JP3923346B2 - Wireless communication device - Google Patents

Description

[0001]
[Technical field to which the invention belongs]
The present invention relates to a wireless communication device, and more particularly to a wireless communication device connected to the Internet.
[0002]
[Prior art]
A wireless communication device such as a cellular phone sets up a communication line using radio waves with a wireless base station, and communicates by wirelessly transmitting and receiving voice, data, and the like. In data communication, the Internet using IP is widely used as one of data communication methods between computers. Until now, this IP connection was mainly used for connecting computers, but with the widespread use of IPv6, various built-in devices that have been unrelated to the network can now support the network. If various devices are networked in the future, these devices may be exposed to various cracking acts (illegal access, eavesdropping, tampering, impersonation, DoS attack, etc.) that are problematic on the Internet. is expected.
[0003]
In particular, a DoS attack (load attack) takes over a large number of computer devices, makes full use of the taken-up devices, and simultaneously accesses an attack target network or computer device to apply an abnormal load. It is an attack that puts the device in an overloaded state and makes it virtually unusable. The feature of this attack method is that there is no problem in the protocol for each access, so it cannot be determined whether a large number of accesses for the purpose of attack or normal access occurred at the same time by chance.
[0004]
As a countermeasure against this DoS attack, for example, an access control device (firewall) is installed between two networks as seen in JP 2001-34553 A, and all communication data passing between the networks is monitored. When an overload occurs, the passage data, communication sequence, access pattern, etc. are analyzed to determine whether it is an unauthorized attack or normal access. If it is determined that the attack is an unauthorized attack, the corresponding communication data is not passed through the firewall first, thereby preventing damage to the network ahead of the firewall fall.
[0005]
[Problems to be solved by the invention]
The above-described method for preventing a DoS attack by installing a firewall and monitoring communication data passing therethrough is effective in a wired network environment. However, in the case of network connection using wireless communication such as a mobile phone, even if a firewall is installed inside the mobile phone and a DoS attack from the network can be prevented, wireless resources are wasted and effective. There is no way.
[0006]
In addition, since a small device such as a mobile phone has restrictions on the size and power consumption of the device and cannot be equipped with a high-speed CPU, it is described in Japanese Patent Laid-Open No. 2001-34553 described above. Such a method of monitoring all communication data passing through the firewall, analyzing the access pattern in real time, and detecting unauthorized communication is too difficult to implement because the processing burden is too great.
[0007]
For this reason, in a wireless communication system using a mobile phone as an Internet connection terminal, a protection means against a DoS attack suitable for the mobile phone is required, which is different from the method used in the conventional wired environment.
[0008]
The present invention provides a mobile phone having a DoS attack protection means suitable for a wireless communication system that can detect unauthorized communication without using a device size, power consumption, etc., and without using a high-speed CPU. The purpose is to provide.
[0009]
[Means for Solving the Problems]
1st invention has a control part which controls operation | movement of a radio | wireless communication apparatus, and is connected to a radio | wireless communication network, and the radio | wireless communication apparatus which transmits / receives data WHEREIN: The said control part receives the data received from the said radio | wireless communication network When it is detected that the amount is greater than or equal to a predetermined amount over a predetermined period and that the transmission source of the data received over the predetermined period is greater than or equal to a predetermined number, the data destination ( For example, the operation is performed to change the IP address).
[0010]
In a second aspect based on the first aspect, the control unit detects a transfer rate of data received by the wireless communication device and a recording unit records a transmission source address of the received data. And whether the number of addresses recorded in the recording means during the predetermined period is greater than or equal to a predetermined number when it is detected that the amount of data received from the wireless communication network is greater than or equal to a predetermined amount over a predetermined period. Determination means for determining whether or not, and destination change means that operates to change the destination of data for the wireless communication device.
[0011]
According to a third invention, in the first or second invention, the wireless communication is performed by the first communication method and the second communication method (for example, cdma2000 1x-EV DO method (or HDR method) and cdma2000 1x method). It is possible to send and receive data by connecting to a network, and the control unit changes a data destination for the wireless communication device by changing a communication method connected to the wireless communication network. It is characterized by operation.
[0012]
According to a fourth aspect, in the third aspect , the second communication method assigns a data destination to the wireless communication device every time the wireless communication device is connected.
[0013]
A fifth invention is a wireless communication network, a wireless communication device connected to the wireless communication network to transmit and receive data in a wireless communication system comprising the wireless communication device, the wireless communication apparatus, the wireless communication When detecting that the amount of data received from the network is a predetermined amount or more over a predetermined period and detecting that the transmission source of the data received over the predetermined period is a predetermined number or more, the wireless communication network And the wireless communication network changes a data destination for the wireless communication device based on the notification from the wireless communication device.
[0014]
According to a sixth invention, in the fifth invention, the wireless communication network and the wireless communication device are connected by the first communication method and the second communication method to transmit and receive data, and the wireless communication By changing a communication method for connecting between a network and the wireless communication device, a data destination for the wireless communication device is changed.
[0015]
In the fifth or sixth invention, the second communication method may be configured to assign a data destination to the wireless communication device each time the wireless communication device is connected.
[0016]
Operation and effect of the invention
In a first aspect of the present invention, in the wireless communication device that includes a control unit that controls the operation of the wireless communication device and transmits and receives data by connecting to the wireless communication network, the control unit receives data received from the wireless communication network When it is detected that the amount is greater than or equal to a predetermined amount over a predetermined period and that the transmission source of the data received over the predetermined period is greater than or equal to a predetermined number, the data destination for the wireless communication device is determined. Because it operates to change, even when a DoS attack that applies an abnormal load and makes the wireless communication device unusable by accessing the wireless communication device all at once, the wireless communication device becomes unusable. Can be avoided. In addition, since the data destination for the wireless communication device is changed, the data for simultaneous access does not reach the wireless communication device, the wireless communication line is not occupied, and wireless resources can be used effectively.
[0017]
In the second invention, the control unit receives from the wireless communication network , a detecting unit that detects a transfer rate of data received by the wireless communication device, a recording unit that records a transmission source address of the data, Determining means for determining whether or not the number of addresses recorded in the recording means during the predetermined period is greater than or equal to a predetermined number when it is detected that the amount of data to be performed is greater than or equal to a predetermined amount over a predetermined period ; In addition to the effect of the first invention, the DoS attack and the normal access can be easily discriminated because there is provided a destination changing unit that operates to change the destination of data for the wireless communication device.
[0018]
In the third invention, data can be transmitted / received by connecting to the wireless communication network by the first communication method and the second communication method, and the control unit is connected to the wireless communication network. By changing the communication method, it operates to change the data destination for the wireless communication device. In addition to the effects of the invention described above, special hardware is added to the wireless communication device having two wireless methods. Therefore, it is possible to protect against a DoS attack and to prevent the wireless communication device from being unavailable.
[0019]
In the fourth invention, since the second communication method assigns a data destination to the wireless communication device every time the wireless communication device is connected, in addition to the effects of the invention described above, the second communication method is portable in the second communication method. Since the destination of the data to the telephone is not fixed, in addition to the effect in the above-described invention, a large amount of transmitted data becomes difficult to reach the wireless communication device, and the wireless communication device is effectively prevented from using against a DoS attack. Possible states can be avoided.
[0020]
In a fifth aspect of the present invention, in a wireless communication system comprising a wireless communication network and a wireless communication device connected to the wireless communication network and transmitting / receiving data, the wireless communication device receives an amount of data received from the wireless communication network Is detected over the predetermined period, and when it is detected that the transmission source of the data received over the predetermined period is equal to or greater than the predetermined number , the wireless communication network is notified, Since the communication network changes the data destination for the wireless communication device based on the notification from the wireless communication device, avoiding the wireless communication device being unusable even when subjected to a DoS attack. Can do. In addition, since the wireless communication network changes the destination of data for the wireless communication device, the data for simultaneous access is not transmitted to the wireless communication device, the wireless communication line is not occupied, and wireless resources are effectively used. Can be used.
[0021]
In a sixth aspect of the invention, data can be transmitted and received by connecting the wireless communication network and the wireless communication device by the first communication method and the second communication method, and the wireless communication network and the wireless communication device Since the destination of data for the wireless communication device is changed by changing the communication method for connecting to the wireless communication device, in addition to the effect of the fifth invention, a wireless communication device or wireless communication network having two wireless methods Without adding special hardware, it is possible to protect against a DoS attack and avoid the wireless communication device being unavailable.
[0022]
DETAILED DESCRIPTION OF THE INVENTION
Next, embodiments of the present invention will be described with reference to the drawings.
[0023]
FIG. 1 is a block diagram showing a main configuration of a mobile phone 1 according to the present embodiment.
[0024]
The antenna 10 is connected to the transmission / reception unit via the switching unit 17, receives radio waves from the radio base station, and transmits radio waves to the radio base station. The transmission / reception unit includes a 1x-EV DO wireless processing unit 11 that performs wireless communication using the cdma2000 1x-EV DO method, and a cdma2000 1x wireless processing unit 16 that performs wireless communication using the cdma2000 1x method. Each of the wireless processing units 11 and 16 includes a transmission unit, a reception unit, and a baseband processing unit, and the transmission unit generates a high-frequency signal to be transmitted from the antenna 10. The receiving unit amplifies and converts the high frequency signal received by the antenna 10 to generate a baseband signal. The baseband processing unit demodulates the baseband signal into an audio signal and modulates the audio signal to generate a baseband signal. That is, since the mobile phone 1 of the present embodiment includes two wireless communication units of the 1x-EV DO wireless processing unit 11 and the cdma2000 1x wireless processing unit 16 having different methods, the two wireless communication units are provided. By switching, it is possible to communicate (data communication) with the base station using two wireless communication methods.
[0025]
The switching unit 17 is controlled by the CPU 12 and selectively connects the antenna 10 and the wireless processing units 11 and 16 to switch the wireless communication method to be connected to the base station.
[0026]
The CPU 12 controls each part of the mobile phone such as the wireless processing units 11 and 16, the switching unit 17, the display unit 14, and the input / output unit 15 based on the program and data stored in the memory 13. The radio processing units 11 and 16 also control the frequency to be transmitted / received, the transmission / reception timing, the output of the transmitted radio wave, and the like.
[0027]
The memory 13 stores data acquired through the wireless communication line. In particular, in the present invention, a DoS access list that collects transmission source IP addresses of received data is stored in the memory 13.
[0028]
The display unit 14 includes a display element and a driver circuit that drives the display element (liquid crystal display panel) by display data from the CPU 12, and relates to character information sent via a wireless communication line and operations. Information such as operation menus, input items, and key input echo back are displayed. The input / output unit 15 includes a keyboard and a keyboard control circuit that accept input of characters and numbers, and instructions for operation to the mobile phone.
[0029]
Further, the mobile phone has a transmitter (not shown) for converting an acoustic signal into an electrical signal and a receiver (not shown) for converting an electrical signal into an acoustic signal.
[0030]
FIG. 2 is a configuration diagram of a network system to which the mobile phone according to the embodiment of the present invention is connected.
[0031]
The mobile phone 1 which is a terminal that can be connected to the Internet can communicate by two wireless systems, and selects the cdma2000 1x mobile phone network 2 or the cdma2000 1xEV-DO high-speed data communication network 3, It is connected to one of the networks and connected to the Internet via the network.
[0032]
The cdma2000 1x mobile phone network 2 includes a cdma2000 1x wireless base station 20, a mobile phone network 21, a public network connection gateway 22, and a control device (not shown). The cdma2000 1x radio base station 20 establishes a cdma2000 1x radio communication line between the mobile phone 1 and connects the mobile phone 1 and the cdma2000 1x mobile phone network 2. The cellular phone network 21 connects a plurality of radio base stations and a public network connection gateway 22 to connect the radio base station 20 to the public line network 4 via the public network connection gateway 22. The public network connection gateway 22 converts a communication protocol between the mobile phone network 21 and the public line network 4 and connects the mobile phone network 21 and the public line network 4. The control device controls the cdma2000 1x mobile phone network 2 in an integrated manner.
[0033]
The public line network 4 is a telephone network that connects the cdma2000 1x cellular phone network 2 and the Internet connection server 6. The Internet connection server 6 is a connection server that connects terminal devices to the Internet by dial-up connection via a public network.
[0034]
The cdma2000 1xEV-DO high-speed data communication network 3 includes a cdma2000 1xEV-DO wireless base station 30 and a control device (not shown). The cdma2000 1xEV-DO wireless base station 30 establishes a cdma2000 1xEV-DO wireless communication line between the mobile phone 1 and connects the mobile phone 1 to the cdma2000 1xEV-DO high-speed data communication network 3. . The cdma2000 1xEV-DO wireless base station 30 is directly connected to the Internet 5 by the TCP / IP method. The control device controls the cdma2000 1xEV-DO mobile phone network 3 in an integrated manner.
[0035]
Connected to the Internet 5 are an Internet connection server 6, a cdma2000 1xEV-DO wireless base station 30 (cdma2000 1xEV-DO high-speed data communication network 3) and content servers (Internet connection terminals) 7 and 8. Transfer data by / IP method.
[0036]
FIG. 3 is a flowchart showing a DoS detection procedure executed by the mobile phone 1 according to the embodiment of the present invention. The DoS detection process shown in FIG. 3 is roughly divided into the following three processes.
[0037]
In the DoS detection process shown in FIG. 3, first, a transmission source address of received data for a predetermined time (Tdos) is recorded in a DoS access list (see FIG. 5). Thereafter, after the predetermined time (Tdos) has elapsed, the registered number Dn of the DoS access list is compared with a preset threshold value Dt, and the registered number Dn of the access list exceeds the threshold value Dt (Dn> Dt). Therefore, it is determined that the DoS attack state is present, and a system switching process for changing the wireless communication method is performed to avoid the DoS attack.
[0038]
The detailed operation of the DoS detection process shown in FIG. 3 will be described below.
[0039]
In wireless data communication using a mobile phone, the maximum communication speed is set when a data communication line is set between the mobile phone and the wireless base station. In addition to the performance of the mobile phone and the performance of the radio base station, the maximum communication speed between the mobile phone and the radio base station includes the communication quality of the radio communication line between the mobile phone and the radio base station, It is determined according to the state of the wireless communication line such as a free state of the wireless channel (100).
[0040]
During data communication, the mobile phone monitors the transfer rate (downlink received data rate) of received data and detects whether the received data rate has reached the maximum communication rate (101).
[0041]
If the received data rate has reached the maximum communication rate, it is determined that a large amount of data has been transmitted to the mobile phone, and the mobile phone may be under a DoS attack. To start. That is, if the received data rate has reached the maximum communication rate, it is determined whether the DoS monitoring timer is operating (102). If the DoS monitoring timer is not in operation (“No” in 102), the DoS access list is initialized (cleared) (104) as a process before the DoS monitoring timer is started. In order to collect the transmission source addresses that have transmitted data to the mobile phone, a DoS monitoring timer is started (105). Then, the source IP address of the received data is recorded in the DoS access list (106).
[0042]
On the other hand, if the DoS monitoring timer is in operation (“Yes” in 102), the DoS monitoring timer value is compared with a value (Tdos) corresponding to a predetermined monitoring time, and it is determined whether the DoS monitoring timer has timed out. Determine (103). If the DoS monitoring timer has not timed out (“No” in 103), the source IP address of the received data is recorded in the DoS access list (106).
[0043]
On the other hand, if the DoS monitoring timer has timed out (“Yes” in 103), the collection of the transmission source address data is terminated, and the collected transmission source address data is analyzed. That is, the registered number Dn of the DoS access list is compared with a preset threshold value Dt (107). As a result of this comparison, if the registered number Dn of the access list exceeds the threshold value Dt (Dn> Dt), it is determined that a large number of data is transmitted from the large number of transmission source devices to the mobile phone, and the DoS attack state (109).
[0044]
When the DoS attack state is determined, a screen for notifying that there is a possibility of a DoS attack is displayed on the display unit 14 of the mobile phone, and the user is prompted to switch the wireless communication method (109 ). After waiting for a wireless communication system switching instruction from the user (110), a wireless communication system switching process (system switching process) is executed (112). Note that when it is determined that the DoS attack state has occurred, the wireless communication system switching process may be executed without displaying the display unit 14 indicating that there is a possibility of a DoS attack (111). 112).
[0045]
For example, when communicating with the cdma2000 1xEV-DO method, if a DoS attack state is determined, a call is made from the mobile phone using the cdma2000 1x method, and the data communication line is reconnected to be assigned to the mobile phone. IP address to be changed. In particular, since the cdma2000 1x system connects data communication lines by dial-up connection, the IP address assigned to the mobile phone at the time of connection by the cdma2000 1x system is not a constant value.
[0046]
In this embodiment, the communication method is changed by calling from the mobile phone when the DoS attack state is determined. However, when the mobile phone is determined to be in the DoS attack state, the mobile phone performs wireless communication. Notify the network (cdma2000 1x mobile phone network 2, cdma2000 1xEV-DO high-speed data communication network 3, etc.) and call the mobile phone from the wireless communication network to change the communication method. The data communication line may be reconnected.
[0047]
On the other hand, as a result of this comparison, if the access list registration number Dn does not exceed the threshold value Dt (Dn ≦ Dt), a large amount of data is not transmitted from a large number of transmission source devices but a normal access state. The data communication process is continued (108).
[0048]
On the other hand, if the received data rate does not reach the maximum communication rate (“No” in 101), there is no possibility that a large amount of data is transmitted to the mobile phone, and the mobile phone is under a DoS attack. Judgment is made and collection of the source address is stopped. That is, if the received data rate does not reach the maximum communication rate, it is determined whether the DoS monitoring timer is operating (113). If the DoS monitoring timer is operating (“Yes” in 113), the operation of the DoS monitoring timer is stopped. On the other hand, if the DoS monitoring timer is not operating (“No” in 113), the process returns to step 101 to determine whether or not the received data rate has reached the maximum communication rate (101).
[0049]
In this way, when a large number of data is transmitted from a large number of transmission source devices to the mobile phone, it is determined as a DoS attack state, the wireless communication method is switched, and the IP address assigned to the mobile phone is changed. Therefore, since the data transmitted to the mobile phone does not reach the band phone, a DoS attack can be avoided. Further, by switching the wireless communication system itself, the wireless communication line is disconnected, and waste of wireless resources can be prevented. Further, if each switched wireless communication system is a data communication system that assigns an IP address to a mobile phone at the time of connection (for example, a data communication system connected by dial-up connection), an IP assigned to the mobile phone for each line connection. Since the address changes, the data transmitted to the mobile phone can be effectively blocked.
[0050]
FIG. 4 shows the display content of the display unit 14 when the mobile phone 1 detects a DoS attack.
[0051]
At the top of the screen is provided a pictogram for displaying a figure (pictogram) indicating the operating state of the mobile phone. In the pictogram part of the present embodiment, in order from the left, an electric field intensity display indicating the strength of radio waves from the base station received by the mobile phone, a call display indicating a call state, and an incoming call display indicating an incoming mail The battery remaining amount display indicating the operation time of the mobile phone is displayed. In the center of the screen, “There is a possibility of DoS attack. We recommend changing the system. Do you want to change the system?” Says that the mobile phone has received a DoS attack from another computer device. That it is detected that it is detected, and a message prompting the user to change the system. Then, a choice of whether to change the system is displayed.
[0052]
FIG. 5 is an explanatory diagram showing the DoS access list recorded in step 106 of the DoS detection process (FIG. 3).
[0053]
In the DoS access list, the transmission source addresses of received data are stored in the order of reception. Then, after the predetermined monitoring time (Tdos) ends, Dn data transmission source IP addresses are recorded.
[0054]
As described above, the mobile phone 1 according to the present embodiment includes the two wireless communication units of the 1x-EV DO wireless processing unit 11 and the cdma2000 1x wireless processing unit 16 which are different in method, and thus, two wireless communication units. By switching the means, data communication with the base station can be performed with two wireless communication systems, and an overload attack such as a DoS attack from the Internet 5 is performed while data communication is performed with one wireless communication system. If this happens, this can be detected, and the current wireless method can be switched to the other wireless communication method to avoid damage from overload attacks and to prevent the mobile phone from becoming unavailable. be able to.
[Brief description of the drawings]
FIG. 1 is a block diagram showing a configuration of a mobile phone according to an embodiment of the present invention.
FIG. 2 is a configuration diagram of a network system to which a mobile phone according to an embodiment of the present invention is connected.
FIG. 3 is a flowchart showing a DoS detection procedure of the mobile phone according to the embodiment of the present invention.
FIG. 4 shows display contents when a DoS attack of the mobile phone according to the embodiment of the present invention is detected. It is an example of a display at the time of mail arrival.
FIG. 5 is an explanatory diagram of a DoS access list stored in the mobile phone according to the embodiment of this invention.
[Explanation of symbols]
1 Mobile phone (Internet connection terminal)
2 Mobile phone network (cdma2000 1x)
3 High-speed data communication network (1xEV-DO)
4 Public network 5 Internet 6 Internet connection server 7 Content server (Internet connection terminal)
8 Content server (Internet connection terminal)
20 Radio base station (cdma2000 1x)
21 Mobile phone network 22 Public network connection gateway 30 Wireless base station (1xEV-DO)

Claims (6)

In a wireless communication device that has a control unit that controls the operation of the wireless communication device and transmits and receives data by connecting to a wireless communication network,
The control unit detects that the amount of data received from the wireless communication network is a predetermined amount or more over a predetermined period, and the transmission source of the data received over the predetermined period is a predetermined number or more. Upon detection of a radio communication device, characterized in that operate to change the destination of the data to the wireless communication device. The controller is
Detecting means for detecting a transfer rate of data received by the wireless communication device;
Recording means for recording a source address of the data;
If it is detected that the amount of data received from the wireless communication network is a predetermined amount or more over a predetermined period, whether or not the number of addresses recorded in the recording means during the predetermined period is a predetermined number or more. Determination means for determining;
The wireless communication device according to claim 1, further comprising: a destination changing unit that operates to change a data destination for the wireless communication device. It is possible to send and receive data by connecting to the wireless communication network by the first communication method and the second communication method,
3. The control unit according to claim 1, wherein the control unit operates to change a data destination for the wireless communication device by changing a communication method connected to the wireless communication network. Wireless communication equipment. The wireless communication device according to claim 3 , wherein the second communication method assigns a data destination to the wireless communication device every time the wireless communication device is connected. In a wireless communication system comprising: a wireless communication network; and a wireless communication device connected to the wireless communication network to transmit and receive data,
The wireless communication device detects that the amount of data received from the wireless communication network is a predetermined amount or more over a predetermined period, and the transmission source of the data received over the predetermined period is a predetermined number or more When this is detected, the wireless communication network is notified,
The wireless communication system, wherein the wireless communication network changes a data destination for the wireless communication device based on a notification from the wireless communication device. It is possible to send and receive data by connecting the wireless communication network and the wireless communication device by the first communication method and the second communication method,
6. The wireless communication system according to claim 5, wherein a destination of data for the wireless communication device is changed by changing a communication method for connecting the wireless communication network and the wireless communication device.

Images