP client 25 (step S103).

  The POP client 25 notifies the server control unit 22 of the mail obtained as a result of decryption.

  The server control unit 22 receives the decrypted mail from the POP client 25, and sends the port described in the disconnection notification mail to the port management unit 27 in the firewall 5 via the UPnP client 41 and the UPnP server 51. Request to close (step S104).

  The port management unit 27 receives the port blocking request from the server control unit 22, blocks the specified external port (for example, 9080), and further, the external IP address and port (for example, 200.200.200.). 1: 9080), the address conversion from the IP address and port (for example, 192.168.0.2:80) of the information providing apparatus 2 is stopped (step S105).

  The server control unit 22 requests the certificate management unit 28 to delete the client certificate issued to the information receiving apparatus 1. The certificate management unit 28 deletes the certificate issued to the information receiving device 1 based on the request from the server control unit 22 (step S106).

  As described above, the port of the information providing apparatus 2 and the certificate can be deleted by the disconnection notification mail transmitted from the information receiving apparatus.

  In this description, the disconnection notification is performed using mail. However, the application client 11 may directly request disconnection from the application server 21 without using mail. In this case, when the application server 21 receives the application client disconnection notification, the server control unit 22 notifies the server control unit 22 of the reception of the disconnection notification. Requests the unit 27 to close the port and stop address translation, and further requests the certificate management unit 28 to delete the certificate.

(The invention's effect)
Next, the effect of this embodiment will be described.
If the invention described in this embodiment is used, an attack on the server can be prevented.

  This is because the port is opened randomly only to the necessary party when necessary, and the number and IP address of the released port are sent by encrypted mail. This is because the risk of being attacked is reduced.

  This is also because the IP address conversion is performed only to the necessary partner when necessary by the firewall, so that the time for accepting the address translation and the partner can be limited, and the risk of being attacked is reduced.

  In addition, when the invention described in this embodiment is used, distribution of a client certificate can be simplified.

  This is because the IP address information, port information and client certificate corresponding to the special address are sent together via the mail server.

(Third embodiment)
Next, the form of the 3rd Embodiment of this invention is demonstrated.
In the third embodiment of the present invention, an information providing device 6 is added to the second embodiment, and the information receiving device 1 specifies an information providing device desired to be connected when transmitting a connection request. It is different in point.

(Description of configuration)
With reference to FIG. 3, the structure in this Embodiment is demonstrated.
The information providing device 6 is the same information providing device as the information providing device 2 in the second embodiment.

(Description of operation)
Hereinafter, with reference to FIG. 3, the operation in the present embodiment will be described separately for connection request transmission, connection request reception, response transmission, and response reception.

  It is assumed that each of the information receiving device 1 and the access control device 4 has a mail address.

  The server control unit 22 in the access control device 4 includes information relating to the association between the special address meaning the information providing device 2 and the IP address (for example, 192.168.0.2) of the information providing device 2, and the information providing device 6 Assume that the association information between the meaning special address and the IP address (for example, 192.168.0.6) of the information providing device 6 is held.

  Further, it is assumed that the cryptographic processing unit 16 and the cryptographic processing unit 26 have the other party's public key in advance. In addition, the address table 13 preliminarily associates the special address meaning the information providing device 2 with the mail address of the access control device 4 and the correspondence between the special address meaning the information providing device 6 and the mail address of the access control device 4. The date is assumed to be registered.

(Send connection request)
Hereinafter, an operation example in the case where the user requests access to the information providing apparatus 6 using the special address with respect to the application client 11 will be described with reference to FIG.

  When the application client 11 receives a connection request to the information providing apparatus 6 using a special address that means the information providing apparatus 6 from the user, the application client 11 inquires of the client control unit 12 a mail address of the information providing apparatus 6 (step S111).

  The client control unit 12 searches the address table 13 for the mail address of the information providing apparatus 6 using the special address received from the application client 11 as a key (step S112).

  The client control unit 12 instructs the SMTP client 15 to transmit a connection request mail with the mail address of the information receiving apparatus 1 as a transmission source with the retrieved mail address as a destination. In addition, the special address of the other party (that is, the information providing apparatus 6) that desires connection is also written in this mail. At this time, in order to facilitate identification when the information providing apparatus 2 receives the connection request mail, a code indicating that it is a connection request mail may be added to the header of the connection request mail. At this time, the IP address of the information receiving apparatus 1 may be added to the body of the connection request mail in order to limit the partners with which the information providing apparatus 2 opens the port.

  The SMTP client 15 receives a mail transmission request from the client control unit 12, and encrypts this mail using the encryption processing unit 16 (step S113).

  In response to a request from the SMTP client 15, the encryption processing unit 16 encrypts the mail using the public key received from the encryption processing unit 26 in advance, and returns the result to the SMTP client 15 (step S114).

  The SMTP client 15 accesses the SMTP server 32 and transmits the mail after encryption is complete (step S115).

  The SMTP server 32 confirms the destination of the mail transmitted from the SMTP client 15, and requests to store the mail in the mail spool 33 because it is addressed to the access control device 4. The mail spool 33 receives the mail storage request from the SMTP server 32, and stores the mail in the spool of the access control device 4 (step S116).

(Connection request received)
An operation example in the case of receiving a connection request will be described with reference to FIG.

  The server control unit 22 in the access control device 4 periodically checks the mail server 3 for the presence of mail through the POP client 25 and confirms the arrival of the connection request mail (step S121). If there is a mail, the POP client 25 is instructed to receive a connection request mail (step S122).

  In response to a request from the server control unit 22, the POP client 25 accesses the POP server 31, acquires the mail addressed to the access control device 4 stored in the mail spool 33, and requests the encryption processing unit 26 to decrypt it. . At this time, the acquired mail may be limited to only the connection request mail based on the headline of the acquired mail. In this case, a code indicating connection request mail is added to the header of the connection request mail.

  In response to a request from the POP client 25, the cryptographic processing unit 26 performs decryption using its own secret key, and returns the result to the POP client 25 (step S123).

  The POP client 25 notifies the server control unit 22 of the mail obtained as a result of decryption.

  The server control unit 22 receives the decrypted mail from the POP client 25, and obtains or manually sets the IP address management unit 23 in the firewall 5 via the UPnP client 41 and the UPnP server 51 by DHCP or the like. Queries the external IP address that has been set.

  Further, the server control unit 22 requests the port management unit 27 in the firewall 5 to allocate a free port via the UPnP client 41 and the UPnP server 51.

  The IP address management unit 23 notifies the server control unit 22 of the external IP address (200.200.200.1) through the UPnP server 51 and the UPnP client 41.

  The port management unit 27 randomly assigns connection ports from among the free ports (eg, 9080 is assigned), and notifies the server control unit 22 through the UPnP server 51 and the UPnP client 41 (step S124).

  The server control unit 22 sends the information providing device 6 from the external IP address and port (for example, 200.200.200.1:9080) to the port management unit 27 via the UPnP client 41 and the UPnP server 51. Is requested to start the conversion operation to the IP address and port (for example, 192.168.0.6:80) (step S125). At this time, when the IP address of the information receiving device 1 is notified by the connection request mail, the conversion operation may be requested to convert only the packet transmitted from the IP address of the information receiving device 1. .

  The port management unit 27 in the firewall 5 receives a connection request from the server control unit 22, and from the IP address and the free port (200.200.200.1:9080), the IP address and the standby port ( For example, address conversion to 192.168.0.6:80) is started.

  The server control unit 22 requests the certificate management unit 28 to issue a client certificate. The certificate management unit 28 issues a certificate necessary for access to the application server 21 based on a request from the server control unit 22, and passes the certificate to the server control unit 22 (step S126).

(Send response)
An operation example in the case of sending a reply mail in response to a connection request will be described with reference to FIG.

  The server control unit 22 in the access control device 4 uses the special address meaning the information providing device 6 assigned to itself as a headline, the IP address acquired by the inquiry to the IP address management unit 23, and the port management unit 27. E-mail in which the port (9080) assigned by the client is described in the text, the client certificate issued by the certificate management unit 28 is attached, the destination is the information receiving device 1, and the transmission source is the access control device 4. (Answer mail) is created and transmitted through the SMTP client 24 (step S131). At this time, a sign indicating that it is a reply mail may be added to the headline of the reply mail.

  The SMTP client 24 receives a mail transmission request from the server control unit 22, and encrypts this mail using the encryption processing unit 26 (step S132).

  The encryption result is returned to the SMTP client 24.

  The SMTP client 24 accesses the SMTP server 32 and transmits the mail after completion of encryption (step S133).

  The SMTP server 32 confirms the destination of the mail transmitted from the SMTP client 24 and requests that the mail be stored in the mail spool 33 because it is addressed to the information receiving apparatus 1. The mail spool 33 receives the mail storage request from the SMTP server 32 and stores the mail in the spool of the information receiving apparatus 1 (step S134).

(Reply received)
An example of the operation when receiving a reply mail transmitted in response to a connection request will be described with reference to FIG.

  The client control unit 12 periodically checks the mail server 3 for mail through the POP client 14 and confirms the arrival of the reply mail (step S141). If there is a mail, the POP client 14 is instructed to receive a reply mail (step S142).

  In response to a request from the client control unit 12, the POP client 14 accesses the POP server 31, acquires the mail addressed to the information receiving apparatus 1 stored in the mail spool 33, and requests the encryption processing unit 16 to decrypt it. . At this time, the acquired mail may be limited to only the reply mail according to the headline of the acquired mail. In this case, a sign indicating that it is a reply mail is added to the headline of the reply mail.

  In response to a request from the POP client 14, the cryptographic processing unit 16 performs decryption using its own secret key, and returns the result to the POP client 14 (step S143).

  The POP client 14 notifies the client control unit 12 of the mail obtained as a result of decryption.

  The client control unit 12 notifies the application client 11 of the IP address and port number of the firewall 5 obtained from the POP client 14 and the client certificate.

  The application client 11 receives a notification of an IP address and a port number (an external address and a port number of the firewall 5) corresponding to a special address meaning the information providing device 6 from the client control unit 12, and connects to this address by SSL Then, the provision of information is requested (step S144). At this time, the client certificate notified from the client control unit 12 is presented.

  The port management unit 27 in the firewall 5 receives a request for information provision from the application client 11 at the port 9080 of the external IP address 200.200.200.1, and sets the connection destination port to 192.168.0.6: 80 and transferred to the application server 61 in the information providing apparatus 6 (step S145).

  The application server 61 receives a connection from the application client 11, checks the validity of the certificate through the certificate management unit 28, and completes the connection process when the check is made. Then, according to the instruction from the user, information in the application server 61 is acquired and displayed to the user (step S146).

(Disconnect notification transmission, disconnect notification reception)
The disconnection notification transmission and reception in the present embodiment is the same as the disconnection notification transmission and disconnection notification reception operations in the second embodiment.

(The invention's effect)
Next, the effect of this embodiment will be described.
If the invention described in this embodiment is used, an attack on the server can be prevented.

  This is because the port is opened randomly only to the necessary party when necessary, and the number and IP address of the released port are sent by encrypted mail. This is because the risk of being attacked is reduced.

  This is also because the IP address conversion is performed only to the necessary partner when necessary by the firewall, so that the time for accepting the address translation and the partner can be limited, and the risk of being attacked is reduced.

  In addition, when the invention described in this embodiment is used, distribution of a client certificate can be simplified.

  This is because the IP address information, port information and client certificate corresponding to the special address are sent together via the mail server.

  Further, when the invention described in this embodiment is used, a plurality of application servers can be installed in the Local IP area.

  This is because, when a connection request is made, a server desired to be connected is designated, and the IP address and port are converted based on the designation.

  The present invention can be applied to a home AV server apparatus, a WEB server apparatus, a home AV system, and a WEB distribution system that can view and distribute text, video, and music via a WAN such as the Internet. Further, the present invention can be applied to a home network system or home network device that controls the operation of devices in the home from outside.

It is a block diagram which shows the structure of the 1st Embodiment of this invention. It is a block diagram which shows the structure of the 2nd Embodiment of this invention. It is a block diagram which shows the structure of the 3rd Embodiment of this invention. 5 is a flowchart showing an operation of connection request transmission according to the first embodiment of the present invention. 6 is a flowchart illustrating an operation of receiving a connection request according to the first embodiment of this invention. 6 is a flowchart showing an operation of reply transmission according to the first embodiment of the present invention. 6 is a flowchart showing an operation of receiving a reply according to the first embodiment of this invention. 6 is a flowchart showing an operation of disconnection notification request transmission according to the first embodiment of the present invention. 6 is a flowchart illustrating an operation of receiving a disconnection notification according to the first embodiment of this invention. It is a flowchart which shows the operation | movement of the connection request transmission of the 2nd Embodiment of this invention. It is a flowchart which shows the operation | movement of the connection request reception of the 2nd Embodiment of this invention. It is a flowchart which shows the operation | movement of the reply transmission of the 2nd Embodiment of this invention. It is a flowchart which shows the reply reception operation | movement of the 2nd Embodiment of this invention. It is a flowchart which shows the operation | movement of reception of the disconnection notification of the 2nd Embodiment of this invention. It is a flowchart which shows the operation | movement of the connection request transmission of the 3rd Embodiment of this invention. It is a flowchart which shows the operation | movement of the connection request reception of the 3rd Embodiment of this invention. It is a flowchart which shows the operation | movement of the reply transmission of the 2nd Embodiment of this invention. It is a flowchart which shows the reply reception operation | movement of the 2nd Embodiment of this invention.

Explanation of symbols

DESCRIPTION OF SYMBOLS 1 Information receiving device 2 Information providing device 3 Mail server 4 Access control device 5 Firewall 6 Information providing device 11 Application client 12 Client control unit 13 Cache 14 POP client 15 SMTP client 16 Cryptographic processing unit 21 Application server 22 Server control unit 23 IP Address management unit 24 SMTP client 25 POP client 26 Cryptographic processing unit 27 Port management unit 28 Certificate management unit 31 POP server 32 SMTP server 33 Mail spool 41 UPnP client 51 UPnP server 61 Application server

Claims (24)

A communication control system,
A terminal that transmits a connection request mail indicating a connection request to the information providing device;
A mail server for holding the transmitted connection request mail;
The connection request mail is acquired from the mail server, and the response mail having the port number and IP address information which is randomly selected from a plurality of ports and opened by the port management unit in response to the connection request mail is encrypted. A communication control system comprising: a control unit configured to transmit the converted data.   2. The communication control system according to claim 1, wherein the port management unit is configured to permit connection of a terminal connected using information of the transmitted port number and IP address. .   The communication control system according to claim 1, wherein the control unit is configured to periodically connect to the mail server and check whether there is a connection request mail.   The communication control system according to claim 2 or 3, wherein the port management unit is configured to open a port only to a terminal that has transmitted the connection request mail.   The communication control system according to claim 1, wherein the terminal transmits the encrypted connection request mail.   The port management unit is configured to permit connection of a terminal connected by presenting a client certificate transmitted by the control unit together with information of the port number and IP address. The communication control system according to any one of claims 2 to 5.   The terminal transmits a disconnection request mail indicating a request to close the opened port when the terminal does not connect using the information of the transmitted port number and IP address for a certain period of time. The communication control system according to any one of claims 2 to 6.   When the port management unit is configured as a firewall, the port management unit converts the connection destination of the terminal connected using the information of the transmitted port number and IP address into an information providing device. The communication control system according to any one of claims 2 to 7, wherein:   The port management unit converts a connection destination of a terminal connected using the information of the transmitted port number and IP address into an information providing apparatus indicated by the terminal in a connection request mail. The communication control system according to claim 8. A communication control device,
A port management unit that randomly selects from a plurality of ports and releases the port number;
Control means for acquiring a connection request mail from a mail server, receiving the connection request mail, and encrypting and transmitting a reply mail having information on the port number and IP address opened by the port management unit;
The communication control apparatus, wherein the port management unit is configured to permit connection of a terminal connected using information of the transmitted port number and IP address. A terminal,
Sending a connection request mail indicating a connection request to the information providing device, receiving this connection request mail, obtaining information of a port number and an IP address that are randomly selected from a plurality of ports and opened, A terminal configured to connect using the acquired port number and IP address. A communication control method,
A connection request transmission step of transmitting a connection request mail indicating a connection request to the information providing device;
An acquisition step of obtaining a connection request mail from a mail server holding the transmitted connection request mail;
Upon obtaining the connection request mail, an opening step of randomly selecting and opening a port from a plurality of ports;
And a transmission step of encrypting and transmitting the reply mail having the information of the opened port number and IP address.   13. The communication control method according to claim 12, further comprising a permission step of permitting connection of a terminal connected using information of the transmitted port number and IP address.   The communication control method according to claim 12 or 13, wherein the obtaining step periodically checks whether there is a connection request mail by connecting to the mail server.   15. The communication control method according to claim 13, wherein the permission step opens a port only to a terminal that has transmitted the connection request mail.   16. The communication control method according to claim 12, wherein the connection request transmission step transmits the encrypted connection request mail.   17. The permission step allows the connection of a terminal connected by presenting the client certificate transmitted in the transmission step together with the port number and IP address information. A communication control method according to claim 1.   The method includes a step of transmitting a disconnection request mail indicating a request to close the opened port when the connection using the information of the transmitted port number and the IP address is not performed for a certain period of time. The communication control method according to any one of claims 13 to 17.   19. The permission step includes a conversion step of converting a connection destination of a terminal connected using information of the transmitted port number and IP address into an information providing device. The communication control method according to any one of the above.   The converting step converts the connection destination of the terminal connected using the information of the transmitted port number and IP address to the information providing apparatus indicated by the terminal in the connection request mail. The communication control method according to claim 19. A communication control system program, wherein the program controls the communication control system,
A terminal that transmits a connection request mail indicating a connection request to the information providing device;
A mail server for holding the transmitted connection request mail;
The connection request mail is acquired from the mail server, and the response mail having the information of the port number and IP address opened by the port management unit randomly selected from a plurality of ports in response to the connection request mail is encrypted. A program that functions as a control means for transmitting data.   The program according to claim 21, wherein the port management unit permits connection of a terminal connected using information of the transmitted port number and IP address. A communication control device program, wherein the program controls the communication control device,
A port management unit that randomly selects from a plurality of ports and releases the port number;
Obtaining a connection request mail from the mail server, receiving this connection request mail, and functioning as a control means for encrypting and transmitting a reply mail having information on the port number and IP address opened by the port management unit,
The port management unit permits connection of a terminal connected using information of the transmitted port number and IP address. A terminal program, wherein the program
Sending a connection request mail indicating a connection request to the information providing device, receiving this connection request mail, obtaining information of a port number and an IP address that are randomly selected from a plurality of ports and opened, A program that functions to connect using the acquired port number and IP address.

Images