JP2017139735A - Communication apparatus, communication control method, and program - Google Patents

Abstract

PROBLEM TO BE SOLVED: To provide a communication apparatus, a communication control method and a program that allow a user to reduce the amount of data caused by unintended data communication.SOLUTION: A communication apparatus prohibits data communication by default, receives a request for data communication from an application, and permits the requesting application to perform data communication in accordance with a UID of the application.SELECTED DRAWING: Figure 1

Description

  The present invention relates to a communication device, a communication control method, and a program.

  Conventionally, a communication device such as a portable terminal capable of data communication is known (for example, see Patent Document 1). The communication device may employ a configuration in which data communication by an application running on the communication device is permitted by default, but only data communication by an application selected by the user is prohibited. In this case, the user can suppress data communication by the application within a range that the user can grasp.

JP, 2015-162701, A

  However, the user may not be able to completely grasp what application is running in the communication device. In particular, there is a high possibility that an application running in the background of the communication device system is not grasped by the user. Therefore, even if the data communication prohibition is selected if the operation is grasped by the user, the application data communication prohibition may not be selected because the user does not grasp the operation. In addition, for data communication performed by the communication device system, the user may not be able to select the communication device system specification in the first place. In these cases, data communication unintended by the user may be performed, and the amount of data communicated may increase unintentionally.

  Therefore, the present invention has been made in view of the above points, and an object thereof is to provide a communication device, a communication control method, and a program that can reduce the amount of data generated by data communication not intended by the user.

A communication device according to an embodiment of the present invention that achieves the above object is as follows.
Data communication is prohibited by default,
Receives a data communication request from the application,
Data communication of the application is permitted according to the requested UID of the application.

  Further, when the data communication is cellular communication, data communication may be prohibited by default.

  Further, when the data communication is wireless LAN communication, data communication may be permitted by default.

In addition, a communication control method according to an embodiment of the present invention includes:
In the communication device,
A step of prohibiting data communication by default;
Receiving a data communication request from the application;
Allowing data communication of the application according to the requested UID of the application.

In addition, a program according to an embodiment of the present invention is
To a computer that functions as a communication device,
A step of prohibiting data communication by default;
Receiving a data communication request from the application;
A step of permitting data communication of the application according to the requested UID of the application.

  According to the communication device, the communication control method, and the program according to the embodiment of the present invention, it is possible to reduce the amount of data generated by data communication not intended by the user.

2 is a functional block diagram illustrating a schematic configuration example of a communication apparatus according to Embodiment 1. FIG. 1 is a diagram illustrating an appearance of an example of a communication device according to Embodiment 1. FIG. 3 is a block diagram illustrating an example of a data flow according to Embodiment 1. FIG. It is a figure explaining the sequence of the filtering process which concerns on Embodiment 1. FIG. It is a figure explaining an example of the sequence which transmits data from an application. 6 is a diagram illustrating a filtering process sequence according to a comparative example of Embodiment 1. FIG. 6 is a block diagram illustrating an example of a data flow according to Embodiment 2. FIG. FIG. 10 is a functional block diagram illustrating a schematic configuration example of a communication device according to a third embodiment. 10 is a block diagram illustrating an example of a data flow according to Embodiment 3. FIG. It is a flowchart which shows the operation example of a connection function part. It is a flowchart which shows the operation example of a connection function part. 10 is a diagram illustrating a data flow according to Comparative Example 1 of Embodiment 3. FIG. 10 is a diagram illustrating a data flow according to Comparative Example 2 of Embodiment 3. FIG.

(Embodiment 1)
Hereinafter, a communication device according to an embodiment will be described in detail with reference to the drawings. The communication apparatus according to the present embodiment can be a mobile device such as a mobile phone or a smartphone. However, the communication device according to the present embodiment is not limited to a portable device, and performs data communication such as a desktop PC, a notebook PC, a tablet PC, a home appliance, an industrial device (FA device), a dedicated terminal, and the like. Various electronic devices can be provided.

[Device configuration]
FIG. 1 is a functional block diagram illustrating a schematic configuration example of the communication device 1 according to the present embodiment. As illustrated in FIG. 1, the communication device 1 includes a control unit 10, a communication unit 11, a storage unit 12, a display unit 13, and an operation unit 14. The control part 10 is connected to the communication part 11, the memory | storage part 12, the display part 13, and the operation part 14, and controls these.

  The control unit 10 can be configured by an operating system (hereinafter also referred to as an OS) and a processor or a microcomputer that can execute application software (hereinafter also referred to as an application). The OS is, for example, Android (registered trademark). The application will be described later.

  The communication unit 11 includes an I / F (interface) device 111 as a communication interface for performing cellular communication, wireless LAN communication, or the like. The I / F device 111 includes a modem 112 and a wireless LAN device 113. The communication unit 11 is connected to a network side such as the Internet using the I / F device 111, and performs data communication with the network side. As a result, the communication device 1 can perform data communication with the network side. The communication unit 11 is connected to the control unit 10 and acquires data to be output to the network side from the control unit 10. The control unit 10 selects data to be output to the communication unit 11 by filtering processing. The filtering process will be described later. Further, the control unit 10 acquires data received from the network side from the communication unit 11.

  When connected to the network side by the cellular communication method, a charge system based on a pay-per-use system is generally adopted in which a communication fee increases in accordance with an increase in the amount of data (packets) to be communicated. On the other hand, when connected to the network side by a method such as wireless LAN communication, it is generally not such a fee structure.

  The storage unit 12 can be configured by, for example, a semiconductor memory. The storage unit 12 stores various information or data, or a program such as an OS or application executed by the control unit 10. The control unit 10 acquires and executes a program stored in the storage unit 12. The control unit 10 stores data generated by executing the program in the storage unit 12. The storage unit 12 can also function as a work memory.

  The display unit 13 displays characters, images, operation objects, pointers, and the like based on information acquired from the control unit 10. The display unit 13 is, for example, a display device such as a liquid crystal display, an organic EL display, or an inorganic EL display, but is not limited thereto.

  The operation unit 14 includes a physical key such as a numeric keypad, a touch pad, or a touch panel. The control unit 10 moves a pointer or the like displayed on the display unit 13 or selects an operation object according to the input content acquired from the operation unit 14.

  FIG. 2 is a diagram illustrating an appearance of an example of the communication device 1 according to the present embodiment. As shown in FIG. 2, the communication device 1 according to the present embodiment is a so-called folding (flip type or clamshell type) feature phone. In the communication device 1, the upper housing 2 and the lower housing 3 are connected by a hinge portion 4 so as to be rotatable. The upper housing 2 includes a display unit 13, and the lower housing 3 includes an operation unit 14. The operation unit 14 includes a touch pad 141 in a portion where no physical key is provided in addition to a physical key such as a numeric keypad. For example, the communication device 1 accepts an operation for selecting an operation object using a physical key, and accepts a movement operation such as a pointer using a touch pad 141.

[application]
The application is installed in the communication device 1 so as to be executable by the control unit 10 and stored in the storage unit 12. When an application is installed in the communication device 1, a unique user identifier (hereinafter also referred to as UID) is assigned to each application. The application is executed by the control unit 10 as a process associated with the UID on the OS.

  When the application is executed by the control unit 10, the application accesses a resource such as a file system. When each application accesses a resource indefinitely, the use area of the resource by each application may overlap, and in this case, the application may not be executed normally. Therefore, access to resources is restricted by a UID associated with a process executed on the OS so that resource usage by applications does not affect each other. That is, the resources accessible from each process are limited to the resources of processes associated with the same UID.

  Each application may be further assigned a group identifier (hereinafter also referred to as GID or group ID). The GID specifies a group to which a unique UID assigned to each application belongs. Only one UID may belong to one group, or a plurality of UIDs may belong to one group. When an application is executed as a process associated with a UID, this process may be associated with a GID. Further, the resources accessible from each process may be limited by extending the target to the resources of the processes associated with the same GID as well as the same UID.

  The application is executed in the foreground (hereinafter also referred to as FG) or the background (hereinafter also referred to as BG). The state in which the application is being executed by the FG is, for example, a state in which the execution status is displayed on the display unit 13 so that the user can confirm, or the user can operate using the operation unit 14. The state in which the application is being executed by the BG is, for example, a state in which the execution status is not displayed on the display unit 13 and the user cannot operate, or the user is operating unintentionally.

[Data communication control]
An application executed by the control unit 10 uses the communication unit 11 to perform data communication with a network side such as the Internet. As described above, the application is executed as a process associated with the UID on the OS. A UID is associated with data transmitted from the application. The control unit 10 determines whether to permit or prohibit (restrict) data transmission based on the UID associated with the data, thereby permitting or prohibiting data communication related to data transmitted from each application. You can control. Hereinafter, in the description according to the present embodiment, data communication refers to data communication performed in principle by the communication unit 11 with the network side.

  FIG. 3 is a block diagram illustrating an example of a data flow according to the present embodiment. In FIG. 3, a control unit 10 and a communication unit 11 are provided on the terminal side. Then, the communication unit 11 is connected to the network side and performs data communication with the network side.

  In FIG. 3, the control unit 10 executes an application A 16a and an application B 16b as processes on the OS. The application executed by the control unit 10 requests data communication with the network side as necessary. For example, the application A 16a requests data transmission toward the network side. In this case, the data transmitted from the application A 16a toward the network side is input to the packet filter 15 operating in the control unit 10. Similarly, data transmitted from the application B 16b to the network side is input to the packet filter 15 from the application B 16b.

  The packet filter 15 performs a data filtering process from the control unit 10 toward the network side. The filtering process is a process for determining whether to permit or prohibit transmission of data requested by an application based on a set filtering condition. The filtering condition includes, for example, ip_rule or ip_route. These filtering conditions are stored in the storage unit 12 and referred to by the packet filter 15. Hereinafter, the operation of setting the filtering condition includes an operation of storing the filtering condition in the storage unit 12. The filtering condition may be held in the control unit 10 without being stored in the storage unit 12.

  ip_rule includes, for example, a condition for determining whether data whose transmission source is X may be transmitted to the network side. ip_route includes, for example, a condition for determining a route (such as a relay router) for transmitting data in which Y is specified as a transmission destination to the network side.

  In FIG. 3, the flow of data transmitted from the application A 16a is indicated by a solid line arrow, and the flow of data transmitted from the application B 16b is indicated by a broken line arrow. Among these, the data transmitted from the application A 16 a is not prohibited from being transmitted by the filtering process in the packet filter 15 and is transmitted to the communication unit 11. On the other hand, transmission of data transmitted from the application B 16 b is prohibited by the filtering process in the packet filter 15 and is not transmitted to the communication unit 11. This operation is shown in FIG. 3 by pointing the dashed arrow to the description “reject”.

  Data that has passed through the packet filter 15 (in the case of FIG. 3, data transmitted from the application A 16 a indicated by a solid arrow) is input to the communication unit 11. The communication unit 11 transmits data to the network side using the I / F device 111. When transmitting data to the network side, the communication unit 11 can appropriately determine whether to use cellular communication by the modem 112, use wireless LAN communication by the wireless LAN device 113, or use another communication method.

[Filtering processing]
Whether data communication for data transmitted from the application is permitted or prohibited is determined based on the UID assigned to the data transmission source application. Hereinafter, data transmitted from an application to which X is assigned as a UID (hereinafter also referred to as an application having a UID X) is also referred to as data having a UID X. Further, the filtering condition used for performing the filtering process of the data with the UID X is also referred to as the filtering condition for the data with the UID X.

  For example, the packet filter 15 has a filtering condition of permitting only data communication related to data transmitted from an application having a UID of 1. Further, the filtering condition may be a combination of a plurality of conditions.

  Here, a data communication sequence when the filtering process according to the present embodiment is performed will be described. The filtering process according to the present embodiment is based on the premise that permission or prohibition of data communication related to data transmitted by an application operating in BG is determined. The following description of the filtering process according to the present embodiment is based on the above assumption.

  In the filtering process according to the present embodiment, a filtering condition for prohibiting data communication by default (hereinafter also referred to as a default communication prohibiting condition) is set. Since the default communication prohibition condition is set, all data communication is prohibited unless another filtering condition is further set. The default communication prohibition condition is set when the communication device 1 is shipped, or is set when the communication device 1 is initialized. In other words, in the present embodiment, “default” means that it is preset as a standard operation at a predetermined timing (for example, when the communication device 1 is shipped, when the communication device 1 is initialized, etc.). It shall be.

  In the present embodiment, in order to execute necessary data communication, a filtering condition in which a condition for permitting data communication (hereinafter also referred to as a communication permission condition) is used in addition to the default communication prohibition condition. . In this case, the communication permission condition has priority over the default communication prohibition condition.

  FIG. 4 is a diagram illustrating a filtering process sequence according to the present embodiment. FIG. 4 shows a sequence of the application A 16a, application B 16b, framework, communication control unit, kernel, and modem 112.

  As described above, the modem 112 is hardware that functions as a communication interface that performs cellular communication. In FIG. 4, the data communication by the cellular communication using the modem 112 is described. However, instead of the modem 112, the data is replaced by another I / F device 111 such as the wireless LAN device 113 and the data by another communication method is used. Communication may be performed.

  The kernel, the communication control unit, and the framework are software, and are executed by the control unit 10. In FIG. 4, 0 is assigned as the UID to the communication control unit.

  The framework is software including a group of functions for operating an application on the OS. Generally, the function of each application is realized by combining the function groups prepared by the framework.

  The kernel is software that forms the core of the OS, and manages processing in hardware such as the communication unit 11 based on processing by software such as an application so that the functions of the hardware can be used.

  The communication control unit is a daemon program that performs network-related processing, and performs processing that connects the framework and the kernel. In particular, the communication control unit processes data for enabling the kernel to use the functions of the communication unit 11. In the present embodiment, the communication control unit outputs a condition for determining whether the kernel permits or prohibits data output to the communication unit 11 to the kernel.

  In the present embodiment, the filtering process is described as being performed by the packet filter 15. Here, the packet filter 15 is a virtual processing unit, and actual filtering processing is performed by the communication control unit and the kernel.

  The application A 16a and the application B 16b are processes that operate on the OS. In FIG. 4, 1 is assigned as the UID to the application A 16a, and 2 is assigned as the UID to the application B 16b.

  Hereinafter, the sequence shown in FIG. 4 will be described. When an application that operates BG transmits data, data communication by cellular communication is prohibited by default (step S1). That is, a default communication prohibition condition relating to data transmitted from an application that operates BG is set as the filtering condition. In FIG. 4, the fact that the default communication prohibition condition is set is recognized by the kernel, the communication control unit, and the framework. In particular, when the kernel recognizes that the default communication prohibition condition is set, the kernel does not transmit data to the modem 112.

  Subsequently, the framework acquires a data communication permission request (hereinafter, also referred to as a data communication permission request for data with a UID of 1) related to data with a UID of 1 when the application operates on the BG (step S2). Subsequently, the framework outputs a communication permission request for data having a UID of 1 to the communication control unit (step S3).

  The communication control unit acquires a communication permission request for data having a UID of 1 (step S4). Subsequently, the communication control unit outputs a communication permission request for data having a UID of 1 to the kernel (step S5).

  The kernel acquires a communication permission request for data having a UID of 1 (step S6). Through the operations in steps S3 to S6, a communication permission request for data having a UID of 1 is transmitted to the kernel. That is, a communication permission condition relating to data having a UID of 1 is set as a filtering condition.

  Subsequently, when the application A 16a requests data communication in the BG operation (step S7), since the kernel recognizes that the communication permission condition relating to the data with the UID of 1 is set, the data communication is permitted. (Step S8). Then, the modem 112 performs data communication for transmitting data having a UID of 1 to the network side (step S9).

  On the other hand, when the application B 16b to which 2 is assigned as the UID requests data communication in the BG operation (step S10), the kernel recognizes that the communication permission condition relating to the data with the UID 2 is not set. Therefore, the kernel prohibits data communication based on the default communication prohibition condition (step S11).

<Data transmission sequence from application>
In steps S7 to S9 of FIG. 4, it has been described that the application requests data communication and the modem 112 performs data communication. Hereinafter, these sequences will be described more specifically with reference to FIG. FIG. 5 shows a sequence of the application A 16a, the framework, the kernel, and the modem 112. The application A 16a, the framework, the kernel, and the modem 112 are the same as those in FIG.

  Regardless of whether the application A16a operates in FG or BG, a data communication request (hereinafter, also referred to as a data communication request with a UID of 1) related to data (data with a UID of 1) transmitted from the application A16a. ) Is output to the framework on the OS on which the application A 16a is running (step S101).

  The framework acquires a data communication request with a UID of 1 (step S102). Subsequently, the framework outputs a data communication request with a UID of 1 to the kernel (step S103).

  The kernel acquires a data communication request with a UID of 1 (step S104). Subsequently, the kernel outputs data to the modem 112 based on the data communication request whose UID is 1 (step S105). The modem 112 performs data communication for transmitting data having a UID of 1 to the network side (step S106).

  By the operation of the sequence shown in FIG. 5 described above, data transmitted from the application is output to the communication unit 11 and transmitted to the network side.

<Comparative example>
According to the filtering processing according to the present embodiment described so far, in addition to the default communication prohibition condition, the communication permission condition is explicitly added by the user, so there is a possibility that data communication unintended by the user can be prohibited. Get higher. Hereinafter, a filtering process according to a comparative example of the present embodiment will be described. In the filtering condition used in the filtering process according to the comparative example, a condition for permitting data communication related to all data by default (hereinafter also referred to as a default communication permission condition) is set. In this way, after data communication related to all data is permitted, a condition for prohibiting data communication related to data of the UID designated by the user (hereinafter also referred to as a communication prohibition condition) is further set.

  FIG. 6 is a diagram illustrating a filtering process sequence according to the comparative example. The application A 16a, the application B 16b, the framework, the communication control unit, the kernel, and the modem 112 are the same as those in FIGS.

  In FIG. 6, even when an application that operates BG transmits data, data communication by cellular communication is permitted by default (step S201). That is, a default communication permission condition relating to data transmitted from an application that operates BG is set as the filtering condition.

  Subsequently, the framework acquires a data communication prohibition request (hereinafter, also referred to as a data communication prohibition request for data with UID 1) when the application A 16a performs a BG operation (step S202). At this time, since the application A 16a is not performing the BG operation, the communication prohibition condition relating to the data with the UID of 1 is not set.

  Subsequently, the framework acquires a notification that the application A 16a has shifted to the BG operation (hereinafter also referred to as a BG shift notification) (step S203). Upon receiving the notification, the framework outputs a communication prohibition request for data having a UID of 1 to the communication control unit (step S204).

  The communication control unit acquires a communication prohibition request for data having a UID of 1 (step S205). Subsequently, the communication control unit outputs a communication prohibition request for data having a UID of 1 to the kernel (step S206).

  The kernel acquires a communication prohibition request for data having a UID of 1 (step S207). Through the operations in steps S202 to S207 described above, a communication prohibition request for data having a UID of 1 is transmitted to the kernel. That is, a communication prohibition condition relating to data with a UID of 1 is set as a filtering condition.

  Subsequently, when the application A 16a requests data communication in the BG operation (step S208), the kernel recognizes that the communication prohibition condition relating to the data with the UID of 1 is set, and therefore prohibits the data communication. (Step S209).

  On the other hand, when the application B 16b to which 2 is assigned as the UID requests data communication in the BG operation (step S210), the kernel recognizes that the communication prohibition condition relating to the data with the UID 2 is not set. Therefore, the kernel permits data communication based on the default communication permission condition (step S211). Then, the modem 112 performs data communication for transmitting data having a UID of 2 to the network side (step S212).

  The filtering process according to the comparative example has been described above. In the comparative example, since the default communication permission condition is set, data communication in the BG operation of the application B 16b in which no additional filtering condition is explicitly set by the user is permitted. Therefore, when the user does not recognize the operation of the application B 16b, data communication unintended by the user may be performed.

  On the other hand, in this embodiment, a default communication prohibition condition is set as a filtering condition. In addition, a communication permission condition relating to the data of the UID specified by the user is further set. In this case, since data communication is prohibited for all data by default, there is a high possibility that data communication unintended by the user can be prohibited.

  The filtering process according to the present embodiment and the comparative example has been described above. In the filtering process according to the present embodiment, unlike the filtering process according to the comparative example, data communication is prohibited for all data by default. Then, the communication permission condition relating to the data of the UID specified by the user is explicitly set as the filtering condition by the user, thereby enabling the data communication intended by the user.

  According to the filtering process according to the present embodiment having the above-described configuration, data communication related to data transmitted from the application B 16b in which filtering conditions are not explicitly set by the user can be prohibited. That is, there is a high possibility that data communication not intended by the user is prohibited.

  In the present embodiment, the method for prohibiting data communication by the cellular communication method using the modem 112 as the I / F device 111 has been mainly described. However, the I / F device 111 is not limited to the modem 112 and may be a wireless LAN device 113 or the like. That is, the data communication control method of the communication apparatus 1 according to the present embodiment is not limited to data communication using the cellular communication method, and can be applied to data communication using another communication method such as a wireless LAN communication method.

  In the present embodiment, data communication may be permitted by default for functions necessary for transmitting data permitted for data communication. The functions that are permitted to perform data communication by default include, for example, a VPN (Virtual Private Network) tunneling function, a DNS (Domain Name System) name resolution function, or a tethering function. Data communication related to these functions may be permitted only if it operates when the user intends. Conditions for permitting data communication related to these functions may be set as filtering conditions prior to default communication prohibition conditions.

  Further, the filtering process according to the present embodiment is performed for data communication of an application operating in BG, but is not limited thereto, and may be performed for data communication of an application operating in FG. In other words, the filtering process according to the present embodiment may determine whether to allow or prohibit data communication related to data transmitted by an application that is performing an FG operation.

(Embodiment 2)
As described so far, in the first embodiment, whether to allow or prohibit data communication related to data transmitted from an application is determined based on the UID associated with the data. In the first embodiment, the communication method in which the communication unit 11 connects to the network side has been mainly described as the cellular communication method. Hereinafter, as the second embodiment, a case where the communication unit 11 appropriately selects and uses the modem 112 and the wireless LAN device 113 as the I / F device 111 will be described.

  FIG. 7 is a diagram illustrating an example of a data flow according to the present embodiment. The configuration shown in FIG. 7 includes a control unit 10 and a communication unit 11 as in the configuration shown in FIG. In FIG. 7, the communication unit 11 includes a modem 112 and a wireless LAN device 113. The communication unit 11 selects and uses the modem 112 and the wireless LAN device 113 as appropriate, and performs data communication with the network side.

  In FIG. 7, as in FIG. 3, the flow of data transmitted from the application A 16a is indicated by a solid line, and the flow of data transmitted from the application B 16b is indicated by a broken line. In FIG. 7, the packet filter 15 determines whether to permit data communication based on the filtering condition for each of the case where the I / F device 111 is the modem 112 and the case where it is the wireless LAN device 113.

  The filtering condition according to the present embodiment includes a condition that data communication is prohibited by default when the I / F device 111 is the modem 112 and communication with the network side is performed by cellular communication. Furthermore, the filtering condition according to the present embodiment includes a communication permission condition related to data transmitted from the application A 16a. An example of the data flow shown in FIG. 7 is based on these filtering conditions.

  When the I / F device 111 is the modem 112, the packet filter 15 prohibits data communication related to data transmitted from the application B 16 b based on the filtering condition, and does not output data to the modem 112. In FIG. 7, the data flow related to this operation is indicated by a broken-line arrow from the packet filter 15 toward the description “reject”.

  The packet filter 15 outputs data to the modem 112 without prohibiting data communication related to data transmitted from the application A 16 a based on the filtering condition. In FIG. 7, the data flow related to this operation is indicated by a solid arrow from the packet filter 15 to the modem 112.

  When the I / F device 111 is the wireless LAN device 113, the packet filter 15 does not prohibit the data communication related to the data transmitted from the application A 16a and the data communication related to the data transmitted from the application B 16b. The data is output to the LAN device 113. In FIG. 7, the data flow related to this operation is indicated by solid and broken arrows from the packet filter 15 toward the wireless LAN device 113.

  The second embodiment has been described above. As described above, the charging method related to the amount of data to be communicated may differ between the cellular communication method and the wireless LAN communication method. According to the present embodiment, it is possible to select data communication using a cellular communication method and data communication using a wireless LAN communication method, and it is possible to set a filtering condition according to a charging method.

(Embodiment 3)
As a third embodiment, a communication apparatus 1 further including a connection function unit 17 will be described. The connection function unit 17 is used when the communication unit 11 appropriately selects the modem 112 and the wireless LAN device 113 as the I / F device 111.

  In the third embodiment, only data communication by cellular communication, which is a charge system based on a metered charge system, is generally prohibited based on the UID. Data communication using a method that is not generally a metered charge system such as a wireless LAN or Bluetooth (registered trademark) may not be prohibited based on the UID.

[Device configuration]
FIG. 8 is a functional block diagram illustrating a schematic configuration example of the communication device 1 according to the third embodiment. Compared to FIG. 1, the communication device 1 illustrated in FIG. 8 further includes a connection function unit 17.

  The connection function unit 17 is connected to the control unit 10 and the communication unit 11. The connection function unit 17 is controlled by the control unit 10. The connection function unit 17 outputs information that instructs the communication unit 11 whether to use the modem 112 or the wireless LAN device 113 for connection to the network side.

  Further, the connection function unit 17 acquires information regarding whether communication with the network side in the communication unit 11 is performed using the modem 112 or the wireless LAN device 113. That is, the connection function unit 17 acquires information regarding whether the I / F device 111 in FIG. 3 is the modem 112 or the wireless LAN device 113.

  In the present embodiment, the control unit 10 includes an application function unit and a data service function unit. Further, the connection function unit 17 may be included in the control unit 10.

  The application function unit implements a user interface when executing an application in the communication device 1. The application function unit manages communication permission or communication prohibition of each application, and notifies the connection function unit 17 of information related to communication permission or communication prohibition. Further, the application function unit determines whether or not to notify the connection function unit 17 in accordance with a change in the state of each application.

  The connection function unit 17 notifies the data service function unit of information regarding communication permission or communication prohibition notified from the application function unit.

  The data service function unit sets a communication permission condition or a communication prohibition condition (addition, change, (Or deletion).

[Control of data communication when VPN device is provided]
In the present embodiment, the communication apparatus 1 further includes a VPN device 18. The VPN device 18 has a protocol that encapsulates the acquired data. A unique UID is assigned to the protocol of the VPN device 18. Hereinafter, a UID assigned to a protocol is also referred to as a protocol UID. The VPN device 18 encapsulates data from the application based on this protocol. Then, the VPN device 18 outputs the encapsulated data to the communication unit 11. The correspondence between the encapsulated data and the UID assigned to the application that transmits the data is lost. The encapsulated data is newly associated with the UID of the encapsulated protocol.

  The VPN device 18 may have a plurality of protocols for encapsulating data. In this case, the UID of each protocol is different. The encapsulated data is associated with the UID of the encapsulated protocol. When the VPN device 18 has a plurality of protocols for data encapsulation, the UIDs of these protocols belong to a common group. This common group is assigned a GID. Therefore, a common GID is associated with a plurality of protocols that the VPN device 18 has. The protocol that the VPN device 18 has may be included in the application.

  FIG. 9 is a diagram showing a data flow according to the present embodiment. In FIG. 9, in addition to the configuration shown in FIG. 7 of the second embodiment, a connection function unit 17 and a VPN device 18 are further provided. In FIG. 9, the data flow through the path directly connected from the packet filter 15 to the communication unit 11 is the same as that in FIG.

  In FIG. 9, the connection function unit 17 acquires information regarding whether the I / F device 111 is the modem 112 or the wireless LAN device 113 from the communication unit 11. Further, the connection function unit 17 sets a filtering condition referred to by the packet filter 15 based on the information acquired from the communication unit 11.

  FIG. 10 is a flowchart showing the operation of the connection function unit 17. First, the connection function unit 17 transmits the data from the application to the VPN device 18 and the first filtering condition that the data communication related to the data associated with the protocol UID of the VPN device 18 is always permitted. A second filtering condition for prohibition is set (step S301).

  According to the first filtering condition, data communication is permitted regardless of which application the data encapsulated by the VPN device 18 is transmitted from. Data communication with the data encapsulated by the VPN device 18 is permitted regardless of whether the I / F device 111 is the modem 112 or the wireless LAN device 113.

  On the other hand, due to the second filtering condition, data transmitted from the application is not transmitted to the VPN device 18 and is not encapsulated. When the first and second filtering conditions are combined, data transmitted from the application is not encapsulated by the VPN device 18.

  Here, in order to encapsulate the data transmitted from the application specified by the user (the data of the UID specified by the user) by the VPN device 18 and transmit it to the network side, the transmission of data to the VPN device 18 is permitted. It is necessary to further set the filtering condition. This filtering condition is set in the following steps S302 to S305.

  Subsequent to step S301, the connection function unit 17 acquires information related to the I / F device 111 from the communication unit 11, and determines whether the I / F device 111 is the modem 112 (step S302).

  When the I / F device 111 is the modem 112 (step S302: YES), the connection function unit 17 adds a third filtering condition that permits transmission of data from the application A 16a to the VPN device 18. (Step S303). According to the third filtering condition, the data transmitted from the application A 16a is transmitted to the VPN device 18 and encapsulated. Further, since the data communication related to the data encapsulated by the VPN device 18 is permitted by the first filtering condition, the data transmitted from the application A 16a is permitted to be encapsulated and transmitted to the network side. Is done. Thereafter, the connection function unit 17 ends the process of the flowchart of FIG.

  When the I / F device 111 is not the modem 112 (step S302: NO), the connection function unit 17 determines whether the I / F device 111 is the wireless LAN device 113 (step S304).

  When the I / F device 111 is the wireless LAN device 113 (step S304: YES), the connection function unit 17 adds a fourth filtering condition that permits transmission of data from the application to the VPN device 18. (Step S305). Thereafter, the connection function unit 17 ends the process of the flowchart of FIG.

  Here, since the application includes the application A 16a and the application B 16b, transmission of data transmitted from any application to the VPN device 18 is permitted by the fourth filtering condition. Thereby, when the I / F device 111 is the wireless LAN device 113, data transmitted from any application is permitted to be encapsulated and transmitted to the network side.

  When the I / F device 111 is not the wireless LAN device 113 (step S304: NO), the connection function unit 17 ends the process of the flowchart of FIG.

  As described above, the operation of the connection function unit 17 has been described with reference to FIG. 10, but the data flow according to the filtering condition set by these operations corresponds to the data flow shown in FIG. Hereinafter, this correspondence will be described.

  In FIG. 9, a solid line arrow from the packet filter 15 to the VPN device 18 indicates a data flow based on a third filtering condition (a condition for permitting data transmission from the application A 16 a to the VPN device 18). The solid line arrows also indicate the data flow based on the fourth filtering condition (conditions permitting data transmission from the application A 16a and the application B 16b to the VPN device 18).

  In FIG. 9, a broken-line arrow from the packet filter 15 to the VPN device 18 branches before the VPN device 18. One of the branches goes to the VPN device 18 and the other of the branches goes to the description “reject”. A broken-line arrow toward the VPN device 18 indicates a data flow based on the fourth filtering condition. A broken-line arrow heading toward “reject” indicates a data flow based on the third filtering condition. That is, whether the data transmitted from the application B 16b whose flow is indicated by the dashed arrow is transmitted to the VPN device 18 is determined depending on whether the I / F device 111 is the modem 112 or the wireless LAN device 113. .

  The data flow shown in FIG. 9 is realized based on each filtering condition set in the flowchart of FIG. However, the data flow shown in FIG. 9 can be realized even under filtering conditions different from those in FIG. FIG. 11 is a flowchart for setting filtering conditions different from those in FIG.

  Hereinafter, the flowchart shown in FIG. 11 will be described. First, the connection function unit 17 transmits the data from the application to the VPN device 18 and the first filtering condition that the data communication related to the data associated with the protocol UID of the VPN device 18 is always permitted. A fifth filtering condition of permitting is set (step S401). The first filtering condition is the same as the first filtering condition set in step S301 in FIG. The fifth filtering condition is different from the second filtering condition set in step S301 in FIG. 10 in that the transmission of data is permitted rather than prohibited.

  According to the first filtering condition, data communication is permitted regardless of which application the data encapsulated by the VPN device 18 is transmitted from. Data communication with the data encapsulated by the VPN device 18 is permitted regardless of whether the I / F device 111 is the modem 112 or the wireless LAN device 113.

  Further, the data transmitted from the application is transmitted to the VPN device 18 by default and encapsulated by the fifth filtering condition. When the first and fifth filtering conditions are combined, the data transmitted from the application is encapsulated in the VPN device 18 by default.

  Here, in order to prevent the data (UID data specified by the user) transmitted from the application specified by the user from being transmitted to the VPN device 18 and not encapsulated, data transmission to the VPN device 18 is prohibited. It is necessary to further set a filtering condition to do. This filtering condition is set in the following steps S402 to S405.

  Subsequent to step S401, the connection function unit 17 acquires information related to the I / F device 111 from the communication unit 11, and determines whether the I / F device 111 is the modem 112 (step S402).

  If the I / F device 111 is the modem 112 (step S402: YES), the connection function unit 17 adds a sixth filtering condition that prohibits data transmission from the application B 16b to the VPN device 18. (Step S403). Thereby, the data transmitted from the application B 16b is not transmitted to the VPN device 18 and is not encapsulated. Therefore, data communication related to the data transmitted from the application B 16b is not permitted. On the other hand, transmission of data transmitted from the application A 16a to the VPN device 18 is not prohibited. Therefore, the data transmitted from the application A 16a is permitted to be encapsulated and transmitted to the network side. Thereafter, the connection function unit 17 ends the process of the flowchart of FIG.

  When the I / F device 111 is not the modem 112 (step S402: NO), the connection function unit 17 determines whether the I / F device 111 is the wireless LAN device 113 (step S404).

  When the I / F device 111 is the wireless LAN device 113 (step S404: YES), the connection function unit 17 deletes the sixth filtering condition (step S405). The deletion of the sixth filtering condition is limited to the case where the sixth filtering condition is originally added. As a result, transmission of data transmitted from the application B 16b to the VPN device 18 is not prohibited. Therefore, the data transmitted from the application B 16b is permitted to be encapsulated and transmitted to the network side in the same manner as the data transmitted from the application A 16a. In other words, when the I / F device 111 is the wireless LAN device 113, data transmitted from any application is permitted to be encapsulated and transmitted to the network side. Thereafter, the connection function unit 17 ends the process of the flowchart of FIG.

  When the I / F device 111 is not the wireless LAN device 113 (step S404: NO), the connection function unit 17 ends the process of the flowchart of FIG.

  As described above, the data flow based on the filtering condition set by the operation of the connection function unit 17 described with reference to FIG. 11 corresponds to the data flow shown in FIG. Hereinafter, this correspondence will be described.

  In FIG. 9, a solid line arrow from the packet filter 15 toward the VPN device 18 indicates a data flow based on the fifth filtering condition.

  In FIG. 9, a broken-line arrow from the packet filter 15 to the VPN device 18 branches before the VPN device 18. One of the branches goes to the VPN device 18 and the other of the branches goes to the description “reject”. A broken-line arrow toward the VPN device 18 indicates a data flow based on the fifth filtering condition (a condition for permitting data transmission by default). A broken-line arrow heading toward “reject” indicates a data flow based on the sixth filtering condition (a condition for prohibiting data transmission from the application B 16b to the VPN device 18). That is, whether the data transmitted from the application B 16b whose flow is indicated by the dashed arrow is transmitted to the VPN device 18 is determined depending on whether the I / F device 111 is the modem 112 or the wireless LAN device 113. .

  According to the filtering process according to the present embodiment described so far, the transmission of data to the VPN device 18 can be controlled based on the information acquired from the communication unit 11 by the connection function unit 17. Therefore, even when data is encapsulated by the VPN device 18 and the UID of the data is changed, it becomes easy to permit or prohibit data communication based on the UID assigned to the application. Hereinafter, a filtering process according to a comparative example of the present embodiment will be described.

<Comparative Example 1>
FIG. 12 is a diagram illustrating a data flow according to Comparative Example 1 of the present embodiment. In FIG. 12, as in FIG. 7, the flow of data transmitted from the application A 16a is indicated by a solid line, and the flow of data transmitted from the application B 16b is indicated by a broken line. 12 includes not only a path directly connected from the packet filter 15 to the communication unit 11 but also a path connected to the communication unit 11 via the VPN device 18 from the packet filter 15. A data flow output from the VPN device 18 and associated with a new UID is indicated by a double-line arrow. In FIG. 12, the data flow through the path directly connected from the packet filter 15 to the communication unit 11 is the same as that in FIG.

  In FIG. 12, the path through which data flows from the packet filter 15 to the communication unit 11 via the VPN device 18 determines whether the packet filter 15 outputs data to the VPN device 18 before data encapsulation. is there. In FIG. 12, compared with FIG. 9, the packet filter 15 cannot determine whether the data encapsulated by the VPN device 18 is finally output to the modem 112 or the wireless LAN device 113. Therefore, it cannot be determined whether the data of the application B 16b can be output to the VPN device 18.

<Comparative example 2>
FIG. 13 is a diagram illustrating a data flow according to Comparative Example 2 of the present embodiment. In FIG. 13, similarly to FIGS. 7 and 12, the flow of data transmitted from the application A 16a is indicated by a solid line, and the flow of data transmitted from the application B 16b is indicated by a broken line. In FIG. 13, as in FIG. 12, the flow of data output from the VPN device 18 and associated with a new UID is indicated by a double line. In FIG. 13, a VPN device 18 is connected between the application A 16 a and application B 16 b and the packet filter 15. That is, the data flow path in FIG. 13 determines whether the packet filter 15 outputs data to the communication unit 11 after the data transmitted from the application is encapsulated.

  In FIG. 13, unlike FIG. 12, since the packet filter 15 directly outputs data to the I / F device 111 of the communication unit 11, the I / F device 111 that is the output destination of the data Or the wireless LAN device 113.

  However, in this case, the data input to the packet filter 15 is associated with the UID of the protocol that encapsulates the data in the VPN device 18. That is, the data input to the packet filter 15 is not associated with the UID of the application A 16a or the UID of the application B 16b. Therefore, the packet filter 15 cannot determine whether the data is transmitted from the application A 16a or the application B 16b. As a result, when the I / F device 111 is the modem 112, the packet filter 15 cannot determine whether data from an application may be output to the modem 112.

  On the other hand, when the I / F device 111 is the wireless LAN device 113, the packet filter 15 determines that data from the application may be output to the wireless LAN device 113, and can output the data.

  The data flow according to the present embodiment and Comparative Examples 1 and 2, that is, the control of data communication has been described above. According to the data communication control according to the present embodiment, even when data is encapsulated by the VPN device 18 and the data UID is changed, the data communication is permitted or prohibited based on the UID assigned to the application. Becomes easier.

  Although the present invention has been described based on the drawings and examples, it should be noted that those skilled in the art can easily make various modifications and corrections based on the present disclosure. Therefore, it should be noted that these variations and modifications are included in the scope of the present invention. For example, the functions included in each component, each step, etc. can be rearranged so that there is no logical contradiction, and multiple components, steps, etc. can be combined or divided into one It is. Further, although the present invention has been described centering on an apparatus, the present invention can also be realized as a method including steps executed by each component of the apparatus. Further, although the present invention has been described mainly with respect to the apparatus, the present invention can also be realized as a method, a program executed by a processor included in the apparatus, or a storage medium storing the program, and is within the scope of the present invention. It should be understood that these are also included.

  In the above-described embodiment, the wireless LAN is exemplified as a data communication method based on a method that is not a pay-per-use system. A data communication system such as

DESCRIPTION OF SYMBOLS 1 Communication apparatus 10 Control part 11 Communication part 111 I / F device 112 Modem 113 Wireless LAN device 12 Storage part 13 Display part 14 Operation part 15 Packet filter 16a Application A
16b Application B
17 Connection Function Unit 18 VPN Device

A communication device according to an embodiment of the present invention that achieves the above object is as follows.
Data communication is prohibited by default,
Receives a data communication request from the application,
Data communication of the application is permitted according to the requested UID of the application.
Also, by default, data communication for all applications is prohibited,
Receives a data communication request from the application,
Depending on the requested UID of the application, data communication of the application may be permitted.
Also, by default, data communication for all applications is prohibited,
Receives a data communication request from an application that runs in the background,
Depending on the requested UID of the application, data communication in the background operation of the application may be permitted.
Also, by default, data communication in the background operation of the application is prohibited,
Receives a data communication request from an application that runs in the background,
Depending on the requested UID of the application, data communication in the background operation of the application may be permitted.
Also, by default, data communication for all applications is prohibited,
Receives a data communication request from the application,
When the requested UID of the application is a UID specified by the user, data communication of the application may be permitted.

Claims (5)

Data communication is prohibited by default,
Receives a data communication request from the application,
A communication device that permits data communication of the application according to the requested UID of the application.   The communication apparatus according to claim 1, wherein when the data communication is cellular communication, data communication is prohibited by default.   The communication device according to claim 1, wherein the data communication is permitted by default when the data communication is wireless LAN communication. In the communication device,
A step of prohibiting data communication by default;
Receiving a data communication request from the application;
Permitting data communication of the application in accordance with the requested UID of the application. To a computer that functions as a communication device,
A step of prohibiting data communication by default;
Receiving a data communication request from the application;
A program for executing a step of permitting data communication of the application in accordance with the requested UID of the application.

Images