JP2009159154A - Network address and port translator - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To provide a technology for appropriately translating a network address and a port number of a communication device. <P>SOLUTION: A communication control device 10 includes: a first database 50 for associating and storing thereon first IP addresses, second IP addresses and port numbers assigned to communication devices together with a user ID of a user; a user database 57 for associating and storing thereon the user ID and an IP address of a terminal of the user; a user database update section 460 which acquires from a connection management server 120 the user ID of the terminal and the IP address imparted to the terminal and registers then on the user database 57; a user identification section for acquiring the user ID by retrieving from the user database 57 an IP address of a transmission source or of a transmission destination of acquired communication data; a retrieval circuit 30 which performs retrieval while referring to a record of the acquired user ID on the first database 50; and a processing execution circuit 40 for translating the IP address and a port number of the transmission source or of the transmission destination of the communication data. <P>COPYRIGHT: (C)2009,JPO&INPIT

Description

  The present invention relates to a communication control technique, and more particularly to a network address port conversion device that converts a network address and a port number of a communication device.

With the development of the Internet infrastructure and the widespread use of communication terminals such as mobile phone terminals, personal computers, and VoIP (Voice over Internet Protocol) telephone terminals, the number of Internet users is increasing explosively. Under such circumstances, security problems such as computer viruses, hacking, and spam mails are becoming obvious, and a technique for appropriately controlling communication is required.
International Publication WO2006-087832 Pamphlet

  Due to the depletion of IP addresses, global IP addresses and private IP addresses can be used properly. When a device to which a private IP address is assigned communicates via the Internet, the private IP address is changed to the global IP address. Need to convert. Also, since both IP addresses coexist during the transition period from IPv4 to IPv6, it is necessary to convert the IP addresses between them. A technique for performing such network address conversion at high speed is required.

  The present invention has been made in view of such circumstances, and an object thereof is to provide a technique for appropriately converting a network address and a port number of a communication apparatus.

  One embodiment of the present invention relates to a network address port translation apparatus. The network address port conversion device assigns a user ID of a user, a first IP address assigned to the communication device for communication in the first network, and the communication device for communication in the second network. A database for storing the second IP address and the port number associated with each other, a user database for storing the user ID and the IP address assigned to the user terminal, and a terminal connected to the Internet A user database update unit that obtains a user ID of the terminal and an IP address assigned to the terminal from a server that dynamically assigns an IP address to the terminal and associates them with each other and registers them in the user database; IP address of the transmission source or destination of the communication data A user identification unit that retrieves a dress from the user database and obtains a user ID corresponding to the corresponding IP address, and refers to a record corresponding to the user ID acquired by the user identification unit in the database, A search unit that searches the database for a source or destination IP address of the acquired communication data, and an IP address of a source of communication data transmitted from the first network to the second network is the communication device. The IP address of the transmission source is converted into a second IP address assigned to the communication device, and the port number assigned to the communication device is stored in the port number. , I of the transmission destination of communication data transmitted from the second network to the first network If the address is the second IP address of the communication device, the communication device is further identified with reference to the port number, and the destination IP address is converted to the first IP address assigned to the communication device And a process execution circuit.

  It should be noted that any combination of the above-described constituent elements and a conversion of the expression of the present invention between a method, an apparatus, a system, a recording medium, a computer program, etc. are also effective as an aspect of the present invention.

  ADVANTAGE OF THE INVENTION According to this invention, the technique which converts the network address and port number of a communication apparatus appropriately can be provided.

(Prerequisite technology)
FIG. 1 shows a configuration of a communication control system according to the base technology. The communication control system 100 includes a communication control device 10 and various peripheral devices provided to support the operation of the communication control device 10. The communication control apparatus 10 of the base technology realizes a packet filtering function provided by an Internet service provider or the like. The communication control device 10 provided in the network path acquires a packet transmitted / received via the network, analyzes the content, and determines whether communication is permitted. When communication is permitted, the communication control apparatus 10 sends the packet to the network. When communication is prohibited, the communication control apparatus 10 discards the packet and returns a warning message or the like to the transmission source if necessary.

  In the communication control system 100 of the base technology, a plurality of communication control devices 10 a, 10 b, 10 c,... Hereinafter, the individual communication control devices 10a, 10b, 10c,... Are also referred to as the communication control device 10 without being distinguished from each other.

  In the communication control system 100 of the base technology, each communication control device 10 divides and holds at least a part of a database necessary for packet processing. Also, at least one extra is provided. For example, when the number of data is 300,000 or more and less than 400,000, the number of communication control devices necessary for operation is four, but in order to operate instead of one of the communication control devices 10 One or more communication control devices 10 are provided, and at least five communication control devices 10 in total are provided for standby for updating the database included in the communication control device 10. Conventionally, it has been necessary to double the entire system for fault tolerance, but according to the technology of the present prerequisite technology, it is only necessary to provide an additional communication control device 10 in divided units. Can be reduced. The operation status of the plurality of communication control apparatuses 10a, 10b, 10c,... Is managed by the operation monitoring server 110. The operation monitoring server 110 of the base technology has a management table for managing the operation status of the communication control device.

  The peripheral devices include an operation monitoring server 110, a connection management server 120, a message output server 130, a log management server 140, and a database server 150. The connection management server 120 manages the connection to the communication control device 10. For example, when the communication control apparatus 10 processes a packet sent from a mobile phone terminal, the connection management server 120 uses the information that uniquely identifies the mobile phone terminal included in the packet to provide a service of the communication control system 100. It authenticates that it is a user who can enjoy. Once authenticated, a packet sent from the IP address temporarily attached to the mobile phone terminal is sent to the communication control device 10 without being authenticated by the connection management server 120 for a certain period of time and processed. . The message output server 130 outputs a message to the transmission destination or transmission source of the packet according to the result of the communication permission / rejection determined by the communication control device 10. The log management server 140 manages the operation history of the communication control apparatus 10. The database server 150 acquires the latest database from the outside and inputs it to the communication control apparatus 10. In order to update the database without stopping the operation of the communication control apparatus 10, the communication control apparatus 10 may have a backup database. The operation monitoring server 110 monitors the operation status of peripheral devices such as the communication control device 10, the connection management server 120, the message output server 130, the log management server 140, and the database server 150. The operation monitoring server 110 has the highest priority in the communication control system 100 and performs monitoring control of the communication control device 10 and all peripheral devices. As will be described later, the communication control device 10 is configured by a dedicated hardware circuit. However, the operation monitoring server 110 uses a boundary scan circuit by using a technique such as Japanese Patent No. 3041340 by the present applicant. By inputting / outputting monitoring data to / from the communication control device 10 or the like, the operation status can be monitored even during operation of the communication control device 10.

  As will be described below, the communication control system 100 of the base technology controls the communication control device 10 configured by a dedicated hardware circuit for speeding up by a server group having various functions connected to the periphery. With this configuration, various functions can be realized with the same configuration by appropriately replacing the software of the server group. According to the base technology, such a highly flexible communication control system can be provided.

  FIG. 2 shows a configuration of a conventional communication control device 1. The conventional communication control device 1 includes a communication control unit 2 on the reception side, a packet processing unit 3, and a communication control unit 4 on the transmission side. The communication control units 2 and 4 include PHY processing units 5a and 5b that perform processing on the physical layer of the packet, and MAC processing units 6a and 6b that perform processing on the MAC layer of the packet, respectively. The packet processing unit 3 includes a protocol processing unit that performs processing according to a protocol, such as an IP processing unit 7 that performs IP (Internet Protocol) protocol processing and a TCP processing unit 8 that performs TCP (Transport Control Protocol) protocol processing. And an AP processing unit 9 that performs application layer processing. The AP processing unit 9 performs processing such as filtering according to the data included in the packet.

  In the conventional communication control apparatus 1, the packet processing unit 3 is realized by software using a CPU that is a general-purpose processor and an OS that runs on the CPU. However, in such a configuration, the performance of the communication control apparatus 1 depends on the performance of the CPU, and there is a limit to the implementation of a communication control apparatus that can process a large-capacity packet at high speed. For example, in the case of a 64-bit CPU, the maximum amount of data that can be processed simultaneously at a time is 64 bits, and there has been no communication control device having higher performance. Further, since it is assumed that there is an OS having a general-purpose function, there is no possibility that a security hole exists, and maintenance work such as OS version upgrade is required.

  FIG. 3 shows a configuration of a communication control apparatus according to the base technology. The communication control apparatus 10 of the base technology is a packet processing circuit configured by dedicated hardware using a wired logic circuit in place of the packet processing unit realized by software including a CPU and an OS in the conventional communication control apparatus. 20. Rather than processing communication data with an OS and software that run on a CPU that is a general-purpose processing circuit, a dedicated hardware circuit for processing communication data is provided, thereby limiting the performance limit caused by the CPU, OS, etc. It is possible to overcome and realize a communication control device with high processing capability.

  For example, when searching for whether or not the data included in the packet includes reference data that is a criterion for filtering in order to perform packet filtering or the like, the communication data and the reference data are compared using the CPU. However, only 64 bits can be compared at a time, and even if it is attempted to improve the processing speed, there is a problem that the performance of the CPU reaches a peak. In the CPU, it is necessary to repeat the process of reading 64 bits from the communication data into the memory, comparing with the reference data, and then reading the next 64 bits into the memory. Time is rate limiting and processing speed is limited.

  On the other hand, in the base technology, in order to compare communication data with reference data, a dedicated hardware circuit configured by a wired logic circuit is provided. This circuit includes a plurality of comparators provided in parallel to enable comparison of data lengths longer than 64 bits, for example, a data length of 1024 bits. In this way, by providing dedicated hardware, a large number of bit matching operations can be executed in parallel at the same time. The communication control apparatus 1 using a conventional CPU can process 1024 bits at a time, which can process only 64 bits at a time, and can dramatically improve the processing speed. If the number of comparators is increased, the processing capability is improved, but the cost and size also increase. Therefore, an optimum hardware circuit may be designed in consideration of desired processing performance, cost, size, and the like.

  Further, the communication control apparatus 10 of the base technology is configured by dedicated hardware using a wired logic circuit, and therefore does not require an OS (Operating System). This eliminates the need for OS installation, bug handling, version upgrade, and the like, and can reduce costs and man-hours for management and maintenance. Unlike CPUs that require general-purpose functions, unnecessary functions are not included, so unnecessary resources are not used, and cost reduction, circuit area reduction, and processing speed improvement can be expected. . Furthermore, unlike conventional communication control devices that use an OS, it does not have an extra function, so it is unlikely that security holes will occur, and is resistant to attacks from malicious third parties via the network. Is excellent.

  The conventional communication control apparatus 1 processes a packet by software premised on the CPU and the OS, receives all data of the packet, performs protocol processing, and passes the data to the application. On the other hand, in the communication control apparatus 10 of the base technology, since processing is performed by a dedicated hardware circuit, it is not necessary to start processing after receiving all the data of the packet, and receive data necessary for processing. Then, the process can be started at an arbitrary time without waiting for the reception of subsequent data. For example, position detection processing in a position detection circuit described later can be started when position specifying data for specifying the position of comparison target data is received. As described above, since various processes can be executed in a floating manner without waiting for reception of all data, the time required to process packet data can be shortened.

  FIG. 4 shows the internal configuration of the packet processing circuit. The packet processing circuit 20 includes first databases 50A, 50B, and 50C that store reference data serving as a reference for determining the contents of processing to be performed on communication data (collectively, “first database 50”). And a search circuit 30 that searches whether the received communication data includes reference data by comparing the communication data with the reference data, and the search result by the search circuit 30 and the communication data. The second database 60 that stores the contents of the processing to be executed in association with each other, the processing execution circuit 40 that processes the communication data based on the search result by the search circuit 30 and the conditions stored in the second database 60. Including.

  When the search circuit 30 divides the reference data stored in the first database 50 into three or more ranges, the position detection circuit 32 detects the position of the comparison target data to be compared with the reference data from the communication data. An index circuit 34 that is an example of a determination circuit that determines which of the ranges the comparison target data belongs to; a binary search circuit 36 that searches for reference data that matches the comparison target data in the determined range; including. Although any search technique can be used as a method for searching the comparison target data from the reference data, the binary search method is used in the base technology. As will be described later, since this base technology uses an improved binary search method, three first databases 50 are provided for this purpose. The same reference data is stored in the first databases 50A, 50B, and 50C.

  FIG. 5 shows the internal configuration of the position detection circuit. The position detection circuit 32 includes a plurality of comparison circuits 33a to 33f for comparing the position specifying data for specifying the position of the comparison target data with the communication data. Here, six comparison circuits 33a to 33f are provided, but the number of comparison circuits may be arbitrary as will be described later. Communication data is input to each of the comparison circuits 33a to 33f with a predetermined data length, for example, shifted by 1 byte. In the plurality of comparison circuits 33a to 33f, the position specifying data to be detected and the communication data are compared in parallel at the same time.

  In the base technology, as an example for explaining the operation of the communication control apparatus 10, the character string “No. ##” included in the communication data is detected, and the number “#” included in the character string is detected. ## ”is compared with the reference data, and a case will be described in which a packet is allowed to pass if it matches the reference data and a packet is discarded if it does not match.

  In the example of FIG. 5, in order to detect the position specifying data “No.” for specifying the position of the number “####” from the communication data, the communication data “01No. 361. Each character is shifted and input to the comparison circuits 33a to 33f. That is, the comparison circuit 33a has "01N", the comparison circuit 33b has "1No", the comparison circuit 33c has "No.", the comparison circuit 33d has "o." . 3 ”and“ 36 ”are input to the comparison circuit 33f. Here, the comparison circuits 33a to 33f simultaneously perform comparison with the position specifying data “No.”. Thereby, the comparison circuit 33c matches, and it is detected that the character string “No.” exists as the third character from the head of the communication data. In this way, it is detected that numerical data as comparison target data exists after the position specifying data “No.” detected by the position detection circuit 32.

  If similar processing is performed by the CPU, first, the character string “01N” is compared with “No.”, and then the character string “1No” is compared with “No.”. Since it is necessary to execute the comparison process one by one, the detection speed cannot be improved. On the other hand, in the communication control apparatus 10 of the base technology, by providing a plurality of comparison circuits 33a to 33f in parallel, it becomes possible to perform parallel and parallel comparison processing that cannot be performed by the CPU, and the processing speed is greatly improved. Can be made. As the number of comparison circuits increases, the number of positions that can be compared simultaneously increases, so the detection speed also improves.However, considering the cost, size, etc., a sufficient number of comparison circuits are required to obtain the desired detection speed. What is necessary is just to provide.

  The position detection circuit 32 may be used not only for detecting position specifying data but also for detecting a character string for general use. Further, not only the character string but also the position specifying data may be detected in bit units.

  FIG. 6 shows another example of the position detection circuit. In the example illustrated in FIG. 6, when the position specifying data is shorter than the data length of each of the comparison circuits 33 a to 33 f provided in the position detecting circuit 32, predetermined data such as “ "00H" or "01H" is padded. For communication data to be compared with the position specifying data, only the same data length as the position specifying data is extracted, and then the same data as the data padded in the position specifying data is padded. At this time, in order not to modify the communication data itself, the communication data may be copied as a work, and the copied data may be processed and input to the comparison circuits 33a to 33f. Thereby, the position detection circuit 32 can be used for general purposes regardless of the data length of the position specifying data.

  FIG. 7 shows still another example of the position detection circuit. In the example shown in FIG. 7, as in the example shown in FIG. 6, predetermined data is padded after the position specifying data, but this data is treated as a wild card. In other words, when data that is a wild card is input, the comparison circuits 33a to 33f determine that the data to be compared matches unconditionally. Thereby, the position detection circuit 32 can be used for general purposes regardless of the data length of the position specifying data.

  FIG. 8 shows an example of internal data of the first database. The first database 50 stores reference data serving as a reference for determining processing contents such as packet filtering, routing, switching, and replacement, sorted in ascending or descending order according to some sort condition. In the example of FIG. 8, 1000 pieces of reference data are stored.

  When the reference data stored in the first database 50 is divided into three or more ranges 52a to 52d, the index circuit 34 determines to which of the ranges the comparison target data belongs. In the example of FIG. 8, 1000 pieces of reference data are divided into four ranges 52 a to 52 d, each having 250 pieces. The index circuit 34 includes a plurality of comparison circuits 35a to 35c that compare the reference data at the boundary of the range with the comparison target data. By comparing the comparison target data with the boundary reference data simultaneously in parallel by the comparison circuits 35a to 35c, it is possible to determine in which range the comparison target data belongs by one comparison process.

  The boundary reference data input to the comparison circuits 35 a to 35 c of the index circuit 34 may be set by a device provided outside the communication control device 10, or the reference data at a predetermined position in the first database 50 is previously stored. You may make it input automatically. In the latter case, even if the first database 50 is updated, the reference data at a predetermined position in the first database 50 is automatically input to the comparison circuits 35a to 35c. Processing can be executed.

  As described above, when a binary search is executed by the CPU, a plurality of comparisons cannot be executed at the same time. However, in the communication control apparatus 10 of the present prerequisite technology, a plurality of comparison circuits 35a to 35c are provided in parallel. Thus, simultaneous parallel processing can be performed, and the search speed can be remarkably improved.

When the range is determined by the index circuit 34, the binary search circuit 36 executes a search by the binary search method. The binary search circuit 36 further divides the range determined by the index circuit 34 into 2 ⁿ pieces, and compares the reference data at the boundary position with the comparison target data to determine which range the data belongs to. . The binary search circuit 36 includes a plurality of comparators for comparing the reference data and the comparison target data in bit units, for example, 1024 in the base technology, and simultaneously executes 1024-bit bit matching. When it is determined which of the ^2n- divided ranges it belongs, the range is further divided into ²ⁿ , the reference data at the boundary position is read, and compared with the comparison target data. Thereafter, this process is repeated to further limit the range, and finally, reference data that matches the comparison target data is searched.

  The operation will be described in more detail using the example described above. “361” is input as comparison target data to the comparison circuits 35a to 35c of the index circuit 34, and reference data “378” at the boundary between the ranges 52a and 52b is input to the comparison circuit 35a as reference data. The reference data “704” at the boundary between the ranges 52b and 52c is input to 35b, and the reference data “937” at the boundary between the ranges 52c and 52d is input to the comparison circuit 35c. The comparison circuits 35a to 35c perform comparison at the same time, and it is determined that the comparison target data “361” belongs to the range 52a. Thereafter, the binary search circuit 36 searches whether or not the comparison target data “361” exists in the reference data.

  FIG. 9 shows another example of internal data of the first database. In the example shown in FIG. 9, the number of reference data is less than the number of data that can be held in the first database 50, here 1000. At this time, the first database 50 stores the reference data in descending order from the last data position. Then, 0 is stored in the remaining data. As a database loading method, data is placed from the back of the loading area without placing data from the beginning, and if there is a space at the beginning of the loading area, all the space is zero-suppressed, so the database is always full. The search time for binary search can be made constant. Further, when “0” is read as the reference data during the search, the binary search circuit 36 can identify the range without performing the comparison and can proceed to the next comparison because the comparison result is self-explanatory. Thereby, the search speed can be improved.

  In the software processing by the CPU, when the reference data is stored in the first database 50, the reference data is stored in ascending order from the first data position. For example, the maximum value is stored in the remaining data. In this case, the comparison process as described above cannot be omitted in the binary search. The comparison technique described above is realized by configuring the search circuit 30 with a dedicated hardware circuit.

  FIG. 10 shows still another example of internal data of the first database. In the example shown in FIG. 10, the reference data is not equally divided into three or more ranges, but the number of reference data belonging to the range is uneven, such as 500 for the range 52a and 100 for the range 52b. It has become. These ranges may be set according to the distribution of the appearance frequency of the reference data in the communication data. That is, the ranges may be set so that the sum of the appearance frequencies of the reference data belonging to each range is substantially the same. Thereby, search efficiency can be improved. The reference data input to the comparison circuits 35a to 35c of the index circuit 34 may be changeable from the outside. Thereby, a range can be set dynamically and search efficiency can be optimized.

  FIG. 11 shows another example of the index circuit. In the example shown in FIGS. 8 to 10, the index circuit 34 uses three comparison circuits 35 a to 35 c to determine which of the four ranges 52 a to 52 d of the first database 50 belongs to the comparison target data. In the example of FIG. 11, the index circuit 34 is provided with four comparison circuits 35d to 35g for determining whether or not the comparison target data is included in each of the four ranges 52a to 52d. For example, the comparison circuit 35d receives the 0th reference data, the 250th reference data, and the comparison target data in the first database 50, and compares each reference data with the comparison target data. Thus, it is determined whether or not the reference data is included in the range 52a. The comparison results of the respective comparison circuits 35d to 35g are input to the determination circuit 35z, and the determination circuit 35z outputs in which range the reference data is included. The comparison circuits 35d to 35g may output whether or not the reference data is included between the two input reference data, and may be any one of larger than the range, included in the range, and smaller than the range. May be output. If it is determined that the comparison target data is not included in any of the ranges 52a to 52d, it can be seen that the comparison target data does not exist in the first database 50. The search can be terminated.

  FIG. 12 shows a configuration of a comparison circuit included in the binary search circuit. As described above, the comparison circuit included in the binary search circuit 36 includes 1024 comparators 36a, 36b,. Each of the comparators 36a, 36b,... Receives the reference data 54 and the comparison target data 56 one bit at a time, and compares them. The internal configurations of the comparison circuits 35a to 35c of the index circuit 34 are the same. In this way, by executing the comparison process with a dedicated hardware circuit, a large number of comparison circuits can be operated in parallel and a large number of bits can be compared simultaneously, so that the comparison process can be speeded up. .

  FIG. 13 shows the configuration of the binary search circuit. The binary search circuit 36 includes comparison circuits 36A, 36B, and 36C including the 1024 comparators 36a, 36b,... Shown in FIG.

  In the conventional binary search method, first, data at a position half the search target range of a database in which data is arranged in ascending or descending order is read and compared with comparison target data. When the data is arranged in ascending order, if the comparison target data is smaller, the comparison target data exists in the first half of the search target range, so the second time uses the first half as the search target range, that is, the first Data at a position ¼ of the search target range is read and compared with the comparison target data. On the other hand, if the comparison target data is larger, the comparison target data exists in the latter half of the search target range. Therefore, in the second time, the second half is set as the search target range, that is, 3/4 of the first search target range. The data at the position is read out and compared with the comparison target data. In this way, the search target range is narrowed by half and finally reaches the target data.

  In the base technology, since three comparison circuits for binary search are provided, when comparing the data in the half of the search target range with the comparison target data for the first search, At the same time, the comparison target data is compared with the data at the positions 1/4 and 3/4 of the search target range for the second search. Thereby, since the search for 2 times can be performed at once, the time which reads data from a database can be shortened. Also, by operating the three comparison circuits in parallel at the same time, the number of comparisons can be reduced to half and the time required for the search can be shortened.

In the example of FIG. 13, three comparison circuits are provided in order to perform two searches simultaneously. In general, in order to perform n searches in parallel at the same time, 2 ⁿ −1 comparison circuits are provided. What is necessary is just to provide. The control circuit 36Z inputs data at positions of 1/2 ⁿ , 2/2 ⁿ ,..., (2 ⁿ −1) / 2 ^{n in} the search target range to each of the 2 ⁿ −1 comparison circuits. They are operated in parallel at the same time and compared with the data to be compared. The control circuit 36Z acquires the comparison results of the respective comparison circuits and determines whether comparison target data has been searched. When any of the comparison circuits outputs a signal indicating that the data match, the control circuit 36Z determines that the comparison target data has been searched and ends the binary search. If no match signal is output, the next search is performed. If the data to be compared exists in the database, it should exist in a range where the comparison results of 2 ⁿ −1 comparison circuits are inverted. For example, when 15 comparison circuits are provided, if the data at the position of 5/16 is smaller than the data to be compared and the data at the position of 6/16 is larger than the data to be compared, 5/16 to 6 / The comparison target data is in the range between 16. Therefore, the control circuit 36Z acquires the comparison results of the respective comparison circuits, determines the range in which the comparison results are inverted as the next search target range, ½ ^{n of} the determined next search target range, 2 ⁿ ,..., (2 ⁿ −1) / 2 ⁿ position data is input to each comparison circuit.

  In the base technology, three first databases 50 are provided, and the first database 50A is connected to the comparison circuit 36A and supplies data at a position ¼ of the search target range to the comparison circuit 36A. The database 50B is connected to the comparison circuit 36B and supplies data at a position 2/4 of the search target range to the comparison circuit 36B, and the first database 50C is connected to the comparison circuit 36C and is 3/4 of the search target range. The data at the position is supplied to the comparison circuit 36C. As a result, data can be simultaneously read out in parallel to the respective comparison circuits, so that the time required for reading data can be further shortened and the binary search can be speeded up.

  As the number of comparison circuits increases, the search speed improves. However, in consideration of cost, size, etc., a sufficient number of comparison circuits may be provided to obtain a desired search speed. In addition, it is preferable to provide as many first databases as the number of comparison circuits. However, in consideration of cost, size, etc., databases may be shared by several comparison circuits.

  FIG. 14 shows still another example of internal data of the first database. The first database 50 shown in FIG. 14 stores URLs of contents to be filtered. The data stored in the first database 50 may include predetermined data recognized as a wild card, for example, “00H” or “01H”. In the example shown in FIG. 14, “http: //www.xx.xx/*********” is recognized as a wild card because “*********” In the devices 36a, 36b,..., It is determined that they match regardless of the comparison target data. Therefore, all the character strings starting with “http: //www.xx.xx/” are detected by the binary search circuit 36. Thereby, for example, it is possible to easily perform processing for filtering all the contents under the domain “http: //www.xx.xx/”.

  FIG. 15 shows an example of internal data of the second database. The second database 60 includes a search result column 62 for storing a search result by the search circuit 30 and a processing content column 64 for storing the content of processing to be executed on communication data, and corresponds the search result to the processing content. Hold it. In the example of FIG. 15, a condition is set such that when the reference data is included in the communication data, the packet is allowed to pass, and when the reference data is not included, the packet is discarded. The process execution circuit 40 searches the second database 60 for process contents based on the search result, and executes the process on the communication data. The processing execution circuit 40 may also be realized by a wired logic circuit.

  FIG. 16 shows another example of internal data of the second database. In the example of FIG. 16, the processing content is set for each reference data. When packet replacement is performed, replacement destination data may be stored in the second database 60. When packet routing or switching is performed, information on the route may be stored in the second database 60. The process execution circuit 40 executes processes such as filtering, routing, switching, and replacement stored in the second database 60 according to the search result by the search circuit 30. As shown in FIG. 16, when setting the processing content for each reference data, the first database 50 and the second database 60 may be integrated.

  The first database and the second database are rewritable from the outside. By exchanging these databases, various data processing and communication control can be realized using the same communication control device 10. In addition, two or more databases storing reference data to be searched may be provided to perform multi-stage search processing. At this time, two or more databases that store search results and processing contents in association with each other may be provided to realize more complicated conditional branching. As described above, in the case where a plurality of databases are provided to perform a multi-stage search, a plurality of position detection circuits 32, index circuits 34, binary search circuits 36, etc. may be provided.

  The data used for the comparison described above may be compressed by the same compression logic. In comparison, if the comparison source data and the comparison destination data are compressed by the same method, the same comparison as usual is possible. As a result, the amount of data loaded at the time of comparison can be reduced. If the amount of data to be loaded is reduced, the time required to read data from the memory is reduced, so that the overall processing time can also be reduced. Further, since the amount of the comparator can be reduced, it is possible to contribute to downsizing, weight reduction, and cost reduction of the apparatus. The data used for the comparison may be stored in a compressed form, or may be compressed after being read from the memory and before the comparison.

  FIG. 17 shows another configuration example of the communication control apparatus of the base technology. The communication control apparatus 10 shown in this figure has two communication control units 12 having the same configuration as the communication control apparatus 10 shown in FIG. Moreover, the switching control part 14 which controls operation | movement of each communication control unit 12 is provided. Each communication control unit 12 has two input / output interfaces 16 and is connected to two networks on the upstream side and the downstream side via the input / output interfaces 16. The communication control unit 12 inputs communication data from one of the networks and outputs the processed data to the other network. The switching control unit 14 switches the direction of communication data flow in the communication control unit 12 by switching input / output of the input / output interface 16 provided in each communication control unit 12. Thereby, not only one direction but two-way communication control becomes possible.

  The switching control unit 14 may perform control so that one of the communication control units 12 processes an inbound packet and the other processes an outbound packet, or may control both to process an inbound packet. May handle outbound packets. Thereby, for example, the direction of communication to be controlled can be made variable in accordance with the traffic status and purpose.

  The switching control unit 14 may acquire the operation status of each communication control unit 12 and switch the communication control direction according to the operation status. For example, when one communication control unit 12 is in a standby state and the other communication control unit 12 is operated, when it is detected that the communication control unit 12 has stopped due to a failure or the like, The communication control unit 12 may be operated. Thereby, the fault tolerance of the communication control apparatus 10 can be improved. Further, when maintenance such as database update is performed on one communication control unit 12, the other communication control unit 12 may be operated as an alternative. Thereby, it is possible to appropriately perform maintenance without stopping the operation of the communication control apparatus 10.

  Three or more communication control units 12 may be provided in the communication control device 10. For example, the switching control unit 14 acquires the traffic status, and controls the communication direction of each communication control unit 12 so that more communication control units 12 are allocated to the communication control process in the direction with a large amount of communication. May be. Thereby, even if the communication amount in a certain direction increases, it is possible to minimize a decrease in communication speed.

  FIG. 18 shows a configuration of the communication control apparatus 10 including a plurality of communication control apparatuses 10a, 10b, 10c,. Since the first database 50 requires a large capacity in proportion to the number of data, it is divided and held in the communication control devices 10a, 10b, 10c,. As will be described later, in the communication control system 100 of the base technology, a communication packet to be processed is supplied to all the communication control devices 10a, 10b, 10c,. Process the received packet. For example, the communication control device 10a has a data ID “000001” to “100000”, the communication control device 10b has a data ID “100001” to “200000”, and the communication control device 10c has a data ID “200001”. To “300000”, and the packet is processed with reference to the data held by each.

  FIG. 19 shows an example of internal data of the management table 111 provided in the operation monitoring server 110. The management table 111 is provided with a device ID column 112, an operation status column 113, and a data ID column 114. The device ID column 112 stores the device IDs of the communication control devices 10a, 10b,..., The operation status column 113 stores the operation status of the communication control device, and the data ID column 114 stores A range of data IDs to be handled by the communication control device is stored. The operational status includes, for example, “in operation”, “standby”, “failure”, “data updating”, and the like. The operation status column 113 is updated by the operation monitoring server 110 every time the operation status of the communication control devices 10a, 10b,. In the example shown in FIG. 19, since “465183” data is stored in the first database 50, five communication control devices 10 with device IDs “1” to “5” are operated, and device IDs are used. The communication control device 10 of “6” is in a standby state.

  The operation monitoring server 110 monitors the operation status of the plurality of communication control devices 10 and enters a standby state when it is detected that a trouble has occurred in any of the communication control devices 10 and the operation becomes impossible. The same data as that of the communication control device 10 whose operation has been stopped is stored in the communication control device 10 being operated, and the operation is switched to the communication control device 10. For example, as illustrated in FIG. 20, when the communication control device 10 with the device ID “2” is stopped due to a failure, the data ID “100001 to 200000” is assigned to the communication control device 10 with the device ID “6” in the standby state. Is stored and the operation is started. Accordingly, even if the communication control apparatus 10 is stopped due to some trouble, the operation can be continued appropriately. The communication control apparatus 10 in standby may store any data in advance and may be in a hot standby state or in a cold standby state.

  Next, a procedure for updating a database included in the communication control apparatus 10 will be described. The database server 150 acquires and holds the latest database from an external database at a predetermined timing. The operation monitoring server 110 transfers and stores data from the database server 150 to the communication control device 10 in order to reflect the latest database held in the database server 150 to the communication control device 10 at a predetermined timing.

  FIGS. 21A, 21B, and 21C are diagrams for explaining how the database is updated. FIG. 21A shows a situation where the communication control devices 10 with device IDs “1” to “5” are in operation and the communication control device 10 with device ID “6” is in a standby state, as in FIG. Show. When it is time to update the database, the operation monitoring server 110 identifies the communication control device 10 that is currently in the standby state, and instructs the database server 150 to store data in the communication control device 10. In the example of FIG. 21A, since the communication control device 10 with the device ID “6” is on standby, data is stored in the communication control device 10 from the database server 150. At this time, the operation monitoring server 110 changes the operation status column 113 of the device ID “6” to “data updating”.

  FIG. 21B shows a situation where the database of the communication control apparatus 10 is being updated. The database server 150 stores the data handled by any of the operating communication control devices 10 in the first database 50 of the communication control device 10 with the device ID “6” being in standby. In the example of FIG. 21B, the data of the data ID “000001 to 100,000”, which was handled by the communication control device 10 of the device ID “1”, is stored in the communication control device 10 of the device ID “6”. Yes.

  FIG. 21C illustrates a situation in which the database of the communication control device 10 with the device ID “6” is updated and the operation is started, and the communication control device 10 with the device ID “1” is in a standby state instead. When the operation monitoring server 110 finishes storing data in the communication control device 10 with the device ID “6”, the operation monitoring server 110 starts operation of the communication control device 10 with the device ID “6” that holds the updated database, and at the same time before the update. The operation of the communication control device 10 with the device ID “1” holding the database is stopped and put into a standby state. As a result, the operation is switched to the communication control apparatus 10 whose database has been updated. Subsequently, after storing the data ID “100001 to 200000” in the communication control device 10 with the device ID “1”, the communication control device 10 with the device ID “1” is started to operate, and the device ID “2” is started. The operation of the communication control apparatus 10 is stopped. Thereafter, similarly, by updating the database cyclically, it is possible to update the databases of all the communication control devices 10 behind without stopping the operation of the communication control system 100.

  As described above, in the communication control device 10 of the base technology, the data stored in each communication control device 10 is not fixed, and which communication control device 10 stores certain data changes depending on time. . If processing for determining in which communication control device 10 the user's data exists before sending the packet to each communication control device 10, it takes extra time for the processing. Therefore, in the present embodiment, the received packet is supplied to all the communication control devices 10, and each communication control device 10 processes the packet. Hereinafter, a technique for realizing such a mechanism will be described.

  FIG. 22 shows a configuration of a communication path control device provided for processing a packet by a plurality of communication control devices 10. The communication path control device 190 includes a switch 191, an optical splitter 192 that is an example of a data supply unit, and a switch 193. The switch 191 transmits the received packet to the communication control device 10. Here, between the switch 191 and the communication control device 10, an optical splitter 192 for supplying packets to the plurality of communication control devices 10a, 10b, and 10c in parallel is provided. Transmits the packet to the optical splitter 192, and the optical splitter 192 transmits the packet to each communication control device in parallel.

  If a packet is converted into a broadcast in order to transmit the packet to a plurality of communication control apparatuses 10a, 10b, and 10c, extra processing such as adding a time stamp to the header occurs, and the processing speed decreases. Therefore, without changing the packet, the packet is divided by the optical splitter 192, and the packet is transmitted to the plurality of communication control apparatuses 10a, 10b, and 10c while being unicast. This method is called “parallel cast” in this specification.

  Each communication control device is set to a promiscuous mode that receives all packets regardless of the destination MAC address, not a mode that receives only packets addressed to its own MAC address. When each communication control apparatus receives a parallel-cast packet from the optical splitter 192, it omits the MAC address matching process and acquires and processes all packets.

  The communication control device 10c transmits a response packet to the switch 191 without passing through the optical splitter 192 when returning a packet addressed to the transmission source such as when communication is prohibited. If the communication is permitted as a result of processing the packet, the communication control device 10c sends the packet to the network. Here, a switch 193 for aggregating packets transmitted from the plurality of communication control devices 10a, 10b, and 10c is provided between the communication control device 10 and the upstream communication line. Actually, the packet is transmitted to the switch 193, and the switch 193 transmits the packet to the upstream communication line.

  When the switch 193 receives a packet returned from the packet transmission destination, if the returned packet does not require processing by the communication control device 10, it is transmitted from the port 195 of the switch 193 to the port 194 of the switch 191. , And sent from the switch 191 to the transmission source. Normally, on the Internet, a route at the time of transmission is recorded in the packet in order to ensure a return route so that a response packet to the packet is surely returned to the transmission source. However, in this embodiment, since a return route in the communication route control device 190 is prepared in advance, communication between devices is performed without recording the route, that is, without processing a packet. Thereby, useless processing can be omitted and the processing speed can be improved.

  The example of FIG. 22 shows a configuration in which a packet is processed only when a packet transmitted from the transmission source is transmitted to the transmission destination, and a response packet transmitted from the transmission destination to the transmission source is passed without being processed. However, the communication control apparatus 10 may be configured to process packets in both directions. In this case, the optical splitter 192 may be provided on both sides of the communication control device 10. Further, a bypass path from the switch 193 to the switch 191 may not be provided.

  In this way, even if the communication control device that should process the packet is not specified in advance among the plurality of communication control devices, the same packet is parallel-cast to all the communication control devices, so that Packets can be processed appropriately.

  Since these communication control devices receive and process or discard all packets cast in parallel from the communication path control device 190 as described above, they are given an IP address for uniquely identifying the device on the Internet. There is no need to keep it. When executing packet processing as described above by a server device or the like, it is necessary to consider an attack on the server device. However, the communication control device according to the present embodiment is directly transmitted from a malicious third party via the Internet. Since there is no attack, communication control can be performed safely.

  Next, a URL filtering technique will be described as an example of communication control using the communication control device 10 described above. In the following, we propose a technology that accurately prevents access to malicious sites such as phishing sites and virus sites. In addition, a technique for constructing a communication system that allows a user to enjoy a network service with confidence using such an access control technique is proposed.

  FIG. 23 shows an internal configuration of the packet processing circuit 20 for URL filtering. The packet processing circuit 20 includes a virus / phishing site list 161, a white list 162, a black list 163, and a common category list 164 as the first database 50. When the communication control apparatus 10 obtains an access request for content, the URL of the content is displayed in the virus / phishing site list 161, the white list 162, the black list 163, and the common category list 164 in order to determine whether access to the content is permitted. Matched.

  The virus / phishing site list 161 stores a list of URLs of contents including computer viruses and a list of URLs of “罠” sites used for phishing scams. An access request for the content of the URL stored in the virus / phishing site list 161 is rejected. As a result, even if the user is not aware or deceived and tries to access a virus site or phishing site, the user can be appropriately prohibited from access and protected from the damage caused by the virus or phishing scam. it can. In addition, since the list of virus sites and phishing sites is stored in the user's terminal and access is not restricted on the terminal side, access restriction is performed centrally by the communication control device 10 provided in the communication path, so that more reliable In addition, it is possible to restrict access efficiently. The communication control apparatus 10 acquires and holds a list of authenticated sites that have been certified by a certification authority as being a legitimate site that is not a virus site or a phishing site, and permits access to URLs stored in the list. You may do it. In addition, when a legitimate site is hijacked by hacking, etc. and a virus is incorporated or used for phishing, a legitimate site operator is hijacked in the virus / phishing site list 161. The URL of the site may be registered, and access may be temporarily prohibited until the site is restored to a normal state. Further, information such as an IP number, a TCP number, and a MAC address may be combined and checked together with the URL list. As a result, a more accurate prohibition condition can be set, and thus virus sites and phishing sites can be filtered more reliably.

  The white list 162 stores a list of URLs of contents that are permitted to be accessed. The black list 163 stores a list of URLs of contents whose access is prohibited. 24A shows an example of internal data of the virus / phishing site list 161, FIG. 24B shows an example of internal data of the white list 162, and FIG. 24C shows an example of the black list 163. An example of internal data is shown. The virus / phishing site list 161, the white list 162, and the black list 163 have a category number column 165, a URL column 166, and a title column 167, respectively. The URL column 166 stores URLs of contents that are permitted or prohibited to be accessed. The category number column 165 stores content category numbers. The title column 167 stores the title of the content.

  The common category list 164 stores a list for classifying the content indicated by the URL into a plurality of categories. FIG. 25 shows an example of internal data of the common category list 164. The common category list 164 is also provided with a category number column 165, a URL column 166, and a title column 167.

  The communication control apparatus 10 extracts the URL included in the “GET” request message or the like, and whether the URL is included in the virus / phishing site list 161, the white list 162, the black list 163, or the common category list 164. The search circuit 30 searches for whether or not. At this time, for example, a character string “http: //” may be detected by the position detection circuit 32, and a data string following the character string may be extracted as target data. The extracted URL is matched with the reference data of the virus / phishing site list 161, the white list 162, the black list 163, and the common category list 164 by the index circuit 34 and the binary search circuit 36.

  FIGS. 26A, 26B, 26C, and 26D show examples of internal data of the second database 60 for URL filtering. FIG. 26A shows search results and processing contents for the virus / phishing site list 161. When the URL included in the GET request or the like matches the URL included in the virus / phishing site list 161, access to the URL is prohibited. FIG. 26B shows search results and processing contents for the white list 162. When the URL included in the GET request or the like matches the URL included in the white list 162, access to the URL is permitted. FIG. 26C shows search results and processing contents for the black list 163. When the URL included in the GET request or the like matches the URL included in the black list 163, access to the URL is prohibited.

  FIG. 26D shows search results and processing contents for the common category list 164. As shown in FIG. 26D, whether to permit or prohibit access to contents belonging to the category is individually set for the search result for the common category list 164. In the second database 60 related to the common category list 164, a category column 169 is provided. The category column 169 stores information indicating whether or not access to content belonging to the category is permitted for each of the 57 categories. When the URL included in the GET request matches the URL included in the common category list 164, whether or not access to the URL is permitted is determined based on the category of the URL. In FIG. 26D, the number of common categories is 57, but other common categories may be used.

  FIG. 27 shows priorities of the virus / phishing site list 161, the white list 162, the black list 163, and the common category list 164. In the base technology, the virus / phishing site list 161, the white list 162, the black list 163, and the common category list 164 have a higher priority in the order, for example, the URL of the content that is permitted to be accessed stored in the white list 162. Even if the URL is stored in the virus / phishing site list 161, access is prohibited as content including a computer virus or content used for phishing.

  Conventionally, when performing matching in consideration of such priorities using software, for example, the first hit that is performed by matching in order from the list with the highest priority, or from the list with the lower priority Either matching was done in order, and the one that was hit later was overwritten, or either method was taken. However, in the base technology, a search circuit 30a for matching the virus / phishing site list 161 and a search circuit 30b for matching the white list 162 are obtained by using the communication control device 10 configured by a dedicated hardware circuit. In addition, a search circuit 30c for matching the black list 163 and a search circuit 30d for matching the common category list 164 are provided, and each search circuit 30 performs matching in parallel at the same time. If there is a hit in a plurality of lists, the one with higher priority is adopted. Thereby, even if a plurality of databases are provided and priorities are set for them, the search time can be greatly reduced.

  Whether the virus / phishing site list 161, the white list 162, the black list 163, or the common category list 164 is to be prioritized for access permission may be set in the second database 60, for example. The conditions of the second database 60 may be rewritten according to which list has priority.

  In this way, when performing filtering based on URL using a plurality of databases, it is configured so that the priority can be set in the database and filtering processing according to the priority can be performed, and the virus / By giving the highest priority to filtering by the phishing site list 161, access to the virus site and phishing site can be surely prohibited regardless of the setting status of the white list 162 and the like by the user. Thereby, a user can be appropriately protected from the damage of a virus or a phishing scam.

  When access to the content is permitted, the process execution circuit 40 outputs a signal for notifying the message output server 130 of the fact. The message output server 130 sends a “GET” request message to the server holding the content. When access to the content is prohibited, when the process execution circuit 40 outputs a signal for notifying the message output server 130, the message output server 130 sends a “GET” request message to the access destination server. Discard without sending. At this time, a response message indicating that access is prohibited may be transmitted to the request source. Further, it may be forcibly transferred to another web page. In this case, the process execution circuit 40 rewrites and sends the destination address and URL to those of the transfer destination. Information such as the response message and the transfer destination URL may be stored in the second database 60, the message output server 130, or the like.

  The message output server 130 uses the ping command or the like to confirm that the request source actually exists, and if it exists, confirms the state and outputs a message to the request source. Good. The message transmitted from the message output server 130 to the request source may be settable for each content to be accessed, for each category, or for each database such as the white list 162 and the black list 163. For example, the screen displayed when access is prohibited may be customized for each category and registered in the message output server 130. In addition, as described above, when a legitimate site is hacked and access is temporarily restricted, a message notifying the user that the legitimate site is temporarily inaccessible, You may make it output the message guided to the mirror site of a site.

  The message output server 130 may manage the message transmission history and use the message transmission history information for various controls. For example, if a large number of access requests are sent in a short time from the same request source, there is a possibility of a denial of service attack (DoS attack). It may be registered and blocked without sending a packet from the request source to the request destination. Further, the message transmission history may be statistically processed and provided to a website administrator or the like. Thereby, a user's access history can be utilized for marketing, or it can be utilized for control of a communication situation. In addition, the number of message transmissions can be reduced or increased depending on the situation. For example, when an access request is transmitted from a specific IP number, it is possible to send many times as many messages as the one request message.

  With the above configuration and operation, access to inappropriate content can be prohibited. Further, since the search circuit 30 is a dedicated hardware circuit composed of an FPGA or the like, high-speed search processing is realized as described above, and filtering processing is executed while minimizing the influence on traffic. Can do. By providing such a filtering service, an Internet service provider or the like can increase added value and attract more users.

  FIG. 28 shows an arrangement example of the communication control system. This figure shows an example in which a mobile phone terminal 260 is used as an example of a user terminal. The access request issued from the mobile phone terminal 260 is sent to the Internet 200 via the base station device 262 installed by the carrier and the control station device 264 provided in the station building, and reaches the web server 250 via the Internet 200. . In the example of this figure, the base station apparatus 262 is provided with the communication control system 100. In this case, the first database 50 may be changed for each base station apparatus 262, and different filtering may be performed for each area covered by the base station apparatus 262. When the communication control system 100 is provided in the base station apparatus 262, the communication control system 100 may be downsized by mounting only the minimum necessary functions. For example, the configuration of the connection management server 120 and the log management server 140 may be omitted. Since the filtering process is distributed by providing the communication control system 100 in the base station apparatus 262, it is only necessary to provide a small-scale communication control system 100. The apparatus can be reduced in size and weight, and the cost can be reduced. Can do. Further, since the access request issued from the mobile phone terminal 260 can be filtered before being sent to the control station apparatus 264, the amount of communication can be reduced. Further, since the packet is filtered in the base station apparatus 262 that communicates directly with the mobile phone terminal 260, the filtering can be executed more reliably.

  FIG. 29 shows another arrangement example of the communication control system. This figure also shows an example in which the mobile phone terminal 260 is used, but unlike the example shown in FIG. 28, the communication control system 100 is provided in the control station device 264. Since the control station device 264 provided in the station building performs centralized filtering, system maintenance is easy.

  FIG. 30 shows still another arrangement example of the communication control system. Also in this figure, a mobile phone terminal 260 is used as an example of a user terminal. An access request issued from the mobile phone terminal 260 is transmitted to the Internet 200 via the wireless LAN access point 272 and the router device 274, and reaches the web server 250 via the Internet 200. In the example of this figure, the communication control system 100 is provided at the access point 272. As in the example shown in FIG. 28, useless communication can be reduced by filtering packets with an apparatus close to the mobile phone terminal 260. For example, in the case of a wireless LAN in a company, it is possible to prevent employees from accessing inappropriate websites during working hours.

  FIG. 31 shows still another arrangement example of the communication control system. This figure also shows an example of a wireless LAN, but unlike FIG. 30, the communication control system 100 is provided in the router device 274. By providing the communication control system 100 in the router device 274, the number of communication control systems 100 can be reduced, and maintenance is facilitated.

  32 and 33 show still another arrangement example of the communication control system. This figure shows an example in which a personal computer (PC) 290 is used as an example of a user terminal. An access request issued from the PC 290 is sent to the Internet 200 via the LAN router devices 282 and 284 and reaches the web server 250 via the Internet 200. FIG. 32 shows an example in which the communication control system 100 is provided in the router device 282, and FIG. 33 shows an example in which the communication control system 100 is provided in the router device 284.

  In the above example, an example in which the communication control system 100 is incorporated in a device configuring a network is shown, but the communication control system 100 may be provided at an arbitrary position on the network separately from these devices.

  In these arrangement examples, the communication data received by the receiving unit such as the antenna of the base station device 262 or the access point 272, the network device interface of the control station device 264, the router device 274, 282, or 284 is the necessity of access control. May be processed by the packet processing circuit 20 without determining. That is, the communication control system 100 may capture and filter all passing packets regardless of whether access control of received communication data is necessary. Further, the communication control system 100 may discard the packet that is determined to be prohibited from access, or may retransmit the packet to the network simply by recording a log.

(Embodiment 1)
Next, a new communication control technique using the above-described communication control device 10 will be described.

  FIG. 34 shows the configuration of the communication control apparatus according to the embodiment. In the communication control apparatus 10 of the present embodiment, the MAC processing units 6a and 6b are omitted from the configuration of the communication control apparatus 10 of the base technology shown in FIG. Other configurations and operations are the same as those of the base technology.

  The communication control device 10 converts the electrical signal received from the network medium such as a cable into a data string by the PHY processing unit 5a that implements the protocol of the physical layer that is the first layer of the OSI reference model, , The data link layer of the second layer, the network layer of the third layer, the transport layer of the fourth layer, the session layer of the fifth layer, the presentation layer of the sixth layer, and the application layer of the seventh layer are omitted. Thus, the data string is directly supplied to the search circuit 30 of the packet processing circuit 20. That is, processing necessary for receiving communication data such as confirmation of the destination MAC address and IP address of the received communication data is omitted, and all the communication data is captured and supplied to the search circuit 30.

  The search circuit 30 accesses arbitrary data in the frame received by the PHY processing unit 5a, and executes search by bit matching. The packet processing circuit 20 performs arbitrary editing processing such as duplication, transfer, addition, deletion, change, compression, encryption, and decryption on the communication data, and outputs the communication data. The communication data output from the packet processing circuit 20 is retransmitted from the PHY processing unit 5b to the network without changing the destination MAC address.

  FIG. 35 is a conceptual diagram for explaining the communication control technique according to the embodiment. The communication control device 10 extracts communication data transmitted and received between the communication device 502 and the communication device 504, and performs various types of communication control. In the communication data transmitted from the communication device 502 to the communication device 504, the MAC address of the communication device 504 is set as the destination MAC address in the data link layer, but the communication control device 10 confirms the destination MAC address. Therefore, communication data addressed to the communication device 504 can also be captured and controlled. Further, since the communication control apparatus 10 retransmits to the network without changing the destination MAC address, the communication data processed by the communication control apparatus 10 is transmitted to the communication apparatus 504 that is the original destination as it is. Accordingly, the communication devices 502 and 504 can perform communication using a normal protocol without being conscious of the existence of the communication control device 10 at all. In FIG. 35, communication data is actually transmitted and received through the path indicated by the solid line, but it appears that the communication devices 502 and 504 are directly communicating with each other as indicated by the dotted line. ing. The same applies to communication data transmitted from the communication device 504 to the communication device 502.

  As described above, the communication control apparatus 10 according to the present embodiment needs to extract and control communication data flowing through the network without checking the MAC address or IP address, and assign the MAC address or IP address to the communication control apparatus 10. There is no. Further, since the communication data is retransmitted to the original destination MAC address without rewriting the destination MAC address, the communication control apparatus 10 can be introduced into the network without complicatedly changing the network settings.

  In the communication control apparatus 10 according to the present embodiment, the number of comparators and the memory capacity of the search circuit 30 are designed so that the communication control process can be completed at a speed equivalent to the communication speed in the network. Therefore, the received data string is not temporarily stored in the reception buffer and processed while being read, but the received data string is not immediately stored in the reception buffer but can be immediately supplied to the search circuit for processing. .

  The conventional communication control device, for example, refers to the protocol number to determine the protocol type and performs processing according to the protocol. However, the communication control device 10 according to the present embodiment performs frame processing without performing protocol processing. Since the communication control is performed by directly accessing the data, general-purpose communication control independent of the protocol can be performed. Therefore, the present invention can be used as a small amount and a variety of communication control devices.

  There is an attack that drives a communication device to stop operation by sending communication data to a specific communication device to the mechanical limit of the communication device. However, the communication control device 10 of the present embodiment has an address. Therefore, the attacker cannot explicitly send communication data to the communication control device 10. Further, even when an attack is made against a communication device other than the communication control device 10, the communication control device 10 can extract and control the communication data being passed, so In addition, communication data intended for attack can be detected and deleted. Further, even when communication data is destroyed due to a router memory failure or a program bug in the middle of a communication path, the communication control device 10 can detect and delete the data, so that the network or communication device Can be reduced.

  When it is necessary to communicate with another communication device for the purpose of collecting information necessary for communication control, the communication may be performed using a virtual IP address. For example, when communicating with a communication device, the communication control device 10 is virtually assigned an IP address of a communication device connected to a network downstream from the communication control device 10 to perform communication.

  FIG. 36 shows another configuration example of the communication control apparatus according to the embodiment. The communication control apparatus 10 illustrated in FIG. 36 further includes a determination unit 510 and a virtual communication apparatus 520 in addition to the configuration of the communication control apparatus 10 illustrated in FIG. Other configurations and operations are the same as those of the communication control apparatus 10 shown in FIG.

  The virtual communication device 520 transmits / receives information necessary for communication control in the communication control device 10 to / from other communication devices. For example, when the communication control device 10 functions as a router device, the virtual communication device 520 exchanges route information with other router devices according to a protocol such as BGP4 (Border Gateway Protocol 4). At this time, the virtual communication device 520 obtains an IP address assigned to another communication device connected to a network downstream from the own device, assuming that the direction of the router device of the other party performing communication by BGP4 is upstream, The IP address is notified to determination section 510 as the virtual IP address of virtual communication device 520. Further, the virtual communication device 520 notifies the determination unit 510 of the protocol number of the protocol for performing communication with other devices using the virtual IP address. As described above, the virtual communication device 520 virtually sets the IP address acquired from the downstream communication device as the IP address of the own device, and performs communication with other devices.

  In the communication data received by the PHY processing unit 5a, the determination unit 510 has a destination IP address that matches the virtual IP address notified from the virtual communication device 520, and a protocol number from the virtual communication device 520. Communication data matching the notified protocol number is sent to the virtual communication device 520 without being supplied to the packet processing circuit 20. The virtual communication device 520 processes the communication data sent from the determination unit 510. For example, route information transmitted from another router device is acquired, the routing table is recalculated, and input to the packet processing circuit 20. When transmitting communication data to another communication device, the virtual communication device 520 sets a virtual IP address as the IP address of the transmission source, and sends it to the network via the PHY processing unit 5b.

  FIG. 37 is a conceptual diagram for explaining the communication control technique according to the embodiment. The communication control apparatus 10 extracts the communication data that the virtual communication apparatus 520 should actually receive from the communication data transmitted from the communication apparatus 502 to the communication apparatus 504 and sends it to the virtual communication apparatus 520. Further, when transmitting communication data to the communication device 502, the virtual communication device 520 sets the IP address of the communication device 504 as the source IP address. In FIG. 37, communication data is actually transmitted and received through the path indicated by the solid line, but the communication device 502 appears to be communicating with the communication device 504 as indicated by the dotted line. Yes. As a result, the virtual communication device 520 that does not actually have an IP address can communicate with another communication device 502.

(Embodiment 2)
Next, a technique for determining the processing to be executed in the communication control apparatus 10 described above at high speed will be described.

  FIG. 38 shows a configuration of the packet processing circuit 20 according to the embodiment. The packet processing circuit 20 illustrated in FIG. 38 is an example of a determination device according to the present invention, and further includes a comparison target extraction circuit 300 in addition to the configuration of the packet processing circuit 20 according to the base technology illustrated in FIG. Other configurations and operations are the same as those of the base technology.

  FIG. 39 shows an example of communication data acquired by the communication control apparatus 10. The communication data 310 stores data with a packet layout corresponding to the type of communication protocol. In FIG. 39, data areas are numbered for convenience of explanation. For example, data whose data area is “1” is expressed as “data 1”.

  FIG. 40 shows an example of a flowchart for determining processing to be executed in the communication control apparatus 10. In the example of FIG. 40, among the communication data 310 acquired by the communication control apparatus 10, data 1, data 5, and data 7 are used as determination criteria, and after a plurality of condition determination branches based on those data, Processing to be executed has been determined. In order to execute a series of processes according to this flowchart, two or three conditional decision branches are required.

  FIG. 41 is a diagram for explaining the determination method according to the present embodiment. The comparison target extraction circuit 300 extracts a plurality of determination data used for determining a process to be executed from the communication data 310 acquired by the communication control apparatus 10 and connects them together to compare the comparison target data. 320 is generated. In the example of the flowchart shown in FIG. 40, “A” of data 1, “E” of data 5, and “F” of data 7 are extracted from communication data 310, and the comparison is performed by connecting them. “AEF” is generated as the target data 320. The comparison target extraction circuit 300 supplies the generated comparison target data 320 to the index circuit 34 and the binary search circuit 36. The comparison target extraction circuit 300 may detect the position of the determination data using the position detection circuit 32 when extracting the determination data from the communication data 310.

  FIG. 42 shows an example of internal data of the first database 50 and the second database 60 according to the present embodiment. The first database 50 stores reference data obtained by concatenating possible values of the data 1, data 5, and data 7. Also, the second database 60 contains the contents of the processing to be executed, which are determined through a plurality of condition determination branches according to the flowchart shown in FIG. 40, for the combinations of the values of data 1, data 5, and data 7. Are stored in association with the reference data. For example, if data 1 is “A”, data 5 is “E”, and data 7 is “F”, the reference data is “AEF”. As can be seen from the flowchart of FIG. The content is “processing a + processing e”. The binary search circuit 36 searches the comparison target data 320 generated by the comparison target extraction circuit 300 from the first database 50, thereby executing a plurality of conditional decision branches at once, and the reference data that matches the comparison target data Outputs the contents of the process to be executed associated with. The process execution circuit 40 executes the contents of the process determined by the search circuit 30.

  In this way, data that is a criterion for determination is extracted from communication data in advance, and the comparison target data is generated by connecting them, and a database that predicts the answer of the generated comparison target data is prepared. As a result, a plurality of condition determination branches for determining the process to be executed can be simultaneously executed instead of being executed sequentially. Thereby, the process to be executed can be determined at high speed.

  In addition, since logic including a plurality of condition determination branches can be expressed by data, the first database 50 or the second database 60 may be changed instead of changing the entire software when changing the logic. Thereby, a man-hour can be reduced.

  FIG. 43 shows another example of internal data of the first database 50 and the second database 60 according to the present embodiment. In the example of FIG. 43, when there is determination data that is not used for multiple conditional determination branches in a combination of values of a plurality of determination data included in the reference data, the determination data is masked. . For example, in the flowchart shown in FIG. 40, if the data 1 is “A”, the condition determination branch for the data 5 is not executed, so the same result is obtained regardless of the data 5. Therefore, the reference data including “A” as data 1 stores a wild card as data 5.

  In order to compare the data by masking, as described in the base technology, the data at the masked position of both the comparison target data and the reference data is replaced with predetermined data, for example, “0” and then input to the comparison circuit Alternatively, the comparison circuit that compares the data at the masking position may output an output signal indicating that both match, or the comparison result of the data at the masking position may be output without going through the comparison circuit. An output signal indicating that the two match each other may be supplied, or the comparison result of the data at the masked position may be ignored in the circuit that obtains the output signal of each comparison circuit and determines the comparison result.

  By adopting such a configuration, the capacity of the first database 50 can be reduced, and the efficiency of the comparison process can be improved.

  FIG. 44 is a diagram for explaining another example of the determination method according to the present embodiment. The comparison target extraction circuit 300 extracts, from the communication data 310, comparison target data having a predetermined length from a predetermined position so as to include a plurality of determination data used for condition determination branching. In the example of FIG. 44, data from data 1 to data 7 is extracted as comparison target data so as to include data 1, data 5, and data 7 as determination data. In this case, the first database 50 stores reference data having the same data length as the comparison target data, as shown in FIG.

  FIG. 45 shows another example of internal data of the first database 50 and the second database 60 according to the present embodiment. In the example of FIG. 45, the reference data is stored in a format including data that is not used as determination data. The reference data of the first database 50 has the same data length as the data from data 1 to data 7 extracted as the comparison target data, and values that can be taken by the determination data at the positions of the determination data. Is stored. Wildcards are stored at positions other than the determination data.

  The index circuit 34 and the binary search circuit 36 search data for comparison from the database by masking data other than the plurality of determination data. As a result, a plurality of condition determination branches can be executed together, and the contents of the process to be executed associated with the reference data matching the comparison target data can be determined at high speed.

  FIG. 46 shows another configuration example of the packet processing circuit 20 according to the embodiment. The packet processing circuit 20 illustrated in FIG. 46 further includes a comparison target setting circuit 330 in addition to the configuration of the packet processing circuit 20 illustrated in FIG. 38, and includes a plurality of first databases 50a and 50b. The comparison target setting circuit 330 sets data to be extracted by the comparison target extraction circuit 300. The comparison target extraction circuit 300 extracts the data set by the comparison target setting circuit 330 and generates comparison target data. Other configurations and operations are the same as those of the packet processing circuit 20 shown in FIG.

  FIG. 47 is a diagram for explaining another example of the determination method according to the present embodiment. In the example of FIG. 47, the comparison target setting circuit 330 is set to extract data 3, data 6, and data 10 instead of data 1, data 5, and data 7. In accordance with this setting, the comparison target extraction circuit 300 extracts data 3, data 6, and data 10 from the communication data 310 to generate comparison target data 320. Thereby, the data for determination extracted as comparison object data can be set arbitrarily. The logic for determining the process to be executed can be easily changed by switching the reference data of the first database 50 in accordance with the change of the setting.

  The comparison target setting circuit 330 may dynamically switch data to be extracted by the comparison target extraction circuit 300. In this case, the comparison target setting circuit 330 may dynamically switch the first database 50 to be applied. Thereby, since both the comparison target data and the reference data can be dynamically switched and processing to be executed with different logic can be determined, for example, processing of a plurality of different communication protocols can be performed by one communication control device 10. It is possible to execute the filtering process according to the settings of a plurality of users.

  FIG. 48 shows another configuration example of the packet processing circuit 20 according to the embodiment. The packet processing circuit 20 shown in FIG. 48 further includes a notification circuit 340 in addition to the configuration of the packet processing circuit 20 shown in FIG. When the comparison target data does not match any of the reference data in the first database 50, the notification circuit 340 notifies the external device to that effect. Other configurations and operations are the same as those of the packet processing circuit 20 shown in FIG.

  If the comparison target data does not match any of the reference data in the first database 50, there is a leak in the logic for determining the process to be executed. At this time, by notifying the notification circuit 340 to that effect, it is possible to appropriately correct the first database 50 and the second database 60 and eliminate the leakage of logic. In the example of FIG. 48, the notification circuit 340 notifies the database server 150 of comparison target data that does not match any of the reference data in the first database 50. The database server 150 accepts the contents of processing to be performed on the comparison target data from an operator or the like, adds a record of the same reference data as the comparison target data to the first database 50, and the second database 60. The contents of the accepted process are stored in association with the reference data. The database server 150 re-injects the corrected first database 50 and second database 60 into the communication control apparatus 10 to reflect the correction of the database.

(Embodiment 3)
Next, a technique for detecting the abnormality of the communication control device 10 described above will be described.

  FIG. 49 shows a configuration of the detection circuit according to the embodiment. The detection circuit 201 detects that communication data cannot be received due to a physical abnormality such as a connector for connecting the communication cable to the communication control device being disconnected or a contact failure. In recent years, the amount of communication on the Internet has increased dramatically, and communication is always performed between routers using a protocol such as RIP (Routing Information Protocol) for realizing dynamic routing, or communication by polling or the like. In many cases, the communication control apparatus is unlikely to receive communication data for a long time. Therefore, the detection circuit detects that the communication data has not been received for a predetermined time or more and issues a warning that the connector is disconnected.

  The detection circuit 201 includes an input unit 202, a counter circuit 204, and a notification unit 206. The input unit 202 acquires communication data received from the communication cable and sends it to the communication control unit 2. The input unit 202 sends a reset signal to the counter circuit 204 when communication data is acquired. The input unit 202 may send the communication data itself acquired in digital format to the counter circuit 204 as a reset signal. In this case, the counter circuit 204 is reset every time the communication data “1” is acquired. Further, the input unit 202 may send a reset signal to the counter circuit 204 in synchronization with the rising or falling edge of the communication data waveform. In short, the reset signal of the counter circuit 204 is generated from the communication data acquired by the input unit 202 and is input to the counter circuit 204. While the input unit 202 acquires the communication data, the counter circuit What is necessary is just to be comprised so that 204 may continue resetting. When the counter value of the counter circuit 204 exceeds a predetermined value, the notification unit 206 notifies that fact. With the above configuration, a physical abnormality of the communication control device 10 can be accurately detected and notified with a simple configuration, so that the safety of communication control can be improved. In addition to the configuration of the main communication control device 10, a detection circuit can be added.

  For example, in a conventional public switched telephone network, the exchange and the subscriber telephone terminal are electrically connected to form a closed circuit, so that a physical abnormality such as disconnection of the connector of the exchange is easily detected. However, in the case where the communication control device 10 of the base technology is used as an exchange in the IP telephone network, there is no electrical connection between the communication control device 10 and the terminal. This technique is particularly effective.

(Embodiment 4)
Next, a technique for controlling a plurality of types of communication data in the communication control apparatus 10 described above will be described. For example, due to the exhaustion of IP addresses in IPv4, the transition to IPv6 with a larger address space is in progress, but both IPv4 and IPv6 packets are communicated during the transitional period, A technique for appropriately controlling both packets is required. In the present embodiment, among the plurality of types of communication data, according to the type of communication data, only the data to be searched is left and other data is masked to switch the data to be searched. explain.

  FIG. 50 shows a configuration of a packet processing circuit of the communication control apparatus according to the embodiment. The packet processing circuit 20 shown in FIG. 50 further includes a mask circuit 380 and a work memory 382 in addition to the configuration of the packet processing circuit 20 of the communication control apparatus 10 of the base technology shown in FIG. Other configurations and operations are the same as those of the base technology.

  In the present embodiment, an example of authenticating a transmission source user by searching a transmission source IP address of an IP packet acquired by the communication control device 10 from a user database 57 storing an IP address of a legitimate user's terminal. Will be described.

  In the present embodiment, the position detection circuit 32 functions as an extraction unit that extracts data of a predetermined length from a predetermined position of communication data as comparison target data. The position and data length of the communication data from which the position detection circuit 32 extracts the comparison target data are set so that the search target data to be searched in the search circuit 30 is included regardless of the type of communication data. In the example of the present embodiment, the comparison target data is extracted so that the source IP address to be searched is included in both the IPv4 packet and the IPv6 packet.

  In IPv6, “source IP address” for 128 bits is stored after the 65th bit from the top of the IP header. In IPv4, after the 65th bit from the beginning of the packet header, an 8-bit “Time to Live”, an 8-bit “Protocol”, and a 16-bit “Header Checksum” ”, 32-bit“ source IP address ”, 32-bit“ destination IP address (Destination Address) ”, variable-length“ Option ”and“ Padding ”are stored. Yes. Therefore, the position detection circuit 32 extracts 128 bits from the 65th bit of the IP header as comparison target data so that the transmission source IP address that is the search target data is included in any packet, and the mask circuit Send to 380.

  In this case, if it is an IPv6 packet, the position detection circuit 32 will just extract “source IP address” as comparison target data, but if it is an IPv4 packet, it also includes data other than “source IP address”. The comparison target data is extracted in the form of an oval. The position detection circuit 32 notifies the mask circuit 380 of the IP version number stored in the IP header for the operation of the mask circuit 380.

  The mask circuit 380 masks data other than the search target data to be searched by the search circuit 30 among the comparison target data extracted by the position detection circuit 32 according to the type of the acquired communication data, and searches the search circuit 30. To supply. The mask circuit 380 refers to the “Version” of the IP header notified from the position detection circuit 32, and if the version is “6”, the extracted comparison target data is sent to the index circuit 34 as it is. If the version is “4”, the mask circuit 380 temporarily stores the extracted comparison target data in the work memory 382 and masks data other than the “source IP address” in the comparison target data. That is, the mask circuit 380 masks 32 bits from the beginning of the comparison target data and 64 bits from the 65th bit. As a result, the comparison target data generated from the IPv4 packet is masked leaving only the “source IP address” to be searched. The mask circuit 380 sends the masked comparison target data to the index circuit 34.

  FIG. 51 shows an example of internal data of the user database 57. The user database 57 stores a list of IP addresses of user terminals as reference data in order for the communication control apparatus 10 to authenticate a user who is a transmission source of communication data. The user database 57 stores the IPv6 IP address and the IPv4 IP address, but both reference data have the same data length as the comparison target data extracted by the position detection circuit 32. Data at positions other than the position of the search target data in the comparison target data is masked according to the type of communication data to be compared with the reference data. That is, the IPv6 128-bit IP address is stored as it is, but the IPv4 32-bit IP address is the 33rd bit from the top of the 128-bit bit string that is the same as the bit length of the IPv6 IP address. To 64th bit, and the remaining bits are set to “0”.

  The mask circuit 380 uses the same data as the data stored in the reference data stored in the user database 57 at a position other than the position of the search target data in the comparison target data. Store in position. Therefore, in the example of the present embodiment, the mask circuit 380 stores “0” at the position where the comparison target data is to be masked. The data stored at the position to be masked may be arbitrary data as long as it is used in common with the reference data of the user database 57.

  The index circuit 34 and the binary search circuit 36 search the user database 57 for the comparison target data supplied from the mask circuit 380 in the same manner as the method described in the base technology. Thus, even when the position of the search target data in the comparison target data differs depending on the type of communication data, the reference data stored in the first database 50 and the comparison extracted by the position detection circuit 32 Since both of the target data are masked so that the search target data is included in the same position, the search can be executed using the same index circuit 34 and binary search circuit 36. Therefore, it is possible to search for desired data among communication data with a simple configuration.

  When the communication data before masking by the mask circuit 380 is required, the processing execution circuit 40 reads the original communication data not masked from the work memory 382 and performs necessary control. As described above, according to the technique of the present embodiment, it is possible to appropriately control a plurality of types of communication data.

  The mask circuit 380 may store data that functions as a wild card at a position other than the search target data in the comparison target data. The comparators of the index circuit 34 and the binary search circuit 36, when data functioning as a wild card is input, output a signal indicating that they match. The comparator that compares the data at the position where the wild card is stored may be treated as if a signal indicating that the two match is output, without needing to input the data. In this case, arbitrary data may be stored in the reference data of the user database 57 at the position to be masked.

  Of the reference data in the user database 57, data that functions as a wild card may be stored at a position other than the position of the search target data in the comparison target data. In this case, the mask circuit 380 and the work memory 382 may not be provided.

  The process execution circuit 40 may convert the IP address of the user who has been successfully authenticated. For example, when the user is identified using the IPv4 IP address in the first database 50, the second database 60, or another communication device, the process execution circuit 40 keeps the IPv4 IP address as it is, You may unify into IPv4 by converting the IP address of IPv6 into the IP address of IPv4. Conversely, it may be converted to IPv6 by converting an IPv4 IP address into an IPv6 IP address. When the user is identified using the user ID in the first database 50, the second database 60, or another communication device, the process execution circuit 40 uses the IPv4 and IPv6 IP addresses as the user ID. May be converted to

(Embodiment 5)
FIG. 52 shows a configuration of a communication management system according to the embodiment. The communication management system 600 uses the communication control apparatus 10 having a function such as packet filtering to perform processing for detecting and blocking inappropriate communication such as communication for operating a bot.

  As described above, the bot infects the user terminal 610 and causes damage. A user terminal infected with a bot (hereinafter referred to as “bot 620”) is manipulated as an attacker and acts as an attacker's terminal. Therefore, it is desirable to detect and block communication for operating the bot 620 and communication for the bot 620 to attack other user terminals 610.

  However, since new variants are appearing one after another based on the bots for which the source code has been released, it is inappropriate to be transmitted / received to / from the bot 620 or the botnet 622 composed of a plurality of bots 620. It is difficult to reliably detect all communication data.

  Therefore, in the present embodiment, the idea is reversed, a normal communication signature list is created and normal communication is allowed to pass, while non-normal communication is escalated and analyzed one by one. We propose a technique to update the abnormal communication signature list as needed. Since this technology is expected to reduce the damage caused by the botnet, it can be said that the social contribution of the present invention is very high.

  In the communication management system 600, the communication control apparatus 10 is provided between the user terminal 610 and the Internet 690, and communication data transmitted / received via the Internet 690 is controlled. When the communication control apparatus 10 detects abnormal communication data, the communication control apparatus 10 notifies the operator terminal 640. In the operator terminal 640, the corresponding communication data is analyzed, and it is determined whether or not the communication data is normal. The signature of the communication data determined to be normal is reflected in the communication control device 10, and thereafter, communication data of the same type as this communication data is permitted to be transmitted and received. The signature of the communication data determined to be abnormal is also reflected in the communication control apparatus 10, and thereafter, communication data of the same type as this communication data is prohibited from being transmitted / received and blocked. In this way, the communication control apparatus 10 detects and blocks communication between the bot 620 and the botnet 622, communication for operating the bot 620 via the Internet 690, and the like.

  In the communication control apparatus 10 of the present embodiment, a normal signature list 632, an abnormal signature list 634, and a rule database 636 are provided as the first database 50. The normal signature list 632 stores a list of communication data signatures to be passed as normal communication. The abnormal signature list 634 stores a list of communication data signatures to be blocked as abnormal communication. The rule database 636 stores rules for extracting communication data that requires analysis.

  In addition to the three first databases 50 being provided, three search circuits 30 are also provided. The search circuit 30 </ b> A functions as a first search unit that searches whether the acquired communication data matches the normal communication signature stored in the normal signature list 632. The search circuit 30 </ b> B functions as a second search unit that searches whether the acquired communication data matches the signature of the abnormal communication stored in the abnormal signature list 634. The search circuit 30C functions as a third search unit that searches whether the acquired communication data matches the rules stored in the rule database 636. At least two of these search circuits 30, preferably all the search circuits 30 execute the search in parallel at the same time. Thus, normal communication, abnormal communication, and communication to be extracted can be detected at high speed without reducing the throughput. In order to simultaneously supply communication data to the three search circuits 30, the technique shown in FIG. 22 may be used.

  The second database 60 stores processing contents for issuing a warning when communication data that does not match the normal communication signature stored in the normal signature list 632 is detected. In response to this, when the search circuit 30A detects communication data that does not match the signature stored in the normal signature list 632, the process execution circuit 40 functions as a warning unit that issues a warning and notifies the operator terminal 640.

  Further, the second database 60 stores processing contents for blocking communication data when it detects communication data matching the signature of the communication to be blocked stored in the abnormal signature list 634. In response to this, when the search circuit 30B detects communication data that matches the signature stored in the abnormal signature list 634, the processing execution circuit 40 functions as a blocking unit that discards and blocks the communication data.

  In the operator terminal 640, when the warning acquisition unit 642 acquires a warning from the communication control device 10, the operator terminal 640 notifies the operator to that effect by display or voice. At this time, the communication data acquisition unit 644 acquires communication data for which a warning has been issued from the communication control device 10. The analysis unit 646 analyzes the communication data that does not match the signature of the normal communication for which a warning is issued, determines whether the communication is normal, and transmits the determination result to the determination result acquisition unit 648. The determination result acquisition unit 648 may acquire a determination result from an operator who has analyzed the communication data. Further, the determination result may be acquired from a security vendor or the like escalated from the operator.

  When the determination result acquisition unit 648 acquires the determination result that the communication data for which the warning has been issued is normal communication data, the normal signature list update unit adds the signature of the communication data to the normal signature list 662 Direct to 652. The normal signature list update unit 652 adds the signature of communication data determined to be normal to the normal signature list 662.

  When the determination result acquisition unit 648 acquires the determination result that the communication data for which the warning has been issued is communication data to be blocked, the abnormality signature list update is performed so as to add the signature of the communication data to the abnormality signature list 664. To the unit 654. The abnormal signature list update unit 654 adds the signature of the communication data determined to be blocked to the abnormal signature list 664.

  The updated normal signature list 662 and the abnormal signature list 664 are reflected in the normal signature list 632 and the abnormal signature list 634 of the communication control apparatus 10 by the database server 150 at a predetermined timing. The database update may be performed according to the procedure described in the base technology. Further, the normal signature list update unit 652 and the abnormal signature list update unit 654 may directly access and update the normal signature list 632 and the abnormal signature list 634. In the case where a plurality of communication control devices 10 are provided, the database server 150 creates a normal signature list 662 in which the determination results of communication data for which warnings have been issued by the respective communication control devices 10 are created, and the collected normal signatures The list 662 is reflected in the normal signature list 632 of each communication control apparatus 10.

  In this way, instead of extracting and blocking only abnormal communication by signature, only normal communication is extracted by signature and allowed to pass, and other communication is analyzed to determine whether it is normal or not. Reflect the results. As a result, even if inappropriate communication is performed by a new communication protocol in the botnet 622 or the like, it is not normal communication and can be reliably detected. Further, once the communication data to be blocked is detected, the signature is registered in the abnormal signature list 634, so that it can be blocked appropriately thereafter. Although the amount of signatures in the normal signature list 632 and the abnormal signature list 664 is considerably large, as described in the base technology, the communication control device 10 of the present embodiment is configured by dedicated hardware, Since a high-speed search is possible, communication can be managed appropriately without reducing the throughput.

  The second database 60 further stores processing contents for copying and outputting the communication data that matches the rules stored in the rule database 666. In response to this, when the search circuit 30C detects communication data that matches the rules stored in the rule database 636, the process execution circuit 40 outputs a copy of the communication data from the output port to the operator terminal 640. Function as.

  For example, other communication data sent from the same source or other communication data sent to the same destination in determining whether the communication data for which the warning has been issued is normal or should be blocked It may be necessary to analyze by referring to. In such a case, if the transmission source IP address, transmission destination IP address, payload content, etc. of the communication data for which the warning has been issued are registered as rules in the rule database 636, the communication data that matches the rules Can be collected and analyzed. As described in the base technology, the communication control apparatus 10 according to the present embodiment searches not only the information stored in the header, such as the IP address of the transmission source or the transmission destination, but also the information stored in the payload part. It is possible to set more detailed rules.

  When the operator analyzes the communication data for which the warning has been issued, and determines that the analysis should be performed with reference to other communication data, the operator extracts the related communication data via the rule database update unit 656. Can be added to the rules database 666. The updated rule database 666 is reflected in the rule database 636 of the communication control apparatus 10 by the database server 150. As a result, a packet capture device that can change the signature at any time can be realized.

(Embodiment 6)
In the embodiment, a technique will be described in which a plurality of types of communication control are executed by one communication control device by providing a plurality of databases for a plurality of different types of communication control and switching them to apply.

  FIG. 53 shows a configuration of the packet processing circuit 20 according to the embodiment. The packet processing circuit 26 shown in FIG. 53 further includes a switching unit 180 in addition to the configuration of the packet processing circuit 20 of the base technology shown in FIG. Further, the first database 50 and the second database 60 include a plurality of databases provided for a plurality of types of communication control. In the example of FIG. 53, a URL filtering database 181 for controlling access to content via the network, a spam mail filtering database 182 for filtering spam mail, and P2P for performing bandwidth control of P2P communication. A bandwidth control database 183 is provided.

  The switching unit 180 enables the communication control apparatus 10 to be used for a plurality of different communication controls by switching the first database 50 and the second database 60 between a plurality of different communication control databases. The switching unit 180 may switch a memory device such as a ROM or a RAM in which a database to be used is stored using a chip select signal or the like.

  When the switching unit 180 switches the first database 50 and the second database 60, the switching unit 180 specifies the storage position of the reference data stored in the database after switching the position specifying data to be detected by the position detection circuit 32. It may be switched to the position specifying data. For example, when the communication control device 10 is provided with a URL filtering function, the first database 50 and the second database 60 are switched to the URL filtering database 181, and “http :: A character string “/” is set, and the storage location of the URL of the accessed content is detected. Further, when the communication control device 10 is provided with a spam mail filtering function, the first database 50 and the second database 60 are switched to the spam mail filtering database 182, and “DATA DATA” is used as position specifying data of the position detection circuit 32. Is set to detect the storage location of the body of the e-mail.

  The switching unit 180 may switch the database to be dynamically applied according to the type of communication data. For example, the search circuit 30 is used as a determination circuit for determining the packet type, and the search circuit 30 detects the port number of the packet and notifies the switching unit 180 of it. The switching unit 180 switches between the first database 50 and the second database 60 according to the notified port number, that is, the packet type. For example, if the port number is “80”, since it is an HTTP packet, it is switched to the URL filtering database 181, and if the port number is “25”, it is an SMTP packet, so it can be switched to the spam mail filtering database 182. Good. Thereby, the function of one communication control apparatus 10 can be dynamically switched, and a plurality of different communication controls can be performed according to the type of packet. In this case, the switching unit 180 may be a circuit for generating and supplying a chip select signal for each of the first database 50 and the second database 60 from the port number signal output from the search circuit 30. .

(Embodiment 7)
Next, a new technique for realizing the binary search in the communication control apparatus 10 described above will be described.

  FIG. 54 shows another configuration example of the binary search circuit. In the example shown in FIG. 54, 15 comparison circuits 36A to 36O are provided in order to execute four searches at a time. The control circuit 36Z simultaneously receives data at positions 1/16, 2/16,..., 15/16 of the search target range from the first database 50 connected to each of the 15 comparison circuits 36A to 36O. They are read out in parallel and input to the comparison circuits 36A to 36O. Further, the comparison target data x is input to each of the comparison circuits 36A to 36O.

  First, as a first step, the control circuit 36Z uses the three comparison circuits 36A, 36B, and 36C to which the data of the positions 4/16, 8/16, and 12/16 of the search target range are input, as the comparison target data. It is determined which x belongs to the range obtained by dividing the search target range into four. Subsequently, as the second stage, the comparison target data x is searched by three comparison circuits to which data at positions 1/4, 2/4, and 3/4 of the range determined in the first stage is input. It is determined which of the ranges obtained by dividing the target range into 16 pieces.

  The binary search circuit 36 receives data in the range determined in the first stage among the next second stage comparison circuits 36D to 36O from the output signal indicating the comparison results of the first stage comparison circuits 36A, 36B, and 36C. Is further provided with a negation circuit 37 and exclusive OR circuits 38A and 38B as a trigger circuit that generates a trigger signal that causes the comparison circuit to input the comparison to be input to the second-stage comparison circuits 36D to 36O. Yes. Here, the comparison circuits 36A to 36O output “1” when the comparison target data x is larger than the reference data, and output “0” when it is smaller.

  First, a trigger signal is input to the first stage comparison circuits 36A, 36B, and 36C, and the comparison is executed in parallel at the same time. If the output of the comparison circuit 36A is “0”, the comparison target data x belongs to the range of 0/16 to 4/16 of the search target range of the first database 50, and therefore the reference data of that range is input. The trigger signal “1” is input to the comparison circuits 36D, 36E, and 36F through the negative circuit 37. Thereby, only the comparison circuits 36D, 36E, and 36F to which the reference data at the positions 1/16, 2/16, and 3/16 of the search target range are input are activated among the comparison circuits 36D to 36O in the second stage. At the same time, the second stage comparison is performed in parallel. When the comparison target data x belongs to the range of 4/16 to 16/16 of the search target range, the output of the comparison circuit 36A is “1”, so that “0” is output from the negative circuit 37, A trigger signal is not input to the comparison circuits 36D, 36E, and 36F.

  If the output of the comparison circuit 36A is “1” and the output of the comparison circuit 36B is “0”, the comparison target data x belongs to the range of 4/16 to 8/16 of the search target range. The trigger signal “1” is input to the comparison circuits 36G, 36H, and 36I to which the reference data is input via the exclusive OR circuit 38A. Thereby, only the comparison circuits 36G, 36H, and 36I to which the reference data at the positions of 5/16, 6/16, and 7/16 of the search target range are input are activated among the comparison circuits 36D to 36O in the second stage. At the same time, the second stage comparison is performed in parallel. When the comparison target data x does not belong to the range of 4/16 to 8/16 of the search target range, the outputs of the comparison circuits 36A and 36B are the same, so that the exclusive OR circuit 38A receives “0”. Is output, and no trigger signal is input to 36G, 36H, and 36I.

  If the output of the comparison circuit 36B is “1” and the output of the comparison circuit 36C is “0”, the comparison target data x belongs to the range of 8/16 to 12/16 of the search target range. The trigger signal “1” is input to the comparison circuits 36J, 36K, and 36L to which the reference data is input via the exclusive OR circuit 38B. Thereby, only the comparison circuits 36J, 36K, and 36L to which the reference data of the positions 9/16, 10/16, and 11/16 of the search target range are input are activated among the comparison circuits 36D to 36O in the second stage. At the same time, the second stage comparison is performed in parallel. When the comparison target data x does not belong to the range of 8/16 to 12/16 of the search target range, the outputs of the comparison circuits 36B and 36C are the same, so that the exclusive OR circuit 38B receives “0”. Is output, and no trigger signal is input to 36J, 36K, and 36L.

  If the output of the comparison circuit 36C is “1”, the comparison target data x belongs to the range of 12/16 to 16/16 of the search target range, and therefore the comparison circuit 36M to which the reference data of that range is input. , 36N, 36O, the output signal of the comparison circuit 36C is input as the trigger signal “1”. Thereby, only the comparison circuits 36M, 36N, and 36O to which the reference data of the positions 13/16, 14/16, and 15/16 of the search target range are input among the second-stage comparison circuits 36D to 36O are activated. At the same time, the second stage comparison is performed in parallel. When the comparison target data x belongs to the range of 0/16 to 12/16 of the search target range, the output of the comparison circuit 36C becomes “0”, so that a trigger signal is input to 36M, 36N, and 36O. Not.

  In this way, in the example shown in FIG. 54, four searches can be executed by the two-stage comparison process. If the comparison target data x is not searched in the four searches, the control circuit 36Z newly sets the 1/16, 2/16,..., 15/16 of the range determined in the second stage. Is input to each of the 15 comparison circuits 36A to 36O, and the next four searches are executed.

  In this way, the comparison circuit for performing the search for n times is hierarchized into a plurality of stages, and after the second stage, only the comparison circuits in the range determined up to the previous stage are operated, thereby reducing power consumption. Can be made.

In the example of FIG. 54, 15 comparison circuits are provided to perform four searches simultaneously, but in general, 2 ⁿ -1 comparison circuits are used to perform n searches simultaneously in parallel. May be provided. Control circuit 36Z is, when dividing a search range of the first database 50 to ^{the 2 n,} the compared data x, ^{1/2 n,} 2/2 n the search range, · · ·, ^{(2 n} - 1) / ² and ⁿ of the location of the ^data, it is input to each of the ² n -1 comparison circuits. First, as a first stage, 2 ⁿ¹ −1 comparison circuits to which data at positions of 1/2 ⁿ¹ , ^{2/2 n1} ,..., (2 ⁿ¹ −1) / 2 ⁿ¹ of the search target range are input. Thus, it is determined whether the comparison target data x belongs to a range obtained by dividing the search target range into 2 ⁿ¹ pieces. Subsequently, as the second step, ^{1/2 n2,} 2/2 n2 ranges determined in the first ^{stage, ···, (2 n2 -1)} / 2 2 data of the position is input ^{n2 n2} It is determined by the one comparison circuit whether the comparison target data x belongs to the range obtained by dividing the search target range into 2 ^{n1 + n2} . In the same manner, n times of searches are executed by repeating until the Nth stage (where n1 + n2 +... + NN = n). If the comparison target data x is not searched in the n searches, a new value of 1/2 ⁿ , 2/2 ⁿ ,..., (2 ⁿ −1) / Data of 2 ⁿ positions are input to each of 2 ⁿ −1 comparison circuits, and the next n searches are executed.

In this case, the trigger circuit has an output signal indicating the comparison result of the m-th (1 ≦ m <N) -stage comparison circuit, within the range determined in the m-th stage among the next (m + 1) -th comparison circuits. A trigger signal that causes the comparison circuit to which data is input to perform comparison is generated and input to the (m + 1) th comparison circuit. Specifically, among the 2 ^m -1 comparison circuits in the m-th stage, when an output signal indicating a different comparison result is output from an adjacent comparison circuit, the data input to the comparison circuits The trigger signal may be input to the (m + 1) -th stage comparison circuit to which data in the range between them is input. In addition, in the (m + 1) -th stage comparison circuit to which the data of the minimum range and the maximum range among the 2 ^m ranges determined in the m-th stage are input, 2 ^m −1 pieces in the m-th stage are included. Of these comparison circuits, a trigger signal may be input according to the comparison result of the comparison circuit to which the minimum and maximum reference data are input.

  FIG. 55 shows still another configuration example of the binary search circuit. In the example shown in FIG. 55, the binary search circuit 36 uses the three comparison circuits 36A to 36C and belongs to which of the ranges obtained by dividing the comparison target data x into four search target ranges of the first database 50. However, in the example of FIG. 55, four comparison circuits 36P to 36S for determining whether the comparison target data x is included in each of the four ranges are provided. For example, the reference data at the position 0/16 of the search target range of the first database 50, the reference data at the position 4/16, and the comparison target data x are input to the comparison circuit 36P. By comparing the reference data and the comparison target data x, it is determined whether or not the reference data is included in the range of 0/16 to 4/16 of the search target range. When included in the range, the trigger signal is input from the comparison circuit 36P to the comparison circuits 36D, 36E, and 36F to which the data included in the range is input as reference data. Thereby, in the second stage, only the comparison circuit in the range determined in the first stage performs the comparison, so that the power consumption can be reduced.

In the example shown in FIGS. 54 and 55, of 2 ⁿ −1 comparison circuits for performing n searches at a time, 1/2 ⁿ¹ , ^{2/2 n1,. n1} -1) / 2 The 2 ⁿ¹ -1 comparison circuits to which the data at the position of ⁿ¹ are input are the first-stage comparison circuits. May be a first-stage comparison circuit. In short, a plurality of comparison circuits may be hierarchized so that only the comparison circuits in the range determined up to the previous stage are operated.

  The first database and the second database are rewritable from the outside. By exchanging these databases, various data processing and communication control can be realized using the same communication control device 10. In addition, two or more databases storing reference data to be searched may be provided to perform multi-stage search processing. At this time, two or more databases that store search results and processing contents in association with each other may be provided to realize more complicated conditional branching. As described above, in the case where a plurality of databases are provided to perform a multi-stage search, a plurality of position detection circuits 32, index circuits 34, binary search circuits 36, etc. may be provided.

  The data used for the comparison described above may be compressed by the same compression logic. In comparison, if the comparison source data and the comparison destination data are compressed by the same method, the same comparison as usual is possible. As a result, the amount of data loaded at the time of comparison can be reduced. If the amount of data to be loaded is reduced, the time required to read data from the memory is reduced, so that the overall processing time can also be reduced. Further, since the amount of the comparator can be reduced, it is possible to contribute to downsizing, weight reduction, and cost reduction of the apparatus. The data used for the comparison may be stored in a compressed form, or may be compressed after being read from the memory and before the comparison.

(Embodiment 8)
Next, a technique for identifying a user terminal in the communication control apparatus 10 described above will be described. A terminal or a mobile phone terminal that is dial-up connected to an Internet service provider is given an IP address from a server that manages the connection when connecting to the Internet, so that the IP address changes each time the connection is made. Therefore, the user terminal cannot be uniquely identified only by the IP address. In the present embodiment, a technique for uniquely identifying a terminal by acquiring an IP address assigned to the terminal from a server that manages the connection of the terminal will be described.

  FIG. 56 shows a configuration of a packet processing circuit of the communication control apparatus according to the embodiment. The packet processing circuit 20 shown in FIG. 56 further includes a user database update unit 460 in addition to the configuration of the packet processing circuit 20 of the communication control apparatus 10 of the base technology shown in FIG. Other configurations and operations are the same as those of the base technology.

  The connection management server 120 authenticates a terminal of a user who is trying to connect to the Internet, and assigns an IP address to the terminal that has been successfully authenticated. The connection management server 120 has a table of IP addresses that can be assigned to the user's terminal, and dynamically assigns a free IP address to the terminal. The connection management server 120 may be a RADIUS (Remote Authentication Dial In User Service) server that performs terminal authentication and accounting, or may be a RADIUS client that requests the RADIUS server to authenticate the user terminal. The connection management server 120 notifies the communication control apparatus 10 of the IP address assigned to the terminal of the user who has been successfully authenticated and the user ID of the user of the terminal. The user database update unit 460 registers the set of the user ID and IP address acquired from the connection management server 120 in the user database 57.

  FIG. 57 shows an example of internal data of the user database 57. The user database 57 is provided with an IP address column 401 and a user ID column 402. The IP address column 401 stores all IP addresses that may be assigned to the user's terminal, sorted in ascending or descending order. When the user database update unit 460 obtains the user ID of the user and the IP address currently assigned to the user terminal from the connection management server 120, the user database update unit 460 registers the user ID in the corresponding IP address record. This makes it possible to identify the user from the IP address thereafter.

  When the communication control apparatus 10 receives the communication data, first, the search circuit 30 searches the IP address column 401 of the user database 57 for the IP address of the communication data transmission source or transmission destination, and corresponds to the corresponding IP address. Obtain a user ID. When the IP address column 401 of the user database 57 is sorted in ascending or descending order, the search circuit 30 searches for the IP address of the transmission source or the transmission destination by binary search. At this time, the search circuit 30 functions as a user identification unit that identifies a user of a communication data transmission source or transmission destination terminal.

  Subsequently, the search circuit 30 searches the reference data included in the communication data from the first database 50, reads the contents of processing to be executed from the second database 60 according to the search result, and controls the communication data. At this time, when a database such as a common category list of the second database 60 is provided for each user and the user ID is stored in the database in association with the user ID, the search is performed by referring to the record of the corresponding user ID. Execute. Thereby, the control set for every user can be performed appropriately.

  The communication control apparatus 10 may further include a search circuit 30 for searching for an IP address. In this case, the search for the IP address and the search for the reference data included in the communication data can be executed in parallel at the same time, so that higher-speed communication control can be realized.

  As described above, according to the technique according to the present embodiment, a terminal that has made a call can be uniquely identified even in an IP telephone. In the fixed subscriber telephone network, the telephone exchange and the subscriber terminal are directly electrically connected, so that the terminal that made the call can be reliably identified. When switching from the fixed telephone network to the IP telephone network, there was a great concern that this characteristic would be lost, but by using the technology of the present embodiment, similarly in the IP telephone network, The characteristics of the telephone lifeline can be maintained. For example, in an emergency call, even if the caller is calm and unable to name himself, there is a failure in speaking, or the terminal is called by the emergency call organization even if it falls into a dangerous situation and cannot speak well. Can be identified. In addition, since the caller is specified, it is also important as a technique for preventing unwanted calls.

(Embodiment 9)
In the embodiment, a technique for editing or duplicating communication data in the communication control apparatus described in the base technology will be described.

  FIG. 58 shows a configuration of the packet processing circuit 20 according to the embodiment. The packet processing circuit 20 according to the present embodiment further includes an editing unit 42 and a duplicating unit 44 in addition to the configuration of the packet processing circuit 20 of the base technology shown in FIG. Other configurations and operations are the same as those of the communication control apparatus 10 according to the base technology.

  The editing unit 42 performs various editing on the communication data before sending the communication data acquired by the communication control device 10 to the network. The editing unit 42 edits the communication data according to the conditions stored in the first database 50 and the second database 60. A plurality of the first database 50 and the second database 60 may be provided according to a plurality of conditions, or may be provided for each user, for each group of users, or for each communication protocol. The first database 50 and the second database 60 may be switched according to the direction of communication or at a predetermined timing.

  The editing unit 42 has a function of deleting predetermined data from communication data. The editing unit 42 may delete the communication text or content stored in the payload of the packet according to a predetermined condition.

  The editing unit 42 has a function of adding predetermined data to communication data. The editing unit 42 may add content such as advertisements, location information of the communication control device 10, region information, IP address, and the like to the packet payload according to predetermined conditions.

  The editing unit 42 has a function of changing predetermined data of communication data to another data. The editing unit 42 may change the IP address or MAC address of the packet transmission source or transmission destination according to a predetermined condition, or may replace a prohibited keyword such as spam mail with a space or the like.

  The editing unit 42 has a function of compressing or decompressing communication data. The editing unit 42 may compress the data stored in the payload of the packet or decompress the compressed data according to a predetermined condition. The editing unit 42 may calculate a hash value of predetermined data stored in the payload of the packet and replace it with the calculated hash value.

  The editing unit 42 has a function of encrypting or decrypting communication data. The editing unit 42 may encrypt plaintext data stored in the payload of the packet or decrypt the encrypted data according to a predetermined condition.

  The editing unit 42 has a function of translating character or sentence data included in the communication data or changing a character code. The editing unit 42 may translate character or sentence data stored in the payload of the packet into a predetermined language according to a predetermined condition. The editing unit 42 may normalize the character code of the character or sentence data stored in the payload of the packet according to a predetermined condition. The editing unit 42 replaces spaces, symbols, control characters, etc. included in the data name of the data stored in the payload of the packet, the file name of the attached file, etc. according to a predetermined condition. May be normalized. As a result, it is possible to reduce a situation in which character data cannot be read or a file cannot be opened due to a difference in file system between the transmission source computer and the transmission destination computer. Also, by replacing the data name and file name with another name, the data can be protected even if the data is accidentally passed to a third party.

  The editing unit 42 may count the number of times of editing, the amount of data, and the like when the communication data is edited by the function as described above. This count value may be supplied to the editing unit 42 and other components of the communication control apparatus 10 and used for communication control. The editing unit 42 recalculates and updates a cyclic redundancy check (CRC) if necessary when editing communication data by the function as described above.

  The duplication unit 44 duplicates the communication data in accordance with a predetermined condition separately from the communication data transmitted by the processing execution circuit 40 and backs up the data in the storage device 46. For example, as a compliance measure in a company, the duplicating unit 44 may duplicate e-mail communication data transmitted / received to / from a mail address of a company mail server and back it up in the storage device 46. At this time, when an e-mail is transmitted to a plurality of e-mail addresses of the same company, only one communication data may be copied and others may be discarded. In addition, communication data that matches a predetermined condition may be copied and backed up in the storage device 46 for investigation by the police. The duplication unit 44 may duplicate all data unconditionally and back it up in the storage device 46. The duplication unit 44 may back up the communication data before editing by the editing unit 42, or may back up the communication data after editing.

  FIG. 59 shows a configuration of a communication control system according to the embodiment. In the example of FIG. 59, the communication control system 100a is provided in the base station device 262, the communication control system 100b is provided in the control station device 264, and the communication control system 100c is provided in the communication path between the Internet 200 and the destination terminal 230. It has been.

  The editing unit 42 of the communication control system 100a closest to the transmission source mobile phone terminal 260 encrypts the communication data sent from the mobile phone terminal 260 and decrypts the communication data sent to the mobile phone terminal 260. The editing unit 42 of the communication control system 100c closest to the transmission destination terminal 230 decrypts the communication data transmitted to the transmission destination terminal 230 and encrypts the communication data transmitted from the transmission destination terminal 230.

  That is, as shown in FIG. 59, the communication data 270 sent from the mobile phone terminal 260 is encrypted by the communication control system 100a of the base station device 262. The encrypted communication data 271 is transmitted to the Internet 200 via the control station device 264. The communication control system 100 c decrypts the encrypted communication data 271 and transmits it to the transmission destination terminal 230. Thereby, since communication data is encrypted and transmitted / received between the communication control system 100a and the communication control system 100c, a safe communication path can be constructed.

  As described above, the communication control apparatus 10 according to the present embodiment is a transparent communication device that does not have an IP address and does not require a physical incoming call. Therefore, an existing network such as a VPN is set. A secure private network can be easily constructed without complicated modifications.

  In the communication control system shown in FIG. 59, the editing unit 42 of the communication control system 100 may compress the communication data sent from the terminal and decompress the compressed communication data sent to the terminal. Thereby, the communication amount between the communication control systems 100 can be reduced.

(Embodiment 10)
In the embodiment, a technique for using the communication control system described in the base technology for an emergency call in a telephone network using a network such as the Internet will be described.

Although IP telephones using technologies such as VoIP have been realized, at present, emergency calls cannot be made from IP telephones. This is because IP telephones do not satisfy the following requirements for subscriber telephones for emergency calls.
(1) Depending on the location of the whistleblower, connect to the emergency call organization that has that jurisdiction.
(2) Make sure that the caller cannot end the call and that the caller can be called from the emergency call organization.
(3) Notify the emergency call organization of the caller's phone number and location information.

  In the present embodiment, a technology for realizing an emergency call by an IP phone or a mobile phone satisfying the above requirements using the communication control system 100 of the base technology is proposed.

  The communication control system 100 according to the present embodiment uses the first database 50 in which the emergency telephone number is stored to detect communication data for calling the emergency telephone number by the search circuit 30 of the communication control apparatus 10, and Control the call for notifications. This communication control system 100 is provided in a communication path between a telephone terminal that is an originator of an emergency call and an emergency call organization. Hereinafter, arrangement examples of the communication control system 100 are listed.

  FIG. 60 shows an example of arrangement of the communication control system. This figure shows an example in which a mobile phone terminal 260 is used as an example of a caller telephone terminal. Communication data transmitted from the mobile phone terminal 260 is transmitted to the Internet 200 through the base station device 262 installed by the carrier and the control station device 264 provided in the station building, and the call destination telephone terminal through the Internet 200. 210 or emergency call organization 220 is reached. In the example of this figure, the base station apparatus 262 is provided with the communication control system 100. In this case, the communication control system 100 may be downsized by mounting only the necessary minimum functions. For example, the configuration of the connection management server 120 and the log management server 140 may be omitted.

  FIG. 61 shows another arrangement example of the communication control system. This figure also shows an example in which the mobile phone terminal 260 is used. However, unlike the example shown in FIG. 60, the communication control system 100 is provided in the control station device 264. Since the emergency call is centrally controlled by the control station device 264 provided in the station building, system maintenance is easy.

  62 and 63 show still another arrangement example of the communication control system. This figure shows an example in which an IP telephone terminal 280 connected to the Internet is used as an example of a telephone terminal. Communication data transmitted from the IP telephone terminal 280 is transmitted to the Internet 200 via router devices 282 and 284 such as LAN or WAN, and reaches the telephone terminal 210 or the emergency call organization 220 as a call destination via the Internet 200. . FIG. 62 shows an example in which the communication control system 100 is provided in the router device 282, and FIG. 63 shows an example in which the communication control system 100 is provided in the router device 284. The communication control system 100 may be provided by a circuit provider or may be provided by an ISP.

  In the above example, an example in which the communication control system 100 is incorporated in a device configuring a network is shown, but the communication control system 100 may be provided at an arbitrary position on the network separately from these devices.

  FIG. 64 shows a configuration of a communication control system according to the embodiment. In the communication control system 100 of the present embodiment, the message output server 130 includes an emergency telephone control unit 137 and a location information holding unit 138. Other configurations and operations are the same as those of the communication control system 100 of the base technology shown in FIG. When the communication control device 10 detects communication data for calling an emergency telephone number, the emergency telephone control unit 137 controls the emergency telephone call. The location information holding unit 138 holds information related to the location of the caller telephone terminal or the communication control system 100. This location information is added to communication data transmitted to the emergency call organization 220 by the emergency telephone control unit 137 that also functions as a location information addition unit, and is notified to the emergency call organization 220.

  In the communication control system 100 for emergency calls using the IP telephone terminal 280 shown in FIG. 62 or 63, information such as a zip code, an address code, and an address may be stored in the position information holding unit 138. . These pieces of information may be information on the installation positions of the communication control system 100 or information on the installation positions of the individual IP telephone terminals 280. In the latter case, the location information holding unit 138 stores the telephone number, postal code, address code, address, and the like of the IP telephone terminal 280 of the registered user of the telecommunication carrier. In this case, the position information holding unit 138 functions as the first database 50 of the communication control device 10 to search the telephone number of the IP telephone terminal 280 that has made an emergency call by the search circuit 30, and the position of the corresponding IP telephone terminal 280. Information may be obtained. In the communication control system 100 for emergency call using the mobile phone terminal 260 shown in FIG. 60 or 61, the latitude, longitude, and accuracy information of the base station device 262 are stored in the position information holding unit 138. Good. In this case, the latitude and light units may be expressed in degrees and the fifth decimal place, and the accuracy information unit may be meters.

  FIG. 65 is a sequence diagram illustrating a procedure of the communication control method according to the embodiment. FIG. 65 shows a procedure until the communication control system 100 establishes a connection with the caller telephone terminal. This procedure mainly assumes a three-way handshake in TCP / IP communication, but may be applied to another communication protocol. If the calling telephone terminal is the mobile telephone terminal 260, these procedures may be omitted.

  When the user calls an emergency telephone number, the caller telephone terminal 280 transmits a “SYN” packet for requesting connection to the connection destination of the emergency telephone number (S10). The communication control apparatus 10 acquires this “SYN” packet, refers to the first database 50 in which the list of emergency telephone numbers is stored, and determines whether the telephone number of the call destination is an emergency telephone number by the search circuit 30. It is determined whether or not (S12). When the call destination telephone number is a general telephone number, the communication control apparatus 10 transmits a “SYN” packet to the Internet and transmits it to the call destination telephone terminal 210. If the call destination telephone number is an emergency telephone number, the communication control apparatus 10 notifies the emergency telephone control unit 137 to that effect (S14).

  When notified of an emergency call, the emergency telephone control unit 137 issues a “ping” command to the caller telephone terminal 280 in order to confirm the presence of the caller telephone terminal 280 (S16). . When receiving the “ping” command, the caller telephone terminal 280 returns a response to the command (S18). If a response cannot be obtained from the caller telephone terminal 280, there is a possibility that the IP address or telephone number is forged, so the emergency call control unit 137 discards the “SYN” packet, Prohibit connection. Thereby, the impersonation of the caller of an emergency call can be suppressed.

  When it is confirmed by the “ping” command that the communication with the caller telephone terminal 280 is normal, the emergency telephone control unit 137 transmits a “FIN” packet to the caller telephone terminal 280 (S20). ). Since the “FIN” packet is normally transmitted when requesting the termination of the connection, the caller telephone terminal 280 attempts to terminate the connection once and enters the half-close (CLOSE_WAIT) or retransmission wait (TIME_WAIT) state. Become. During this time, the emergency telephone control unit 137 transmits a “SYN / ACK” packet for requesting an acknowledgment response to the connection request and establishment of the connection to the caller telephone terminal 280 (S22). The calling telephone terminal 280 transmits an “ACK” packet for confirming the response to the emergency telephone control unit 137 (S24). Through the above procedure, the emergency telephone control unit 137 establishes a connection with the caller telephone terminal 280 instead of the callee telephone terminal. This makes it impossible to end the call from the caller telephone terminal 280 and allows the emergency call organization to call the caller via the emergency call control unit 137. Can be satisfied.

  FIG. 66 is a sequence diagram illustrating a procedure of the communication control method according to the embodiment. FIG. 66 shows a procedure in which the communication control system 100 controls a call between the caller telephone terminal 260 or 280 and the emergency call organization 220. When the emergency call control unit 137 establishes a connection with the caller telephone terminal 260 or 280, the emergency call control unit 137 selects an emergency call organization to be connected (S30). In the communication control system 100 shown in FIG. 60, since the caller mobile phone terminal 260 exists within a range of about several hundred meters from the base station apparatus 262, the emergency call control unit 137 is configured to call the callee telephone. Depending on the number, select the emergency call organization that has jurisdiction over the location of your installation location. In communication control system 100 shown in FIG. 61, as will be described later, the position of caller mobile phone terminal 260 is determined by referring to the position information added to communication data by communication control system 100 of base station apparatus 262. Then, an emergency call organization having jurisdiction over the location of the determined mobile phone terminal 260 is selected according to the emergency telephone number of the call destination. In communication control system 100 shown in FIG. 62 or 63, caller IP telephone terminal 280 is referred to by referring to location information added to communication data issued by caller IP telephone terminal 280, as will be described later. And the emergency call organization having jurisdiction over the location of the determined IP telephone terminal 280 is selected according to the emergency telephone number of the call destination. As a result, it is possible to connect to the emergency call organization whose jurisdiction is the location of the caller's telephone terminal, so that the above requirement (1) can be satisfied.

  When the emergency call control unit 137 selects the emergency call organization, it is held in the communication data for calling the telephone terminal of the emergency call organization in the telephone number of the caller's phone terminal and the location information holding unit 138. The added position information is added (S32). At this time, if the location information has already been added by the upstream communication control system 100, the location information may not be added or may be added. In the latter case, it is possible to grasp the communication path from the calling terminal to the emergency call organization. As a result, the telephone number and location information of the reporter can be notified to the emergency call organization, so that the requirement (3) described above can be satisfied.

  The emergency telephone control unit 137 sends the communication data to which the location information is added to the emergency call agency, and calls the telephone terminal of the emergency call agency (S34). The emergency telephone control unit 137 may call the telephone terminal of the emergency call organization using the IP telephone network using the Internet, or the telephone terminal of the emergency call organization using a fixed telephone network or a dedicated line. You may call. When the connection is established with the emergency call organization (S36), the emergency call control unit 137 relays the call between the caller telephone terminal and the emergency call organization and controls the communication (S38). .

  When the emergency call organization issues an end call signal (S40), the emergency call control unit 137 releases the connection with the caller telephone terminal (S42) and opens the connection with the emergency call organization. (S44). Thereby, both connection is cut | disconnected. The emergency telephone control unit 137 does not release the connection with the caller's telephone terminal unless it receives an end call signal from the emergency call agency. Thereby, (2) of the requirements mentioned above can be satisfied.

  A plurality of communication control systems 100 having a position information addition function may be provided on the communication path, and the position information of the communication control system 100 may be added to the communication data every time the communication control system 100 passes. For example, the position information of itself may be added after the position information of the upstream communication control system 100 already added. Thereby, the path | route which the communication data passed can be traced.

  In the embodiment, the information indicating the position of the communication control system 100 held in the position information holding unit 138 is added to the communication data. However, the base station device 262, the control station device 264 provided with the communication control system 100, Identification information such as the router device 282 or 284 may be added, GPS information notified from the caller telephone terminal may be added, or a plurality of communication with the caller telephone terminal may be added. Based on the position information of the base station device 262, the position of the caller telephone terminal may be calculated by triangulation or the like, and the calculated position information may be added.

  As described above, according to the technique according to the present embodiment, the location information of the caller of the emergency call can be accurately notified to the emergency call organization even in the IP phone. In emergency calls, it is very important that the emergency call organization knows the location of the caller accurately. Since the fixed telephone network had all the above-mentioned requirements for emergency calls, any emergency call organization can determine and deal with location information as long as the caller makes a call anyway. In that sense, it had excellent characteristics as a lifeline. When switching from a fixed telephone network to an IP telephone network, there was a great concern that this characteristic would be lost. Even if the caller calms down and cannot accurately tell his / her position, or there is a problem in speaking, or even if the situation falls into a dangerous situation and the voice cannot be spoken well, The location information of the whistleblower is notified to the emergency call organization by making a call, so that appropriate measures can be taken.

  FIG. 67 shows another configuration example of the communication control system according to the embodiment. The communication control system 100 shown in FIG. 67 further includes a reply unit 139 in addition to the configuration of the communication control system 100 shown in FIG. The reply unit 139 returns the communication data to which the location information is added by the emergency telephone control unit 137, which is an example of the location information addition unit, to the caller telephone terminal 260. Other configurations and operations are the same as those of the communication control system 100 shown in FIG.

  FIG. 68 shows a state in which communication data for a telephone terminal to call another telephone terminal is transmitted. Communication data 270 for emergency notification issued by the mobile phone terminal 260 is transmitted to the emergency notification organization 220 via the base station device 262, the control station device 264, and the Internet 200. The communication control system 100a provided in the base station device 262, the communication control system 100b provided in the control station device 264, and the communication control system 100c provided in the communication path by an Internet provider or the like pass the communication data 270. In addition, the emergency telephone control unit 137 adds the position information of the own device to the communication data 270. At this time, if there is position information of the upstream communication control system 100 already added to the communication data 270, the emergency telephone control unit 137 further adds the position information of the own device. For example, the communication data 270 sent from the communication control system 100a of the base station device 262 is added with “Sagagatake 100, Chiyoda-ku, Tokyo”, which is position information of the communication control system 100a. The communication data 270 sent from the communication control system 100c includes the position information of the communication control systems 100a and 100b that have passed so far, as well as the position information of the communication control system 100c, “Sagagatake 300, Chiyoda-ku, Tokyo”. It has been added.

  The control for establishing a connection between the calling terminal and the emergency call organization described above may be executed by any one of the communication control systems 100, and the other communication control systems 100 The position information may be added to the communication data 270 and transmitted.

  At least one of the communication control systems 100a, 100b, and 100c includes a reply unit 139 as shown in FIG. 67, and communication data 270 to which position information of the communication control system 100 that has passed so far is added. Is returned to the caller mobile phone terminal 260. The communication control system located near the caller mobile phone terminal 260, for example, the communication control system 100a of the base station device 262 may return the communication data 270. As a result, it is possible to immediately reply to the caller mobile phone terminal 260, so that the user can immediately grasp the position information of the place where the user is. The communication control system 100c located near the call destination telephone terminal, for example, the telephone terminal of the emergency call organization 220 may return the communication data 270. Thereby, the user can grasp the position information of the nearest emergency call organization 220 from the position where the user is located together with the position where the user is located.

  The emergency telephone control unit 137 may add a zip code, an address, an address code, etc. to the communication data 270 as position information of the own device. These pieces of information may be added to the communication data 270 as character data. As a result, the location information can be provided to the caller user as readable character data, so that the convenience for the user can be improved. Further, the position information may include the number of floors of the building, detailed information on the location, and the like. Thereby, information that cannot be acquired by GPS or the like can be provided to the user, and the convenience of the user can be improved.

  As described above, the communication control device 10 includes the first database 50 functioning as an emergency call agency database storing the telephone numbers of emergency call agencies, and the call destination telephone number included in the communication data is stored in the emergency call agency database. And the search circuit 30 for searching whether or not the telephone number included in the communication data 270 exists in the emergency call institution database. That is, when an emergency call is made, the communication data 270 to which the location information is added may be returned to the caller telephone terminal 260.

  Further, the communication control device 10 is provided with a user database storing the telephone numbers of the telephone terminals of the users who enjoy the service described in the present embodiment, and the calling circuit included in the communication data 270 is retrieved by the search circuit 30. It is possible to search whether or not the telephone number of the telephone terminal exists in the user database, and when it exists, the reply unit 139 may return the communication data 270 to the calling telephone terminal. In this case, if the telephone number of the caller telephone terminal exists in the user database, the communication control apparatus 10 notifies the reply unit 139 that the communication data 270 should be returned, and the reply unit 139 When the notification is received from the control device 10, the communication data 270 is returned. Alternatively, the message output server 130 may be provided with a user database and search circuit 30. With this configuration, this service can be provided to a specific user. Even when a service is provided to a specific user, the communication data 270 may be returned to all users in the case of an emergency call.

  The communication control apparatus 10 according to the present embodiment is a completely transparent communication device that does not have an IP address, and executes the above function without physically receiving communication data. That is, the communication control apparatus 10 captures communication data passing through the network, omits processing necessary for physical incoming calls such as protocol processing, performs the above-described processing, and transmits communication data with location information added to the caller. Reply to The conventional communication device receives and controls the communication data addressed to its own device, but the communication control device 10 according to the present embodiment captures the communication data that is not transmitted to the own device. To control. Accordingly, the communication control device 10 does not require any change in setting or the like due to the provision of the communication control device 10 for the call source and call destination devices and other communication devices provided in the communication path. It is possible to communicate without being conscious of the existence of Therefore, according to the technique of the present embodiment, it is possible to construct a system as described above without greatly modifying the communication system. Moreover, since the communication control apparatus 10 of this Embodiment does not have an IP address, it is not attacked by a malicious hacker etc., and is excellent in security.

(Embodiment 11)
Next, we propose a technique for outputting a message to the access requester. We also propose a business model using this message. Furthermore, we propose a technology that uses this message to take appropriate defenses against malicious attacks.

  As described in the base technology, the communication control apparatus 10 receives the access request packet for the content, determines whether or not the access is permitted, and if the access is prohibited, the communication control apparatus 10 sends an error message or the like to the message output server 130. Directs message output. In the present embodiment, the message output to the access request source by the message output server 130 can be flexibly set for each user of the access request source, for each URL of the access destination, for each category, for each database, etc. It is possible to output an appropriate message accordingly. Not only when access is prohibited, content and a message may be held in association with each other, and a message associated with the content may be output to a user who has transmitted an access request to the content. .

  FIG. 69 shows a configuration of the message output server 130 according to the embodiment. The message output server 130 of the present embodiment includes a message output unit 131, a message holding unit 132, a history holding unit 133, an evaluation unit 134, a registration receiving unit 135, and a charging unit 136.

  The message holding unit 132 holds a message output to the access request source. The message may be set for each user. In this case, the message holding unit 132 stores information for identifying the user in association with the message output to the user or the file name of the file storing the message. The message may be set for each category in the category list, or may be set for each URL to be accessed. For example, the site operator may set advertisement information as a message for each URL. When the message holding unit 132 can set a message according to a plurality of conditions such as for each user or for each URL, information indicating which message is given priority may be further stored.

  The registration accepting unit 135 accepts message registration. When the message can be set for each user, the registration receiving unit 135 receives the message registration from the user and registers the message in the message holding unit 132. In addition, registration of a message may be accepted from a content provider, an advertisement provider, or the like. When charging the registration fee for the message registrant, the registration receiving unit 135 instructs the charging unit 136 to charge the registration fee when receiving registration of the message. The billing unit 136 performs a process of subtracting the registration fee from the registrant's account.

  When the message is set for each access request source user, the message output unit 131 acquires the user ID of the access request source user from the connection management server 120 or the communication control device 10 that processes the access request packet. Then, referring to the message holding unit 132, the message set for the user is output. When the message is set for each URL and category of the access destination, the message output unit 131 acquires the URL or category identification information of the access destination from the communication control device 10, and refers to the message holding unit 132. The message set in the URL or category is output. The message output unit 131 registers the history of outputting the message in the history holding unit 133. In addition, when charging a message registrant or a message recipient for the output of the message, the charging unit 136 is instructed to charge.

  When setting a message for each list in the first database 50, for example, a user who requested access to the URL registered in the virus / phishing site list 161 is "Access is restricted because it is a virus-infected site." The reason why access is prohibited can be output as a message, such as "Access is restricted because it is a phishing site." Also, when a message is set for each category in the common category list 164, for example, the reason for prohibiting access can be output as a message such as “Access is restricted because it is a browsing prohibited category”. . The same applies when a message is set for each URL registered in each list.

  When setting a message for each access requesting user, for example, when the access authority is set according to the job title in a company, a message such as "You do not have authority to access this site" is output. be able to. In addition, when a parent gives a child a mobile phone etc., when the child tries to access an inappropriate site, a message including a link to another healthy or good site is output and the user is directed to the link destination. May be.

  You may set the message containing an advertisement etc. for every category or URL of an access destination. For example, an advertisement related to the content of the site may be included in the message. Thereby, since the advertisement relevant to the site which the user tried to browse can be provided, the advertising effect can be enhanced. Moreover, you may set the message containing an advertisement etc. for every user. For example, the user may set a field of interest, and information such as advertisements belonging to the field may be included in the message.

  The message may include a link to another site. Examples of links to other sites include links to sites that offer advertisements, links to sites related to the content being accessed, links to sites with higher rankings, and secure sites certified by a certificate authority May include a link to For example, when a legitimate site is closed due to hacking, a message including a link to a mirror site may be output to a user who tries to access the site. Further, when the URL of the site is transferred, a message including a link to the URL of the transfer destination may be output to the user who tries to access the URL before the transfer. In addition, the message output unit 131 extracts a list by extracting a highly relevant site, a popular site, a high-quality site, a site authenticated by a certificate authority, etc. from the sites related to the accessed content. It may be created and included in the message.

  The evaluation unit 134 refers to the message output history held in the history holding unit 133 and evaluates the communication status and the status of the access request source. The evaluation unit 134 may statistically process the message transmission history and provide it to a website administrator or the like. Thereby, a user's access history can be utilized for marketing, or it can be utilized for control of a communication situation. Alternatively, the user terminal may be set to periodically send an access request, and a user's action history or the like may be grasped and used by referring to a message transmission history.

  The evaluation unit 134 evaluates that there is a possibility of a denial of service attack (DoS attack) when a large number of access requests are transmitted in a short time from the same request source. The source may be registered in the access denial list, and a packet from the request source may be blocked without being sent to the request destination. At this time, the evaluation unit 134 may confirm that the request source actually exists by using a ping command or the like, and may confirm the state if it exists. When a request source that is sending an unauthorized access request such as a denial of service attack is specified, the message output unit 131 may output a message to the request source. As described above, the communication control apparatus 10 according to the present embodiment is a completely transparent communication apparatus that does not have an OS and a CPU, and does not have an IP address. Conversely, a message can be given to the attacker's device by “bounce” the message from the message output server 130 to the attacker. In this case, since the communication control system 100 rebounds without passing an unauthorized access request, it plays a role like a mirror. A plurality of messages can be sent in response to one access request.

(Embodiment 12)
In the embodiment, a technique for filtering a log output from the communication control apparatus described in the base technology will be described.

  FIG. 70 shows a configuration of the communication control apparatus 10 according to the embodiment. The communication control apparatus 10 according to the present embodiment further includes a log output control apparatus 145 in addition to the configuration of the communication control apparatus 10 according to the base technology shown in FIG. The log output control device 145 includes log output control circuits 141a and 141b, a log output setting unit 142, and a plurality of log output ports 143a to 143f. These configurations may be included in the log management server 140. Other configurations and operations are the same as those of the communication control apparatus 10 according to the base technology.

  The log output control circuit 141 controls output of processing logs in the packet processing circuit 20 of the communication control device 10. The log output control circuit 141 includes a configuration similar to the configuration of the packet processing circuit 20 illustrated in FIG. 4, and a method for outputting a log based on data included in the log output from the packet processing circuit 20. decide. Based on the data included in the log, the log output control circuit 141 determines a port for outputting the log, a log output destination, and the like, and edits and outputs the log if necessary.

  FIG. 71 shows an example of internal data of the first database 50 and the second database 60 provided in the log output control circuit 141. The first database 50 is provided with a source IP address column 71, a destination IP address column 72, a protocol number column 73, and a port number column 74. The second database 60 is provided with a processing column 81, an output port column 82, and an output destination column 83. The search circuit 30 provided in the log output control circuit 141 includes a transmission source IP address, a transmission destination IP address, a protocol included in the log output from the packet processing circuit 20 or the communication data that is the basis of the log. The first database 50 is searched by acquiring the number, port number, and the like. The process execution circuit 40 provided in the log output control circuit 141 acquires the process to be executed, the output port, and the output destination from the second database 60 based on the search result by the search circuit 30 and executes the necessary process. Thereafter, the log is output from the designated log output port 143 to the output destination.

  The log output control circuit 141 may include a plurality of search circuits 30 according to the number of types of data serving as a reference for determining a log output method. For example, as in the example of FIG. 71, when the log output method is determined based on the source IP address, the destination IP address, the protocol number, and the port number, four search circuits 30 are used for each search. And a plurality of types of data can be searched in parallel at the same time. Thereby, log output can be controlled at higher speed. The log output control circuit 141 may be used as a reference for determining a log output method using a MAC address of a transmission source or a transmission destination, a communication status, or any other data or bit existing in communication data alone or in combination.

  Before outputting the log, the log output control circuit 141 compresses or encrypts the log, extracts only predetermined data, deletes predetermined data, adds predetermined data, It may have a function of editing the log by changing the code, changing the MAC address or IP address of the transmission source or transmission destination, or changing the protocol.

  The log output control circuit 141 may collectively output a plurality of logs from the log output port 143. For example, until the log of a predetermined number or a predetermined amount of data is output from the packet processing circuit 20, the output log is held in the temporary memory, and the log accumulated in the temporary memory has a predetermined number or a predetermined amount of data. The log data may be read from the temporary memory and output from the log output port 143 together.

  The log output setting unit 142 sets a log output method by the log output control circuit 141. The log output setting unit 142 switches the log output method by rewriting the first database 50 and the second database 60 provided in the log output control circuit 141. In this embodiment, since the log output control circuit 141a and the log output control circuit 141b are provided as the log output control circuit, the log output setting unit 142 stores the database of one of the log output control circuits 141. The operation can be continued by the other log output control circuit 141 while the log output method is updated by rewriting. The log output setting unit 142 may switch the log output control circuit 141 operated using a chip select signal or the like. As a result, the log output method can be changed without stopping the operation.

  The log output control function of this embodiment may be realized by the message output server 130 described in the base technology. Conversely, the function of the message output server 130 described in the base technology may be realized by the log output control circuit 141 according to the present embodiment. For example, when the packet processing circuit 20 processes communication data intended for a DoS attack, the log output control circuit 141 may return the communication data to the transmission source of the communication data and perform mirroring. Further, the log output port 143 may be used as a spare port for outputting some data from the communication control device 10 to the outside.

  The log output control circuit 141 may determine the log output port 143 to be used according to the usage status of the log output port 143. For example, when a large number of logs to be output from the log output port 143a are output, instead of outputting all of them from the log output port 143a, the logs may be output from another log output port 143 that is not congested. Thereby, the load of the log output port 143 can be distributed and the log can be output efficiently.

  The log output control circuit 141 may further determine the log output port 143 to be used in consideration of the status of the message output server 130. For example, when the message output server 130 needs to output a large number of messages, the message may be received from the message output server 130 and output from the log output port 143. Conversely, when all the log output ports 143 are congested, log data to be output may be sent to the message output server 130 and output from the message output server 130. As described above, the log output control circuit 141 may perform load distribution in cooperation with the message output server 130. As a result, messages and logs can be output more efficiently.

  The log output control circuit 141 may transfer the communication data to another device when the communication data transmission destination device is abnormal and cannot receive the communication data. For example, when the destination SMTP server of the e-mail is down, the communication data of the e-mail addressed to the SMTP server may be transferred to the spool destination device and temporarily spooled. The IP address or MAC address of the device in which an abnormality has occurred and the transfer destination device are transmitted from an external device to the log output setting unit 142 via the packet processing circuit 20 or directly, and the log output setting unit 142 outputs the log. It may be set in the control circuit 141. Thereby, even if it is a case where abnormality has arisen in the apparatus of the transmission destination of communication data, communication data can be controlled appropriately.

(Embodiment 13)
In the embodiment, a technique for distributing the load of a communication data transmission destination device using the function of the message output server 130 described in the base technology will be described.

  FIG. 72 shows a configuration of the message output server 130 according to the embodiment. The message output server 130 of this embodiment includes message output control circuits 171a and 171b, a message output setting unit 172, a plurality of message output ports 173a to 173f, and a load status holding unit 174. The message output server 130 functions as a load distribution device, the message output control circuit 171 functions as a transmission destination control unit and a transmission unit, and the message output setting unit 172 functions as a setting unit.

  FIG. 73 shows an example of internal data of the load status holding unit 174. The load status holding unit 174 is provided with a transmission destination IP address column 91, a group ID column 92, and a load status column 93. When a plurality of devices having the same function such as a mirror server of a web server or a download site are prepared in the load status holding unit 174, these devices are registered as a group. Load status is stored. For example, in the example of FIG. 73, the device with the IP address “xxx.100.0.1”, the device with “xxx.100.0.2”, and the device with “xxx.100.0.3” have the same functions. It is assumed that the same processing is performed no matter which communication data is transmitted to any device. At this time, the IP addresses of these devices are registered in the load status holding unit 174 as a device group of the group ID “1”, and the load status of each device is stored. The load status of each device may be received from each device via the communication control device 10 and automatically stored by the message output setting unit 172, or the load status holding unit 174 can be updated from an external device. You may comprise.

  In the present embodiment, the first database 50 of the communication control apparatus 10 stores the same data as the transmission destination IP address column 91 of the load status holding unit 174 as reference data, and the search circuit 30 It is searched whether or not the transmission destination IP address of the communication data acquired by 10 is registered in the first database 50. When the transmission destination IP address of communication data is registered in the first database 50, the group ID associated with the transmission destination IP address is notified to the message output server 130.

  The message output control circuit 171 reads the load status of the device having the same group ID as the group ID notified from the communication control device 10 from the load status holding unit 174, and depending on the load status of each device, the communication data Determine the destination of. The message output control circuit 171 may transmit communication data to a device with the lowest load, or may determine a transmission destination based on a transmission destination history output from the message output server 130 so far. In addition, the message output control circuit 171 may determine the transmission destination of the communication data according to the time change of the load situation. For example, communication data may be transmitted to a device whose load status is decreasing. The message output control circuit 171 does not select a device in which some abnormality has occurred as a transmission destination.

  The message output control circuit 171 sends communication data to the determined transmission destination device via the message output port 173. When the determined transmission destination device is different from the transmission destination device set in the communication data, the message output control circuit 171 reads the IP address of the newly determined transmission destination device from the load status holding unit 174. The communication data is set to the transmission destination IP address and transmitted. With the technique as described above, it is possible to appropriately distribute the load on the communication data transmission destination device and to efficiently process the communication data.

  The message output control circuit 171 may determine a message output port 173 that outputs communication data from a plurality of message output ports 173 according to a transmission destination device. For example, when each message output port 173 is connected to a different network, an appropriate message output port 173 may be selected according to the IP address of the transmission destination device and the communication data may be transmitted. Thereby, communication data can be appropriately routed.

  The message output control circuit 171 not only changes the transmission destination before outputting communication data, but also changes the transmission source, compresses data, encrypts, extracts only predetermined data, It may have a function of editing communication data by deleting predetermined data, adding predetermined data, changing a character code, or changing a protocol.

  The message output setting unit 172 sets a communication data output method by the message output control circuit 171. The message output setting unit 172 switches an algorithm for determining the transmission destination device or the message output port 173 in the message output control circuit 171. In this embodiment, since the message output control circuit 171a and the message output control circuit 171b are provided as the message output control circuit, the message output setting unit 172 uses the algorithm of one of the message output control circuits 171. Even during the update, the other message output control circuit 171 can continue the operation. The message output setting unit 172 may switch the message output control circuit 171 operated using a chip select signal or the like. Thereby, the communication data output method in the message output control circuit 171 can be changed without stopping the operation.

  The message output control circuit 171 may determine the message output port 173 to be used according to the usage status of the message output port 173. For example, when a large amount of communication data to be transmitted from the message output port 173a is received, instead of outputting all of it from the message output port 173a, it may be output from another message output port 173 that is not congested. As a result, the load on the message output port 173 can be distributed and communication data can be transmitted efficiently.

  The message output control circuit 171 may transfer the communication data to another device when the communication data transmission destination device is abnormal and cannot receive the communication data. For example, when the destination SMTP server of the e-mail is down, the communication data of the e-mail addressed to the SMTP server may be transferred to the spool destination device and temporarily spooled. Thereby, even if it is a case where abnormality has arisen in the apparatus of the transmission destination of communication data, communication data can be controlled appropriately.

  The example in which the message output server 130 functions as a load distribution device has been described above, but the process execution circuit 40 may have a function as a load distribution device. Also in this case, the process execution circuit 40 reads the load statuses of a plurality of devices having the same function as the communication data transmission destination device from the load status holding unit 174, and the transmission destination devices according to the load status of these devices. If necessary, the communication data is transmitted after rewriting the identification information of the destination device.

(Embodiment 14)
In the embodiment, a technique for providing a new service for improving the convenience of an IP telephone user using the function of the message output server 130 described in the base technology will be described. In this embodiment, while the caller telephone terminal is calling the callee telephone terminal, a voice message such as an advertisement previously registered by the user of the callee telephone number is called. A service is proposed that gives a benefit to the user of the caller's telephone terminal on the condition that the user of the caller's telephone terminal hears the advertisement message, transmitted to the original telephone terminal and played back.

  FIG. 74 shows a configuration of the message output server 130 according to the embodiment. The message output server 130 according to the present embodiment includes message output control circuits 171a and 171b, a message output setting unit 172, a plurality of message output ports 173a to 173f, a registration receiving unit 135, and a charging unit 136. The message output control circuits 171a and 171b include the message output unit 131 and the message holding unit 132 of the message output server 130 shown in FIG. Further, the registration receiving unit 135 and the charging unit 136 have the same functions as the registration receiving unit 135 and the charging unit 136 of the message output server 130 shown in FIG. 69, respectively.

  When the communication terminal 10 acquires communication data for calling another telephone terminal, the communication control apparatus 10 sends the communication data to the call destination telephone terminal and sends the communication data to the message output server 130. . The message output control circuit 171 acquires communication data from the communication control device 10 and transmits a voice message to the caller telephone terminal included in the communication data. The message output control circuit 171 includes a configuration similar to the configuration of the packet processing circuit 20 shown in FIG. 4, and outputs a voice message based on the caller or callee telephone number included in the communication data. Decide how to do.

  FIG. 75 shows an example of internal data of the first database 50 and the second database 60 provided in the message output control circuit 171. The first database 50 is provided with a caller telephone number column 94 and a callee telephone number column 95. The second database 60 is provided with an audio file name column 96, a processing column 97, and an output port column 98. Thus, in the first database 50 and the second database 60, the voice file name to be transmitted to the caller telephone terminal in association with the caller telephone number and the callee telephone number, and the process to be executed And a message output port 173 to be output are stored.

  The search circuit 30 provided in the message output control circuit 171 searches the first database 50 for the caller or callee telephone number included in the communication data acquired from the communication control device 10. The process execution circuit 40 provided in the message output control circuit 171 reads and executes the process to be executed from the second database 60 based on the search result by the search circuit 30.

  The process execution circuit 40 reads the file name and output port of the voice message to be transmitted to the caller telephone terminal from the second database 60 and notifies the message output unit 131 of it. The message output unit 131 reads the voice file designated by the processing execution circuit 40 from the message holding unit 132 and sends it from the designated message output port 173 to the caller telephone terminal. When the call source telephone terminal acquires this voice message, it reproduces it while calling the call destination telephone terminal. As a result, the user of the calling telephone terminal can enjoy a voice message such as music or advertisement instead of the conventional ringing tone while calling the calling telephone terminal. When the call destination telephone terminal receives a call and the connection is established, the call source telephone terminal may stop playing the voice message and switch to a normal call, or the voice message finishes playing. You may switch to a normal call after waiting.

  Further, the process execution circuit 40 reads the contents of the process to be executed by the charging unit 136 from the second database 60 and notifies the charging unit 136 of the contents. The charging unit 136 executes a charging process with the content specified by the process execution circuit 40. For example, on the condition that the caller telephone terminal reproduces a voice message, the billing unit 136 grants a profit such as a point grant or a call charge discount to the user of the caller telephone terminal. When the call source telephone terminal reproduces a voice message including a call destination advertisement associated with the call destination telephone number, the billing unit 136 calls the call source telephone terminal and the call destination telephone. You may charge the user of the call destination telephone terminal for the charge of the call with the terminal. The charging unit 136 may execute the above-described processing after receiving a notification that the voice message has been reproduced from the caller telephone terminal, or the caller telephone terminal must reproduce the voice message. If it is, the above processing may be executed without confirming whether or not the voice message has been reproduced.

  The message output setting unit 172 sets a voice message output method by the message output control circuit 171. The message output setting unit 172 switches a voice message output method by updating a database such as the first database 50, the second database 60, or the message holding unit 132 provided in the message output control circuit 171. In this embodiment, since the message output control circuit 171a and the message output control circuit 171b are provided as the message output control circuit, the message output setting unit 172 uses the database of one of the message output control circuits 171 as the database. Even during the update, the other message output control circuit 171 can continue the operation. The message output setting unit 172 may switch the message output control circuit 171 operated using a chip select signal or the like. As a result, the voice message output method in the message output control circuit 171 can be changed without stopping the operation.

  The registration accepting unit 135 accepts registration of a telephone number of a call destination telephone terminal and a voice message to be transmitted to the call origination telephone terminal from an advertiser or an advertising business. The message output setting unit 172 reflects the received data on the message output control circuit 171. When the registration receiving unit 135 receives a voice message from an advertiser or an advertising business, the charging unit 136 may charge the registrant with the advertising cost. The registration accepting unit 135 may accept registration of a voice message such as music. For example, a general user may be able to register music that he / she wants to hear from the user of the telephone terminal that has called his / her telephone terminal. Further, the music distributor may be able to register music to be distributed to the caller's telephone terminal. This makes it possible to provide an attractive service for the user of the caller telephone terminal.

  The message holding unit 132 may store voice messages in a plurality of data formats according to the type of the caller telephone terminal. At this time, the file name of the voice message in the data format corresponding to the specification of the telephone terminal corresponding to the caller telephone number is registered in the voice file name column 96 of the second database 60. As a result, the message output control circuit 171 can read and transmit an appropriate voice message from the message holding unit 132 according to the specification of the caller telephone terminal. In this way, in this embodiment, since the voice message to be transmitted is determined by referring not only to the telephone number of the call destination but also to the telephone number of the call source, the call is made to the same call destination telephone number. Even when a call is made, a different voice message can be transmitted in accordance with the caller's telephone terminal. For example, even if a call is made to the same telephone number, different voice messages are sent to the caller's phone terminal according to attributes such as the age, gender, address, and preferences of the user of the caller's phone terminal. Can do. Thereby, a more flexible and detailed service can be provided.

  The message output control circuit 171 may include a plurality of search circuits 30 according to the number of types of data serving as a reference for determining a voice message output method. For example, as in the example of FIG. 75, when the voice message output method is determined based on the caller telephone number and the callee telephone number, two search circuits 30 are provided for each search. Searches may be executed in parallel at the same time. Thereby, the output of the voice message can be controlled at higher speed. The message output control circuit 171 is used as a reference for determining a method for outputting a voice message by combining a MAC address of a transmission source or a transmission destination, a communication status, or any other data or bit existing in communication data, alone or in combination. Also good.

  The message output control circuit 171 may determine a message output port 173 that outputs a voice message from a plurality of message output ports 173 according to a destination telephone terminal. For example, when each message output port 173 is connected to a different network, an appropriate message output port 173 may be selected according to the IP address of the destination telephone terminal to send a voice message. Thereby, communication data can be appropriately routed.

  The message output control circuit 171 may determine the message output port 173 to be used according to the usage status of the message output port 173. For example, when a large number of voice messages to be transmitted from the message output port 173a are generated, instead of outputting them all from the message output port 173a, they may be output from other message output ports 173 that are not congested. As a result, the load on the message output port 173 can be distributed and the voice message can be transmitted efficiently.

  When the calling telephone terminal is a fixed telephone, the voice message to be transmitted may be supplied from the voice server to the calling telephone terminal as an analog signal.

  According to the technology as described above, a user of a telephone terminal can enjoy a voice message such as music while calling the telephone terminal of the call destination, and can also listen to a voice message such as an advertisement. Benefits such as reduced call charges can be enjoyed. In addition, since the advertiser or the advertising business can provide the advertisement to the user who has called the telephone number of his / her telephone terminal, the advertisement can be efficiently performed. Furthermore, the telecommunications carrier can expect an increase in the number of users by providing an attractive service, and can obtain an advertising revenue from a voice message provider and an increase in a call charge due to an increase in the amount of communication. As described above, the service proposed in the present embodiment is an attractive business model in which all entities related to the service can enjoy the benefits.

  In the above example, the voice message is transmitted to the caller telephone terminal. However, instead of the voice message, content including characters and images may be transmitted to the caller telephone terminal. In this case, the calling telephone terminal displays the transmitted content on the display device of the telephone terminal.

  As the voice message, a response message or the like when the call destination telephone terminal is busy may be registered in the message holding unit 132. In this case, the message output control circuit 171 sends a response message to the caller telephone terminal when communication data including information indicating that the call is busy is returned from the callee telephone terminal. Thereby, even when the call destination telephone terminal is busy and a call is not established, an appropriate response message can be transmitted to the call source telephone terminal.

  In addition, as a voice message, when a large-scale disaster occurs, when the communication line including the IP telephone network is in a congested state, it holds a message that it is difficult to connect, and a guidance message that provides detailed information on the current situation It may be registered in the unit 132. In this case, the message output setting unit 172 registers a guidance message in the message holding unit 132 in association with the telephone number of the telephone terminal that is difficult to make a call, and the message output control circuit 171 calls the telephone number. A guidance message is transmitted to the called telephone terminal. Thus, even when the communication path to the call destination telephone terminal is in a congested state and the call is not established, an appropriate guidance message can be transmitted to the call source telephone terminal.

  Further, an automatic response message from an emergency call organization may be registered in the message holding unit 132 as a voice message. In this case, the message output control circuit 171 sends an automatic response message or the like for explaining an appropriate countermeasure to the reporter when the call destination telephone number is the telephone number of the emergency call organization. Since the whistleblower may have a disability in speaking or listening, an automatic response message explaining, for example, an appropriate operation method of the telephone terminal may be transmitted by text or an image. Thereby, an appropriate response message can be transmitted to the telephone terminal of the caller of the emergency call.

  Thus, according to the technique of the present embodiment, from a public switched telephone network in which a telephone terminal and a switch are directly electrically connected to an IP telephone network in which there is no direct connection between the telephone terminal and the switch. Even after the migration, it is possible to provide a service having a function as a lifeline as described above.

(Embodiment 15)
Next, a technique for realizing bandwidth control in the communication control apparatus 10 described above will be described.

  FIG. 76 shows a configuration of a communication control apparatus according to the embodiment. The communication control apparatus 10 according to the present embodiment further includes a band control circuit 400 in addition to the configuration of the communication control apparatus 10 of the base technology shown in FIG. Other configurations and operations are the same as those of the communication control apparatus 10 shown in FIG.

  The bandwidth control circuit 400 includes a selection circuit 405, a registration unit 410, a class management circuit 420, a management table 430, a communication data registration RAM 440, and a data extraction circuit 450. The communication data output from the packet processing circuit 20 is attached with class information indicating a class of a band for transmitting the communication data. The class information is determined by the packet processing circuit 20 according to the protocol number, port number, transmission source IP address, transmission destination IP address, etc. of the communication data.

  The class-specific management circuit 420 is provided for each class of a band for transmitting communication data, and controls the timing for transmitting the communication data. The management circuit by class 420 acquires communication data belonging to the class that it is in charge of from the communication data output from the packet processing circuit 20 and packetizes it. The class-specific management circuit 420 registers the data length of the packet to be transmitted and the start and end points of the memory area in the communication data registration RAM 440 according to the basic information registered in the management table 430. The class management circuit 420 registers information related to the control performed in the management table 430. The registration unit 410 registers basic information in the management table 430.

  FIG. 77 shows an example of internal data of the management table. The management table 430 includes a class column 431, a sendable bit number column 432, a registered packet number column 433, and an excess bit number column 434. The class column 431 stores a band class. The sendable bit number column 432 stores the number of bits that can be sent per unit time assigned for each class. The registered packet number column 433 stores the amount of packets of communication data registered in the communication data registration RAM 440 as communication data to be transmitted next time by the class management circuit 420. In the example of FIG. 77, the amount of registered packets is stored in the number of bits. The excess bit number column 434 is used when the bit number of communication data registered in the communication data registration RAM 440 by the class management circuit 420 exceeds the number of bits that can be transmitted per unit time registered in the transmittable bit number column 432. The excess number of bits is stored in

  The class-specific management circuit 420 is defined in the sendable bit number column 432 of the management table 430 when a large amount of communication data belonging to the class in charge of the class is generated or a large-capacity file is to be sent. Packets exceeding the number of bits may be registered in the communication data registration RAM 440. However, the class-specific management circuit 420 registers the excess number of bits in the excess bit number column 434 of the management table 430, and communicates a packet with the number of bits obtained by subtracting the excess bit number from the number of transmittable bits after the next time. It is registered in the data registration RAM 440 and the excess is adjusted. Accordingly, it is possible to flexibly adjust the transmission amount of communication data in units of packets while performing appropriate bandwidth control for each class.

  The class-specific management circuit 420 refers to the management table 430 to extract a class whose registered packet number is less than the transmittable bit number when a packet scheduled to be transmitted next exceeds the transmittable bit number, May be requested to send the excess communication data to the class-specific management circuit 420 in charge of. The requested class-specific management circuit 420 accepts transmission of additional communication data within a range that does not exceed the number of bits that can be transmitted, packetizes the communication data, registers it in the communication data registration RAM 440, and registers the number of registered packets in the management table 430. Update column 433. Thereby, even if the class of communication data is biased, it is possible to transmit using the available band, so that the entire band can be used effectively.

  The data extraction circuit 450 extracts a packet registered in the communication data registration RAM 440 at a predetermined timing and transmits it to the network.

  The selection circuit 405 distributes the communication data to the class-specific management circuits 420a to 420d according to the class information of the communication data acquired from the packet processing circuit 20. The selection circuit 405 generates a chip select signal for activating the class management circuit 420 to which communication data should be distributed from the class information notified from the packet processing circuit 20 and supplies the chip select signal to the class management circuit 420. As a result, the class-specific management circuit 420 that should process the communication data can be activated and the communication data can be processed with a simple configuration.

(Embodiment 16)
FIG. 78 shows a configuration of a test apparatus 900 according to the embodiment. The test apparatus 900 includes a generation unit 902, an output unit 904, an input unit 906, and an inspection unit 908. In terms of hardware components, these configurations are realized by a CPU of a computer, a memory, a program loaded in the memory, and the like, but here, functional blocks realized by their cooperation are illustrated. Accordingly, those skilled in the art will understand that these functional blocks can be realized in various forms by hardware only, software only, or a combination thereof.

  The generation unit 902 generates test data to be output to the communication control apparatus 10 and answer data to be output from the process execution circuit 40 when the process execution circuit 40 of the communication control apparatus 10 has processed the test data normally. . For example, in the case of the communication control apparatus 10 for performing packet filtering, the generation unit 902 generates test data in which a packet to be passed and a packet to be blocked are mixed, and includes a packet to be blocked and includes a packet to be blocked. Generate answer data that does not contain. When the communication control apparatus 10 performs processing for converting data included in a packet using a predetermined algorithm, the generation unit 902 generates a sample of the packet to be communicated as test data, and converts the data included in the packet into a predetermined data The answer data converted by the algorithm is generated.

  The generation unit 902 may generate test data and answer data in advance and store them in a storage device such as a hard disk device or a memory. In this case, when the test is started, the generation unit 902 reads the test data from the storage device and sends it to the output unit 904, and reads the answer data from the storage device and sends it to the inspection unit 908. The output unit 904 may read test data directly from the storage device. Further, the inspection unit 908 may read the answer data directly from the storage device.

  The test data and answer data may be generated by another device and input to the test device 900. In this case, the test apparatus 900 includes a configuration for acquiring test data and answer data from another apparatus instead of the generation unit 902.

  The output unit 904 outputs test data to the communication control device 10. The input unit 906 inputs result data output from the communication control device 10. The inspection unit 908 compares the answer data generated by the generation unit 902 and the result data input by the input unit 906 in order from the top of both data, thereby determining whether the communication control device 10 is operating normally. Inspect.

  FIG. 79 shows the configuration of the inspection unit 908. As in the binary search circuit 36 shown in FIG. 12, the inspection unit 908 includes a plurality of comparators 920a that compare the answer data 910 generated by the generation unit 902 and the result data 912 input by the input unit 906 in bit units. 920b,... Are provided. The plurality of comparators 920a, 920b,... May be capable of performing a plurality of comparisons in parallel. As a result, a large number of data can be compared at high speed, and the time required for the test can be greatly reduced. In addition, the capacity of the buffer that temporarily stores the answer data 910 and the result data 912 to be compared can be reduced.

  In the communication control apparatus 10 described in the base technology, the packet processing circuit 20 including the search circuit 30 is configured by a wired logic circuit, and a position detection circuit 32 for detecting data to be compared at high speed, a high speed Since the index circuit 34 and the binary search circuit 36 for realizing the binary search are provided, very high-speed processing is possible. When testing such a communication control apparatus 10, it is preferable that the test apparatus 900 can also operate at high speed. As described above, according to the test apparatus 900 of the present embodiment, it is possible to realize a high-speed test suitable for the communication control apparatus 10 that operates at high speed.

  The determination circuit 922 acquires a comparison result from the plurality of comparators 920a, 920b,..., And determines whether the answer data 910 and the result data 912 match. If the answer data 910 and the result data 912 do not match, the notification unit 930 notifies the fact that an error has occurred by displaying an error message on the display device 932 or outputting an alarm sound from the speaker 934. . The log recording unit 940 records the content of the error in an error log held in the log holding unit 942. The error log may include the position of data in which an error has occurred, answer data at that time, output data, and the like. The notification unit 930 may print an error message on a printing device (not shown). Further, the log recording unit 940 may print the error log on a printing device (not shown).

  FIG. 80 shows another configuration example of the test apparatus according to the embodiment. In the example shown in FIG. 78, the generation unit 902, the output unit 904, the input unit 906, and the inspection unit 908 are provided in the same test apparatus 900. However, in the example shown in FIG. The test apparatus 900a on the input side includes a generation unit 902, output units 904a and 904b, and the test apparatus 900b on the output side of the communication control apparatus 10 includes input units 906a and 906b and an inspection unit 908.

  The output unit 904 a outputs the test data generated by the generation unit 902 to the communication control device 10. The output unit 904b outputs the answer data generated by the generation unit 902 to the test apparatus 900b. The input unit 906a inputs the result data output from the communication control device 10. The input unit 906b inputs the answer data output from the output unit 904b. Other configurations and operations are the same as those of the example shown in FIG.

  The inspection unit 908 may estimate the processing time in the communication control device 10 by measuring the difference between the time when the input unit 906a inputs data and the time when the input unit 906b inputs corresponding data. In this case, in order to more accurately measure the throughput of the communication control device 10, a communication path from the output unit 904a to the input unit 906a via the communication control device 10, and a communication path from the output unit 904b to the input unit 906b It is preferable to have the same communication capability.

  FIG. 81 shows still another configuration example of the test apparatus according to the embodiment. In the example shown in FIG. 81, two systems of data are output from the communication control device 10. For example, in the communication control apparatus 10 that performs packet filtering, a system in which a packet to be passed is output and a system in which an error message is output for a packet to be blocked are prepared. In this case, test devices 900 b and 900 c are provided for each of the two systems of data output from the communication control device 10. The output unit 904b of the test apparatus 900a outputs answer data of two systems to each of the test apparatuses 900b and 900c. The input unit 906a of the test apparatus 900b inputs result data of one system output from the communication control apparatus 10, and the input unit 906b inputs answer data of that system. The input unit 906c of the test apparatus 900c inputs the result data of the other system output from the communication control apparatus 10, and the input unit 906d inputs the answer data of that system. When three or more systems of data are output from the communication control device 10, the test device 900 may be provided accordingly.

  FIG. 82 shows still another configuration example of the test apparatus according to the embodiment. In the example shown in FIG. 81, the test apparatus 900b and the test apparatus 900c are provided separately. However, in the example shown in FIG. 82, the same test apparatus 900d has two systems of data output from the communication control apparatus 10. Inspect. The test apparatus 900d includes input units 906a and 906c for inputting two systems of data output from the communication control apparatus 10, and further includes two systems output from the output unit 904b of the test apparatus 900a. Input unit 906b for inputting the answer data. The inspection unit 908 may include two comparison circuits 920 that compare the result data and answer data of the two systems, or time-divide the same comparison circuit 920 to obtain the result data and answer data of the two systems. You may compare.

  FIG. 83 shows still another configuration example of the test apparatus according to the embodiment. In the example of FIG. 83, a test apparatus 900c that tests the message output server 130 that outputs a message or the like based on a signal output from the communication control apparatus 10 is provided. In this case, the generation unit 902 of the test apparatus 900a further generates answer data to be output by the message output server 130 in response to the data output to the communication control apparatus 10, and the output unit 904c outputs the generated answer data. Output to the test apparatus 900c. The input unit 906c of the test apparatus 900c inputs the result data output from the message output server 130, and the input unit 906d inputs the answer data output from the output unit 904c. The inspection unit 908c compares the result data input by the input unit 906c with the answer data input by the input unit 906d to inspect whether the message output server 130 is operating normally. As a result, not only the communication control device 10 but also the entire communication control system 100 including peripheral devices of the communication control device 10 can be tested simultaneously.

  FIG. 84 shows still another configuration example of the test apparatus according to the embodiment. 84 includes an update unit 952 and a difference generation unit 954 in addition to the configuration of the test apparatus 900 shown in FIG. Further, a holding unit 950 is provided instead of the generation unit 902. Other configurations and operations are the same as those of the test apparatus 900 shown in FIG.

  The holding unit 950 is output from the process execution circuit 40 when the process execution circuit 40 of the communication control apparatus 10 has successfully processed the test data output to the communication control apparatus 10 and the test data output to the communication control apparatus 10. Corresponding and holding power answer data. The test data and answer data may be generated by the generation unit 902 and stored in the holding unit 950, or may be provided from another device.

  When the database server 150 updates the first database 50 or the second database 60 of the communication control device 10, the difference generation unit 954 calculates the difference between the database before being updated and the database after being updated. Generate. The difference generation unit 954 may acquire the database before update and the database after update from the database server 150 and generate a difference between them. Further, the difference generated in the database server 150 may be acquired. The difference generation unit 954 notifies the update unit 952 and the output unit 904 of the difference between the databases before and after the update.

  When the first database 50 or the second database 60 of the communication control apparatus 10 is updated, the update unit 952 updates the data held in the holding unit 950 along with the database update. The update unit 952 may acquire the difference between the databases before and after the update from the difference generation unit 954 and generate test data and answer data related to the updated record. Moreover, you may acquire the test data and answer data produced | generated in the other apparatus. The update unit 952 stores the newly generated test data and answer data in the holding unit 950. The update unit 952 notifies the output unit 904 of the updated test data and answer data records.

  The output unit 904 selects the test data of the record updated by the update unit 952 from the data held in the holding unit 950 and outputs the selected test data to the communication control apparatus 10. The output unit 904 selects the test data including the reference data stored in the difference records in the database before and after the update generated by the difference generation unit 954 from the data held in the holding unit 950 and selects the communication control device 10. May be output. Thereby, only the test regarding the record updated in the database can be selectively performed, so that the efficiency of the test can be improved. In addition, since the updated record can be focused on, the accuracy of the test can be improved.

  When the communication control apparatus 10 has a function of returning response data to the transmission source of communication data using a protocol such as ICMP (Internet Control Message Protocol), the test apparatus 900 returns the response data. Response data may be tested. In this case, the holding unit 950 further holds response data to be returned by the communication control apparatus 10 with respect to the data output to the communication control apparatus 10. The input unit 906 further inputs response data returned from the communication control device 10 in response to the data output to the communication control device 10. The input unit 906 may input response data from the same port as the port from which the output unit 904 outputs test data to the communication control apparatus 10. The inspection unit 908 further inspects whether or not the response data is normally returned by comparing the response data returned from the communication control device 10 with the response data held in the holding unit 950.

  As described in the base technology, when the communication control apparatus 10 has a function of transmitting a message to a predetermined destination when controlling communication data, the test apparatus 900 tests a message transmitted by the communication control apparatus 10. May be. In this case, the holding unit 950 further holds a message to be transmitted by the communication control apparatus 10 with respect to the data output to the communication control apparatus 10. The input unit 906 further inputs a message transmitted from the communication control apparatus 10 with respect to the data output to the communication control apparatus 10. The input unit 906 may have a message input port for receiving a message transmitted from the message output port 21 of the communication control device 10. The input unit 906 may receive a message transmitted from the message output server 130. The inspecting unit 908 further inspects whether the message is normally transmitted by comparing the message transmitted from the communication control device 10 with the message retained in the retaining unit 950.

  As described in the base technology, when the communication control apparatus 10 has a function of outputting a log when controlling communication data, the test apparatus 900 may test the log output by the communication control apparatus 10. . In this case, the holding unit 950 further holds a log to be output by the communication control apparatus 10 with respect to data output to the communication control apparatus 10. The input unit 906 further inputs a log output from the communication control apparatus 10 with respect to the data output to the communication control apparatus 10. The input unit 906 may have a log input port for inputting a log output from the log output port 22 of the communication control apparatus 10. The input unit 906 may input a log output from the log management server 140. The inspection unit 908 further inspects whether the log is normally output by comparing the log output from the communication control device 10 with the log stored in the storage unit 950.

  Even if the communication control device 10 has a function of outputting response data, a message, a log, and the like in addition to the communication data, whether or not those functions are operating normally by the above technique. Can be tested simultaneously.

  The communication control apparatus 10 according to the present embodiment is a completely transparent communication device that does not have an IP address, and executes the above function without physically receiving communication data. That is, the communication control apparatus 10 captures communication data passing through the network, omits processing required for physical incoming calls such as protocol processing, performs the above-described processing, and retransmits the communication data to the network according to a predetermined condition. Put out. The conventional communication device receives and controls the communication data addressed to its own device, but the communication control device 10 according to the present embodiment captures the communication data that is not transmitted to the own device. To control. Therefore, the source and destination devices and the other communication devices provided in the communication path do not require any change in settings or the like due to the provision of the communication control device 10, and the presence of the communication control device 10 exists. It is possible to communicate without being conscious of Therefore, according to the technique of the present embodiment, the above-described communication control can be performed without greatly modifying the communication system. Moreover, since the communication control apparatus 10 of this Embodiment does not have an IP address, it is not attacked by a malicious hacker etc., and is excellent in security.

(Embodiment 17)
In the present embodiment, a technique for converting a network address and a port number assigned to a communication device using the communication control device 10 described above will be described.

  FIG. 85 shows the configuration of the communication control system according to the present embodiment. In the communication control system, the communication control device 10 is provided on a communication path between the Internet 890 which is an example of a first network and a LAN 892 which is an example of a second network. The first database 50 of the communication control device 10 includes a private IP address assigned to the communication device for communication on the LAN 892, a global IP address assigned to the communication device for communication on the Internet 890, and UDP or TCP. Stored in association with the port number.

  The search circuit 30 acquires communication data transmitted / received between the Internet 890 and the LAN 892 and searches the first database 50 for the IP address of the transmission source or destination of the communication data. If the transmission source IP address of the communication data transmitted from the LAN 892 to the Internet 890 is the private IP address of the communication device, the processing execution circuit 40 sets the transmission source IP address to the global IP address to be assigned to the communication device. At the same time, the port number assigned to the communication device is stored in the UDP or TCP port number. If the destination IP address of the communication data transmitted from the Internet 890 to the LAN 892 is a global IP address assigned to the communication device, the destination communication device is further identified by referring to the port number and transmitted. The previous IP address is converted into a private IP address assigned to the communication device. As a result, a communication device to which a private IP address is assigned can perform communication via the Internet 890.

  The first database 50 stores the IPv4 IP address and the IPv6 IP address assigned to the same communication device in association with each other, and the processing execution circuit 40 converts the IP address between them. Good. In this case, when the IPv4 IP address is included in the communication data transmitted from the IPv4 network to the IPv6 network, the process execution circuit 40 converts the IPv4 IP address into the IPv6 IP address. When the IPv6 IP address is included in the communication data transmitted from the IPv6 network to the IPv4 network, the processing execution circuit 40 converts the IPv6 IP address into an IPv4 IP address.

  According to the technique of the present embodiment, the network address and port number of the communication device can be converted appropriately and at high speed.

  The present invention has been described based on the embodiments. This embodiment is an exemplification, and it will be understood by those skilled in the art that various modifications can be made to combinations of the respective constituent elements and processing processes, and such modifications are also within the scope of the present invention. is there.

It is a figure which shows the structure of the communication control system which concerns on a premise technique. It is a figure which shows the structure of the conventional communication control apparatus. It is a figure which shows the structure of the communication control apparatus which concerns on a premise technique. It is a figure which shows the structure of a packet processing circuit. It is a figure which shows the structure of a position detection circuit. It is a figure which shows another example of a position detection circuit. It is a figure which shows another example of a position detection circuit. It is a figure which shows the example of the internal data of a 1st database. It is a figure which shows another example of the internal data of a 1st database. It is a figure which shows another example of the internal data of a 1st database. It is a figure which shows another example of an index circuit. It is a figure which shows the structure of the comparison circuit contained in a binary search circuit. It is a figure which shows the structure of a binary search circuit. It is a figure which shows another example of the internal data of a 1st database. It is a figure which shows the example of the internal data of a 2nd database. It is a figure which shows another example of the internal data of a 2nd database. It is a figure which shows another structural example of the communication control apparatus which concerns on a premise technique. It is a figure which shows the structure of the communication control apparatus containing a some communication control apparatus. It is a figure which shows the example of the internal data of the management table provided in the operation | use monitoring server. It is a figure for demonstrating the operation method when a communication control apparatus fails. FIGS. 21A, 21B, and 21C are diagrams for explaining a method of updating the database of the communication control device. It is a figure which shows the structure of the communication path control apparatus provided in order to process a packet with a some communication control apparatus. It is a figure which shows the internal structure of the packet processing circuit for URL filtering. FIG. 24A is a diagram showing an example of internal data of a virus / phishing site list, FIG. 24B is a diagram showing an example of internal data of a white list, and FIG. It is a figure which shows the example of the internal data of a black list. It is a figure which shows the example of the internal data of a common category list | wrist. FIGS. 26A, 26B, 26C, and 26D are diagrams showing examples of internal data of the second database. It is a figure which shows the priority of a virus / phishing site list, a white list, a black list, and a common category list. It is a figure which shows the example of arrangement | positioning of a communication control system. It is a figure which shows the example of arrangement | positioning of a communication control system. It is a figure which shows the example of arrangement | positioning of a communication control system. It is a figure which shows the example of arrangement | positioning of a communication control system. It is a figure which shows the example of arrangement | positioning of a communication control system. It is a figure which shows the example of arrangement | positioning of a communication control system. It is a figure which shows the structure of the communication control apparatus which concerns on embodiment. It is a conceptual diagram for demonstrating the communication control technique which concerns on embodiment. It is a figure which shows another structural example of the communication control apparatus which concerns on embodiment. It is a conceptual diagram for demonstrating the communication control technique which concerns on embodiment. It is a figure which shows the structure of the packet processing circuit which concerns on embodiment. It is a figure which shows the example of the communication data which the communication control apparatus acquired. It is a figure which shows the example of the flowchart for determining the process which should be performed in a communication control apparatus. It is a figure for demonstrating the determination method which concerns on embodiment. It is a figure which shows the example of the internal data of the 1st database and 2nd database which concern on embodiment. It is a figure which shows another example of the internal data of the 1st database and 2nd database which concern on embodiment. It is a figure for demonstrating another example of the determination method which concerns on embodiment. It is a figure which shows another example of the internal data of the 1st database and 2nd database which concern on embodiment. It is a figure which shows another structural example of the packet processing circuit which concerns on embodiment. It is a figure for demonstrating another example of the determination method which concerns on embodiment. It is a figure which shows another structural example of the packet processing circuit which concerns on embodiment. It is a figure which shows the structure of the detection circuit which concerns on embodiment. It is a figure which shows the structure of the packet processing circuit of the communication control apparatus which concerns on embodiment. It is a figure which shows the example of the internal data of a user database. It is a figure which shows the structure of the communication management system which concerns on embodiment. It is a figure which shows the structure of the packet processing circuit which concerns on embodiment. It is a figure which shows another structural example of a binary search circuit. It is a figure which shows another example of a structure of a binary search circuit. It is a figure which shows the structure of the packet processing circuit of the communication control apparatus which concerns on embodiment. It is a figure which shows the example of the internal data of a user database. It is a figure which shows the structure of the packet processing circuit which concerns on embodiment. It is a figure which shows the structure of the communication control system which concerns on embodiment. It is a figure which shows the example of arrangement | positioning of a communication control system. It is a figure which shows the example of arrangement | positioning of a communication control system. It is a figure which shows the example of arrangement | positioning of a communication control system. It is a figure which shows the example of arrangement | positioning of a communication control system. It is a figure which shows the structure of the communication control system which concerns on embodiment. It is a sequence diagram which shows the procedure of the communication control method which concerns on embodiment. It is a sequence diagram which shows the procedure of the communication control method which concerns on embodiment. It is a figure which shows another structural example of the communication control system which concerns on embodiment. It is a figure which shows a mode that the communication data for a telephone terminal to call another telephone terminal is transmitted. It is a figure which shows the structure of the message output server which concerns on embodiment. It is a figure which shows the structure of the communication control apparatus which concerns on embodiment. It is a figure which shows the example of the internal data of the 1st database with which the log output control circuit was equipped, and the 2nd database. It is a figure which shows the structure of the message output server which concerns on embodiment. It is a figure which shows the example of the internal data of a load condition holding | maintenance part. It is a figure which shows the structure of the message output server which concerns on embodiment. It is a figure which shows the example of the internal data of the 1st database with which the message output control circuit was equipped, and the 2nd database. It is a figure which shows the structure of the communication control apparatus which concerns on embodiment. It is a figure which shows the example of the internal data of a management table. It is a figure which shows the structure of the test apparatus which concerns on embodiment. It is a figure which shows the structure of a test | inspection part. It is a figure which shows another structural example of the test apparatus which concerns on embodiment. It is a figure which shows another example of a structure of the test apparatus which concerns on embodiment. It is a figure which shows another example of a structure of the test apparatus which concerns on embodiment. It is a figure which shows another example of a structure of the test apparatus which concerns on embodiment. It is a figure which shows another example of a structure of the test apparatus which concerns on embodiment. It is a figure which shows the structure of a communication control system.

Explanation of symbols

  DESCRIPTION OF SYMBOLS 10 Communication control apparatus, 12 Communication control unit, 14 Switching control part, 20 Packet processing circuit, 30 Search circuit, 32 Position detection circuit, 33 Comparison circuit, 34 Index circuit, 35 Comparison circuit, 36 Binary search circuit, 36A-36O Comparison Circuit, 36Z control circuit, 37 negation circuit, 38A, 38B exclusive OR circuit, 40 processing execution circuit, 42 editing unit, 44 replication unit, 46 storage device, 50 first database, 60 second database, 100 communication control system 110 operation monitoring server, 120 connection management server, 130 message output server, 131 message output unit, 132 message holding unit, 133 history holding unit, 134 evaluation unit, 135 registration reception unit, 136 billing unit, 137 emergency telephone control unit, 138 Position information holding unit, 1 39 Reply unit, 140 Log management server, 141 Log output control circuit, 142 Log output setting unit, 143 Log output port, 145 Log output control device, 150 Database server, 160 URL database, 161 Virus / phishing site list, 162 White list 163, black list, 164 common category list, 171 message output control circuit, 172 message output setting unit, 173 message output port, 174 load status holding unit, 180 switching unit, 181 URL filtering database, 182 spam mail filtering database, 183 P2P bandwidth control database, 190 communication path control device, 201 detection circuit, 202 input unit, 204 counter circuit, 206 notification unit, 210 Telephone terminal, 220 Emergency call organization, 260 Mobile phone terminal, 262 Base station device, 264 Control station device, 272 Access point, 274, 282, 284 Router device, 280 IP phone terminal, 290 PC, 300 Comparison target extraction circuit, 310 Communication data, 320 Comparison target data, 330 Comparison target setting circuit, 340 Notification circuit, 380 Mask circuit, 382 Work memory, 400 Band control circuit, 405 Selection circuit, 410 Registration unit, 420 Management circuit by class, 430 Management table, 440 Communication data registration RAM, 450 data extraction circuit, 460 user database update unit, 502 communication device, 504 communication device, 510 determination unit, 520 virtual communication device, 600 communication management system, 610 user terminal, 620 bot, 622 NET, 632 normal signature list, 634 abnormal signature list, 636 rule database, 640 operator terminal, 642 warning acquisition unit, 644 communication data acquisition unit, 646 analysis unit, 648 determination result acquisition unit, 652 normal signature list update unit, 654 Abnormal Signature List Update Unit, 656 Rule Database Update Unit, 662 Normal Signature List, 664 Abnormal Signature List, 666 Rule Database, 690 Internet, 900 Test Device, 902 Generation Unit, 904 Output Unit, 906 Input Unit, 908 Inspection Unit, 920 Comparison circuit, 922 determination circuit, 930 notification unit, 932 display device, 934 speaker, 940 log recording unit, 942 log holding unit, 950 holding unit, 952 updating unit, 954 difference generation unit.

Claims (1)

A user ID of the user, a first IP address assigned to the communication device for communication in the first network, a second IP address assigned to the communication device for communication in the second network, and A database that stores port numbers in association with each other;
A user database that stores a user ID and an IP address assigned to the user's terminal in association with each other;
User database update that acquires a user ID of the terminal and an IP address assigned to the terminal from a server that dynamically assigns an IP address to a terminal connected to the Internet, and registers them in the user database in association with each other And
When acquiring communication data, a user identification unit that searches the user database for an IP address of a transmission source or a transmission destination of the communication data and acquires a user ID corresponding to the corresponding IP address;
A search unit that searches the database for a transmission source or transmission destination IP address of the acquired communication data with reference to a record corresponding to the user ID acquired by the user identification unit in the database,
When the transmission source IP address of the communication data transmitted from the first network to the second network is the first IP address of the communication device, the transmission source IP address is assigned to the communication device. The port number assigned to the communication device is stored in the port number, and the destination IP of the communication data transmitted from the second network to the first network is stored in the port number. If the address is the second IP address of the communication device, the communication device is further identified with reference to the port number, and the destination IP address is converted to the first IP address assigned to the communication device A processing execution circuit to
A network address port conversion device comprising:

Images