JP2008252547A - Communication control system and communication control method - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To provide a technology that achieves proper communication control suitable to a situation. <P>SOLUTION: A communication control system performs control on communication between a client device and a server device. The system is provided with a network-layer control means, an application-layer control means, an information collecting means, which collects network-layer information acquired by the network-layer control means and application-layer information acquired by the application-layer control means so as to store them in a storage means, and a control-contents instruction means that determines contents of network-layer control and those of application-layer control on the basis of the network-layer information and the application-layer information so as to instruct the network-layer control means, the application-layer control means, or both of the control means to execute control corresponding to the determined control contents. <P>COPYRIGHT: (C)2009,JPO&INPIT

Description

  The present invention relates to a technique for performing communication control between a client device and a server device by using information of a plurality of layers in an integrated manner.

  Conventionally, there is a bandwidth control technique for controlling a network bandwidth by referring to network layer information such as an IP address and a MAC address in a packet transmitted over the network. There are also conventional techniques for determining permission / denial of access to a user based on application layer information such as a user ID and controlling the content of information provided to the user. In the prior art, network layer control and application layer control are performed separately and independently.

  In the specification and claims of the present application, the network layer information is information related to transmitting a packet on the network, for example, an IP address, a MAC address, a port number, a tag, a protocol, a used bandwidth, etc. There is. Network layer control refers to performing control related to packet transmission using these pieces of information, such as bandwidth control, priority control, and packet filtering.

The application layer information is information related to the use of the application, and includes, for example, a user ID, a password, information contents, user attributes, and device attributes to be used. Application layer control refers to performing control related to the use of an application using these pieces of information, such as user authentication, access control, and data rewriting. For example, Patent Document 1 is a prior art document related to the present application.
JP 2007-68208 A

  As described above, in the prior art, the network layer control and the application layer control are performed independently and separately, for example, there are the following problems. This will be described with reference to FIG.

  FIG. 1 is a diagram illustrating a system in which a server device 5 and a plurality of client devices 1 to 4 are connected via a network 6 such as the Internet. As shown in FIG. 1, a bandwidth control device 7 that controls the bandwidth of packet transmission from the server device 5 is provided. The bandwidth control device 7 exists between the server device 5 and each client device in terms of network.

  In addition, the server device 5 includes an application that provides information (here, map information data is taken as an example) to the client device based on a request from the client device, and the application grants the authority of the user of the client device. It has a function of identifying based on the user ID, determining whether to transmit detailed map information data or simple map information data based on the authority, and transmitting the determined map information data.

  In the system of FIG. 1, the bandwidth control device 7 determines the bandwidth (line speed, capacity) allocated for the client device based on the IP address of the client device. In the example of FIG. 1, it is assumed that the bandwidth control device 7 performs network layer control in which a large bandwidth (broadband) is allocated to the client devices 1 and 2 and a small bandwidth (narrowband) is allocated to the client devices 3 and 4. The client devices 1 and 3 are used by low-privileged users, the client devices 2 and 4 are used by high-privileged users, and the server device 5 is smaller in size than the client devices 1 and 3 corresponding to low-privileged users. Simple map information data is provided, and application layer control is performed to transmit large-sized detailed map information data to the client devices 2 and 4 corresponding to the high authority user.

  In the conventional technology, since these network layer control and application layer control are performed independently, detailed map information data having a large size is transmitted to the client device 4 to which a narrow band is allocated. Will occur. In such a case, there are problems that it takes a very long time to transmit the map information data, or the session is disconnected because the map information data cannot be transmitted. That is, there arises a problem that sufficient convenience cannot be provided to a highly authorized user.

  The present invention has been made in view of the above points, and performs a network layer control and an application layer control based on the network layer information and the application layer information, thereby realizing an appropriate communication control suitable for the situation. The purpose is to provide.

  The above-described problem is a communication control system that controls communication between a client device and a server device, and includes a network layer control unit that performs network layer control for communication between the client device and the server device, and the client device. Application layer control means for performing application layer control for communication between the server apparatuses, network layer information acquired by the network layer control means from information transmitted between the client apparatus and the server apparatus, and the client apparatus Information collecting means for collecting application layer information acquired by the application layer control means from information transmitted between the server devices, and storing the collected information in the storage means; Based on the network layer information and the application layer information, the content of the network layer control executed by the network layer control means and the content of the application layer control executed by the application layer control means are determined, and the determined control The network control unit or the application layer control unit or a control content instruction unit for instructing both of the control unit to perform the control according to the content Is done.

  The present invention is also a communication control method executed by a communication control system that controls communication between a client device and a server device, wherein network layer information is obtained from information transmitted between the client device and the server device. Obtaining information, acquiring application layer information from information transmitted between the client device and the server device, and storing the information in storage means; the network layer information stored in the storage means; and Based on the application layer information, the content of the network layer control executed by the network layer control means and the content of the application layer control executed by the application layer control means are determined, and the control according to the determined control content is performed. Network layer system Control content instructing step for instructing the device or the application layer control means or both of the control means, and the network layer control means and the application layer control means in accordance with the control content instructed in the control content instructing step. It is also possible to configure as a communication control method characterized by comprising a communication control step for performing communication control according to the above.

  According to the present invention, by performing network layer control and application layer control based on network layer information and application layer information, it is possible to realize appropriate communication control suitable for the situation.

  Embodiments of the present invention will be described below with reference to the drawings.

(System configuration)
FIG. 2 shows a configuration diagram of the network system including the configuration of the communication control system in the embodiment of the present invention. In the network system shown in FIG. 2, the server device 11 is connected to a network 12 such as the Internet via the communication control system 10, and a plurality of client devices 13 to 15 are connected to the network 12. In the example of FIG. 2, a configuration in which the communication control system 10 and the server apparatus 11 are connected via a LAN is shown, but the communication control system 10 and the server apparatus 11 may be connected via a network 12.

  The communication control system 10 includes a network layer control unit 101, an application layer control unit 102, and a control management unit 103. The control management unit 103 includes a control information collection unit 110, a control information storage unit 111, and a control content instruction unit 112.

  The network layer control unit 101 is a functional unit that performs network layer control such as bandwidth control, and can be realized using a router, for example. The application layer control unit 102 is a functional unit that performs application layer control such as access control based on a user ID and data rewriting. When rewriting data or the like, the application layer control unit 102 functions as a proxy for the server device 11.

  The control information collection unit 110 in the control management unit 103 is a functional unit that collects network layer information from the network layer control unit 101 and collects application layer information from the application layer control unit 102. The control information accumulation unit 111 in the control management unit 103 is a functional unit that accumulates information collected by the control information collection unit 110. The control content instruction unit 112 in the control management unit 103 controls the network layer control unit 101 and / or the application layer control unit 102 based on the network layer information and the application layer information stored in the control information storage unit 111. It is a functional unit that determines the contents and instructs the network layer control unit 101 and / or the application layer control unit 102 to execute control of the control contents.

  The communication control system 10 can be configured as one device provided with each of the above functional units, or can be configured as a single device for each functional unit or a plurality of functional units, and can be configured with a plurality of devices.

(Operation of communication control system)
Next, the operation of the communication control system 10 configured as described above will be described with reference to FIG. FIG. 3 is a diagram showing a flow of processing between functional units.

  A predetermined request (for example, an HTTT request) is sent from the client device 13 to the server device 11, and the network layer control unit 101 receives the request as a packet (step 1).

  Upon receiving the request as a packet, the network layer control unit 101 captures the received packet and analyzes the content to obtain network layer information (eg, IP address, port number, bandwidth occupancy status, etc.) Collected by the control information collection unit 110 of the control management unit 103 (step 2).

  The network layer control unit 101 outputs the received request. If the network layer control unit 101 is set to control the request packet, the request is output after the control is performed. (Eg priority control).

  The request output from the network layer control unit 101 reaches the application layer control unit 102, and the application layer control unit 102 receives the request (step 3). The application layer control unit 102 analyzes the content of the request, acquires application layer information (for example, a user ID), and the control information collection unit 110 of the control management unit 103 collects it (step 4).

  The control information collection unit 110 that has collected the network layer information and the application layer information accumulates these pieces of information in the control information accumulation unit 111 (step 5). The control information storage unit 111 includes static information such as job title / authority corresponding to the user ID, geographical information corresponding to the IP address (address, etc.), in addition to the information acquired dynamically from the communication content. Can be accumulated.

  The control content instruction unit 112 acquires information necessary for determining the control content from the information (including history information acquired in the past) stored in the control information storage unit 111 based on a rule given in advance ( Step 6) The control contents in each of the network layer control unit 101 and the application layer control unit 102 are determined.

  Then, the control content instruction unit 112 transmits a setting change command corresponding to the determined control content, a new setting content (configuration file), or the like to the network layer control unit 101, and sets control settings to the network layer control unit 101. Change (step 7).

  Similarly, the control content instruction unit 112 transmits a setting change command corresponding to the determined control content, a new setting content (configuration file), or the like to the application layer control unit 102, and performs control setting to the application layer control unit 102. Is changed (step 8). Note that the network layer control unit 101 and the application layer control unit 102 have a function of receiving setting contents such as a configuration file and updating the settings.

  On the other hand, the application layer control unit 102 outputs the request received in step 3, but if the application layer control unit 102 is set to control this request, the control is performed (for example, Request rewriting). The request output from the application layer control unit 102 is received by the server device 11 (step 9).

  The server apparatus 11 sends a response to the received request to the client apparatus 13, and the response reaches the application layer control unit 102 (step 10). The application layer control unit 102 that has received the response performs application layer control (for example, rewriting of response data) based on the current control settings, and then outputs the response, which is received by the network layer control unit 101. (Step 11).

  The network layer control unit 101 that has received the response performs network layer control (for example, bandwidth control) based on the current control setting, and then outputs the response, which reaches the client device 13 (step 12). .

(Example)
Next, an embodiment of the communication control system 10 will be described. This embodiment corresponds to the map information distribution example described in the background art, and is particularly suitable for application to a disaster prevention system. In the present embodiment, detailed map information data is transmitted to a high authority user in a wide band, and even a low authority user accesses the server device 11 from a specific area (for example, an area where a disaster has occurred). If it is, detailed map information data can be transmitted to the user in a wide band. The system configuration is shown in FIG.

  In the communication control system 10 in this embodiment shown in FIG. 4, the network layer control unit 101 in the configuration shown in FIG. 2 is a bandwidth control device 201 that controls the bandwidth based on the destination IP address, and the application layer control unit 102 is a map. This is a proxy apparatus 202 having a function of converting information data.

  Further, it is assumed that the IP address for assigning a narrow band and the IP address for assigning a wide band have already been set in the band control device 201. Further, the detailed map information data received from the server device 11 is transmitted as it is to the client device corresponding to the specific user ID having high authority, and the client device corresponding to the specific user ID having low authority is transmitted. It is assumed that the proxy control device 202 has already been set to convert detailed map information data into simple map information data with a small amount of data and transmit it. These setting contents are also held by the control content instruction unit 112 of the control management unit 103.

  Further, in this embodiment, the control information storage unit 111 in the control management unit 103 holds a table associating the IP address and area information (address, etc.) as shown in FIG. It is assumed that a table associating user IDs and authorities as shown in b) is held. In addition, the authority in FIG.5 (b) represents a high authority, so that a number is small. Next, an operation example of the system shown in FIG. 4 will be described.

  A request for map information data including a user ID is sent from the client device 13 to the server device 11, and the bandwidth control device 201 receives the request as a packet. The bandwidth control apparatus 201 captures the received packet and analyzes the content to acquire the IP address of the transmission source, which is collected by the control information collection unit 110 of the control management unit 103.

  The request output from the bandwidth control device 201 reaches the proxy device 202. The proxy device 202 that has received the request analyzes the content of the request, acquires the user ID, and the control information collection unit 110 of the control management unit 103 collects the user ID. The control information collection unit 110 that has collected the IP address and the user ID accumulates the information in the control information accumulation unit 111. The processing of the control content instruction unit 112 will be described with reference to the flowchart of FIG.

  The control content instruction unit 112 acquires the user ID from the control information storage unit 111 (step 21), and by referring to the table shown in FIG. 5B, the user corresponding to the user ID has high authority. It is determined whether or not the user is a user (step 22). Whether the authority is high can be determined based on whether the authority number is smaller than a predetermined number.

  When it is determined in step 21 that the authority is high, the control content instructing unit 112 acquires the IP address from the control information storage unit 111 (step 23), and refers to the setting content of the bandwidth control device 201 to determine the IP address. It is determined whether or not a wideband is assigned to (step 24). Whether or not the bandwidth is wide can be determined based on whether or not the bandwidth allocated by the bandwidth control device 201 is greater than a predetermined value. If a wide band is assigned, detailed map information is sent to the high authority user in a wide band, so it is determined that the control setting contents are not changed (step 25). It should be noted that determining not to change is also included in determining the contents of control.

  If it is determined in step 24 that no broadband is assigned, the control content instruction unit 112 sends a control setting instruction to the bandwidth control apparatus 201 to assign a broadband to the client apparatus having the IP address. (Step 30).

  If it is determined in step 22 that the authority is not high, the control content instruction unit 112 acquires the IP address from the control information storage unit 111 (step 40), and the IP address is determined by referring to FIG. It is determined whether or not it corresponds to a predetermined specific area (step 41). If it does not correspond to a specific area, it is determined not to change the control setting contents (step 42). When corresponding to a specific area, the control content instructing unit 112 refers to the setting content of the bandwidth control device 201 to determine whether or not a broadband is assigned to the client device corresponding to the IP address (step 43). . When the broadband is assigned, the control content instruction unit 112 transmits an instruction for control setting for transmitting detailed map information data to the client device of the user ID to the proxy device 202 (step 44). .

  If it is determined in step 43 that no broadband is assigned, the control content instruction unit 112 sends a control setting instruction for allocating the broadband to the client device having the IP address to the bandwidth controller 201. At the same time (step 45), a control setting instruction for transmitting detailed map information data to the client device of the user ID is transmitted to the proxy device 202 (step 44). As a result, detailed map information data can be transmitted over a wide band even if the authority is low and a client device to which a narrow band is allocated is present in a specific area.

  Thereafter, when the above-described control setting instruction is transmitted to the bandwidth control device 201, the proxy device 202, or both, a setting change based on the instruction is performed in each device.

  On the other hand, the proxy device 202 sends the request received from the bandwidth control device 201 to the server device 11, and the server device 11 that has received the request outputs the map information data for the received request to the client device 13, The map information data reaches the proxy device 202. The proxy device 202 that has received the map information data performs control based on the current control settings, and then outputs the map information data, which is received by the bandwidth control device 201.

  The bandwidth control device 201 that has received the map information data performs bandwidth control based on the current control settings, and then outputs the map information data, which reaches the client device 103.

  In this embodiment, the proxy device 202 may perform control to change the parameter of the request received from the bandwidth control device 201 instead of performing control to convert the map information data received from the server device 11. In this case, the server device 11 has a function of determining and outputting detailed map information data or simple map information data according to the requested parameters. After the control content determined by the flow processing shown in FIG. 6 is reflected, the proxy device 202 sets a parameter for requesting detailed map information data in the request as necessary according to the control content. Set and output the request.

  Also, in the above embodiment, the network congestion status (bandwidth availability) is acquired as network layer information, and if there is a bandwidth, a wideband is allocated according to the above flow, but there is no bandwidth It is also possible to perform control such as reducing the extent of expanding the band, or deleting part of the information in the detailed map information data so that the map information data reaches the client device with certainty. In addition, when there is not enough bandwidth, it is possible to perform control such as denying access to a user who has low authority and does not exist in a specific area.

  Since the setting contents determined by the flow of FIG. 6 are exceptional, after performing this setting, an instruction for appropriately returning to the original setting is given to the bandwidth control device 201 and the proxy device 202. It is good.

  As described above, according to the system in the present embodiment, the network layer control content is determined based on the application layer information such as the user authority, and further, the application layer control content is determined based on the network layer information such as the IP address, and the communication control is performed. It is possible to perform appropriate communication control suitable for the situation.

  The present invention is not limited to the above-described embodiment, and various modifications and applications can be made within the scope of the claims. In particular, the specific control is not limited to that described in the embodiment, and it goes without saying that various controls are possible.

It is a figure for demonstrating the problem of a prior art. 1 is a configuration diagram of a network system in an embodiment of the present invention. 4 is a diagram for explaining the operation of the communication control system 10. FIG. It is a block diagram of an Example. It is a figure which shows an example of the information which the control information storage part 111 hold | maintains in an Example. It is a flowchart which shows the process of the control content instruction | indication part 112 in an Example.

Explanation of symbols

1-4, 13-15 Client device 5, 11 Server device 6, 12 Network 7 Band control device 10 Communication control system 101 Network layer control unit 102 Application layer control unit 103 Control management unit 110 Control information collection unit 111 Control information storage unit 112 Control content instruction unit 201 Band control device 202 Proxy device

Claims (7)

A communication control system for controlling communication between a client device and a server device,
Network layer control means for performing network layer control for communication between the client device and the server device;
Application layer control means for performing application layer control for communication between the client device and the server device;
Network layer information acquired by the network layer control unit from information transmitted between the client device and the server device, and acquired by the application layer control unit from information transmitted between the client device and the server device. Collecting the application layer information and storing the information in the storage means;
Based on the network layer information and the application layer information stored in the storage means, contents of network layer control executed by the network layer control means and contents of application layer control executed by the application layer control means Control content instruction means for instructing the network layer control means or the application layer control means or both of these control means to perform control according to the determined control content;
A communication control system comprising:   The communication control system according to claim 1, wherein the communication control system acquires the network layer information and the application layer information from request information for the server device sent from the client device.   The control content instruction means instructs the network layer control means to change the control content when the application layer information satisfies a predetermined condition, and when the network layer information satisfies the predetermined condition, 3. The communication control system according to claim 1 or 2, wherein the application layer control means is instructed to change control contents.   The network layer control means is a bandwidth control means having a function of controlling a communication bandwidth between the client device and the server device based on the network layer information, and the application layer control means includes the application layer information in the application layer information. 4. The communication control according to claim 1, wherein the communication control unit is a proxy unit for the server device having a function of converting data transmitted between the client device and the server device. system.   When the application layer information is information indicating a high-privileged user, the control content instructing unit provides the bandwidth control unit with a wide bandwidth for communication between the client device corresponding to the application layer information and the server device. 5. The communication control system according to claim 4, wherein an instruction is given to assign.   When the network layer information is information indicating a specific geographical area, the control content instruction unit performs control for transmitting information of a predetermined type to a client device corresponding to the network layer information. The communication control system according to claim 4 or 5, wherein an instruction is given to the proxy device. A communication control method executed by a communication control system that controls communication between a client device and a server device,
Network layer information is obtained from information transmitted between the client device and the server device, application layer information is obtained from information transmitted between the client device and the server device, and these are stored in the storage means. An information gathering step;
Based on the network layer information and the application layer information stored in the storage means, determine the contents of network layer control executed by the network layer control means and the contents of application layer control executed by the application layer control means, A control content instruction step for instructing the network layer control means or the application layer control means or both of these control means to perform control according to the determined control content;
A communication control step in which the network layer control means and the application layer control means perform communication control according to the control content instructed in the control content instruction step;
A communication control method comprising:

Images