JP4732858B2 - Packet filtering apparatus and packet filtering program - Google Patents

Description

  The present invention relates to a packet filtering apparatus and a packet filtering program that perform packet filtering.

  Conventionally, as one of the functions of an Internet application, there is a case where communication with an unspecified number of terminals is performed on an open network. Therefore, measures have been taken to ensure security for a terminal on which the application is installed. .

  As a measure for ensuring such security, a communication line is physically connected between an internal network such as a closed network (for example, a corporate LAN) and an external network such as a wide area network (for example, a public network or the Internet). A device for controlling (for example, refer to Non-Patent Document 1) is provided, and unauthorized access from the external network to the internal network or from the internal network to the external network, computer virus, DoS (Denial of Service) attack, etc. In some cases, the internal network is protected by physically disconnecting and controlling the communication line. In addition, there is also a mode in which devices that physically control communication lines are widely deployed throughout the wide area on the ISP (Internet Service Provider) side that provides the wide area network, such as routers constituting the wide area network provided. Are known.

"Stateful inspection technology", [online], [searched on September 28, 2005], Internet <http://www.checkpoint.co.jp/products/download/Stateful_Inspection.pdf>

  By the way, in the above-described conventional technology, a company using a wide area network or an ISP provider providing a wide area network needs to deploy a device for performing security measures for each connection point between the closed network and the wide area network. There was a problem of large capital investment and increase in operation cost.

  In addition, since security measures of a company using a wide area network depend on the company, there are problems such as inconsistency of security measures due to different security perceptions and increased damage due to omission of security information update.

  Accordingly, the present invention has been made to solve the above-described problems of the prior art, and prevents redundant equipment investment and operation costs for security measures for both ISP contractors and companies. An object of the present invention is to provide a packet filtering device capable of preventing inconsistency of security measures and omission of update of security information.

In order to solve the above-described problems and achieve the object, the present invention is connected to a wide area network or each of a plurality of different predetermined closed networks via another closed network, and the wide area network or the predetermined closed network A packet filtering device for filtering packets transmitted to and / or packets transmitted from the wide area network or the predetermined closed network, and a plurality of filter means for filtering the packets according to the type of the packet; the packet transmitted from the wide area network or a packet and / or the plurality of terminal devices each being sent to a plurality of terminal devices each connected to the predetermined closed network each, each said wide area network or the predetermined closed network packet receiving means for receiving via said another closed network that is connected to, path received by the packet receiving means And distributing the packet distributing means to said plurality of filter means Tsu bets according to the type of the packet, a packet delivery means for delivering the filtered packets to the destination by the plurality of filter means, the predetermined closed network Address information used in the wide area network for each of a plurality of terminal devices connected to the network, and global address information set in the packet filtering apparatus and address information used in the predetermined closed network Address information storage means for storing private address information in association with each other, wherein the packet delivery means causes the packet receiving means to send a packet addressed to a terminal device connected to the predetermined closed network via the wide area network. If the packet is received, the address information storage means is referred to determine the destination of the packet. The packet address information is changed from private address information to private address information and delivered via the other closed network to which the destination is connected, and a packet addressed to a terminal device connected to the predetermined closed network is sent via the other closed network. If received, the address information storage means is referred to change the source of the packet from private address information to global address information, and the destination of the packet is changed from global address information to private address information. When the packet addressed to the terminal device connected to the wide area network is received via the other closed network, the address information storage means is referred to. Replacing the source of the packet from private address information to global address information It is characterized by being delivered via a network .

Further, the present invention is characterized in that, in the above invention, the packet delivery means delivers the packet to the terminal device via a secure transmission path.

Also, the present invention is characterized in that, in the above invention, the packet receiving means receives the packet from the terminal device via a secure transmission path.

Also, the present invention is characterized in that, in the above invention, the packet distribution means distributes according to the type of application that processes the packet received by the packet reception means.

According to the present invention, packets are received and filtered on a wide area network (for example, public network, Internet, etc.) or a closed network connected thereto, and are distributed to a transmission destination. There is no need to take security measures for each connection point, and it is possible to prevent redundant equipment investment and increase in operating costs for security measures for both ISP providers providing wide area networks and companies using wide area networks. In addition, it is not necessary to take different security measures for each company using a wide area network, and it is possible to prevent inconsistency of security measures and omission of update of security information.

Further, according to the present invention, since the packet is delivered to the terminal device through the secure transmission path, the filtered packet can be safely delivered to the transmission destination without being exposed to danger such as eavesdropping. It is.

In addition, according to the present invention, since address information corresponding to the terminal device is delivered by being replaced with the packet received by the packet receiving means, it can be correctly delivered to the terminal device which is the original transmission destination, and the transmission can be performed. It is possible to receive a packet that has been replaced with a source address that can be sent back.

In addition, according to the present invention, since the packet from the terminal device is received through the secure transmission path, it is possible to safely receive the packet from the terminal device of the transmission source without being exposed to danger such as eavesdropping. It is.

Further, according to the present invention, since the packet received by the packet receiving means is distributed to the plurality of filters according to the type of the packet and filtered, a plurality of security functions can be aggregated and deployed at one point, for example, Various security measures such as unauthorized access, computer virus, and Dos attack can be taken, and it is possible to prevent redundant capital investment and an increase in operation cost of security measures.

In addition, according to the present invention, since the packet received by the packet receiving means is sorted and filtered according to the type of application, for example, security measures corresponding to various applications such as HTTP and MAIL can be taken. It is possible to prevent redundant capital investment and increase in operation cost.

Further, according to the present invention, since the packet received by the packet receiving means is sorted and filtered according to the contract status of the terminal device, the wide area network or the closed area network, only the security measures necessary for the contractor can be taken. It is possible to prevent redundant capital investment and increase in operation cost.

Further, according to the present invention, the packet received by the packet receiving means is sorted and filtered according to the load status of the plurality of filter means. For example, it is possible to give priority to a filter with a low load. It is possible to prevent packet delay due to filtering.

  Embodiments (embodiments 1 and 2) of a packet filtering apparatus according to the present invention will be described below in detail with reference to the accompanying drawings.

  In the following first embodiment, the outline and features of the packet filtering device according to the present invention, the configuration and processing flow of the packet filtering device, and the effects of the first embodiment will be described in order.

[Outline and features of packet filtering device]
First, the outline and features of the packet filtering apparatus according to the present embodiment will be described with reference to FIG. FIG. 1 is a system configuration diagram illustrating an overall configuration of a system including a packet filtering apparatus according to the present embodiment.

  This packet filtering device is designed to perform security measures by filtering packets, and can prevent redundant capital investment and increase in operating costs for security measures, and inconsistent security measures The main feature is that it is possible to prevent omissions in updating security information.

  As shown in the figure, the packet filtering device 11, the A corporate LAN 12, the B corporate LAN 13, the C corporate LAN 14, and the D corporate LAN 15 are formed by a wide area network 10 (public network, Internet network, or the like). Communication network). The corporate LAN 12 and the corporate LAN 13 are under a security service contract provided by the packet filtering device 11.

  A terminal device is connected to each in-house LAN, and a private address (hereinafter referred to as PIP) that can be used only within the LAN is set in the terminal device. Specifically, a terminal device A 12 a in which PIP (10.1.1.1) is set is connected to the A corporate LAN 12, and a PIP (10.2.2.2) is connected to the B corporate LAN 13. Is set, the terminal 14a with PIP (10.3.3.3) is connected to the corporate LAN 14 and the corporate IP 14P is connected to the corporate LAN 14P. The terminal device 15a to which 10.4.4.4) is set is connected.

  In addition, the packet filtering device 11 includes a global IP address uniquely assigned to enable communication on the wide area network 10 by the terminal device A 12a and the terminal device B 13a connected to the corporate LAN under contract. Addresses (hereinafter referred to as GIP) 1.1.1.1 and 2.2.2.2 are set. Further, the packet filtering device 11 includes PIP (10.1.1.1 and 10.2.2.2) and GIP (1.1.1.1 and 2.2.2.2) of the terminal devices under contract. GIP / PIP information 19 associated with 2) is stored.

  The packet filtering device 11 and the in-company LAN 12 and the in-company LAN 13 that are under contract are connected by virtual LANs, and a wide area for terminal devices connected to the in-company LAN under contract. Input / output traffic with the network 10 is configured to pass through the packet filtering device 11.

  Under such a system configuration, the packet filtering device 11 receives a packet transmitted to a terminal device under contract and / or a packet transmitted from a terminal device under contract with a wide area network, and receives the received packet. After filtering, the packet is delivered to the destination.

  For example, when a packet is transmitted from a terminal device D15a that is not under contract to a terminal device A12a (1.1.1.1) that is under contract, the packet is transmitted to the GIP (in the wide area network 10 of the terminal device A12a). 1.1.1.1) is transmitted to the wide area network 10 and is received by the packet filtering device 11 in which GIP (1.1.1.1) is actually set. Then, the packet filtering device 11 filters the received packet, and the destination of the filtered packet is the destination PIP (10.1...) In the virtual LAN connection corresponding to GIP (1.1.1.1). 1.1) and delivered to the terminal device A 12a as the transmission destination through a virtual LAN connection.

  When a packet is transmitted from the terminal device A12a (10.1.1.1) under contract to the terminal device B13a (2.2.2.2) under contract, the packet is virtual Passes through the packet filtering device 11 in the process of going to the gateway for exiting to the wide area network 10 via a simple LAN connection (received in layer 2 but passes in layer 3). At that time, the packet filtering device 11 filters the packet, and sends the transmission source to the GIP (1.1.1.1) corresponding to the PIP (10.1.1.1) that is the transmission source of the filtered packet. In addition, it is delivered via the wide area network 10 to the terminal device B 13a. The packet is received by the packet filtering device 11 in which GIP (2.2.2.2) is actually set in the wide area network 10. Then, the packet filtering device 11 filters the received packet, and sets the destination of the filtered packet as the destination PIP (10.2.) In the virtual LAN connection corresponding to GIP (2.2.2.2). In other words, the packet is delivered to the terminal device B 13a through a virtual LAN connection.

  When a packet is transmitted from the terminal device A12a (10.1.1.1) under contract to the terminal device C14a (3.3.3.3) not under contract, the packet is virtually Passes through the packet filtering device 11 in the process of going to the gateway for exiting to the wide area network 10 via a simple LAN connection (received in layer 2 but passes in layer 3). At that time, the packet filtering device 11 filters the packet, and sends the transmission source to the GIP (1.1.1.1) corresponding to the PIP (10.1.1.1) that is the transmission source of the filtered packet. In exchange, it is delivered to the terminal device C 14 a (3.3.3.3) via the wide area network 10.

  In addition, when a packet is transmitted from the terminal device C12a that is not under contract to the terminal device D15a (4.4.4.4) that is not under contract, the packet does not pass through the packet filtering device 11, The terminal device D15a to which GIP (4.4.4.4) is assigned receives (receives not only in layer 3 but also in layer 2).

[Configuration of packet filtering device]
Next, the configuration of the packet filtering device will be described with reference to FIG. FIG. 2 is a block diagram illustrating a configuration of the packet filtering apparatus. As shown in the figure, the packet filtering device 20 includes a packet receiving unit 21, a filtering unit 22, and a packet delivery unit 23.

  Among these, the packet receiving unit 21 is a means for receiving a packet. Specifically, a packet whose destination is the GIP of a terminal device (for example, the terminal device A 12a and the terminal device B 13a) connected to the corporate LAN under contract is received from the wide area network 10. In addition, a packet transmitted from a PIP of a terminal device under contract to a GIP that is a wide area network is received via a virtual LAN connection.

  For example, when the terminal device A12a under contract receives a packet using the wide area network 10, PIP (10.1.1.1) is set in the terminal device A12a, and the packet filtering device 11 Is set to GIP (1.1.1.1). Therefore, the packet filtering device 11 receives a packet whose destination is GIP (1.1.1.1). The same applies to the terminal device B13a. The packet receiving unit 21 corresponds to “packet receiving means” recited in the claims.

  The filtering unit 22 is means for filtering received packets. Specifically, the packet distribution unit 22a, the URL filter 22b, the AntiVirus filter 22c, and the SPAM filter 22d are configured. The filtering unit 22 corresponds to the “filtering unit” described in the claims, the packet distribution unit 22a corresponds to the “packet distribution unit”, and the URL filter 22b to the SPAM filter 22d are Similarly, it corresponds to “a plurality of filter means”.

  Among these, the packet distribution unit 22a is means for distributing the received packet to a plurality of filters according to the type. Specifically, the port number indicating the application type of the destination of the received packet and the source IP Sort to a plurality of filters by address or destination IP address. For example, as shown in FIG. 3, when the destination port number is HTTP (HyperText Transfer Protocol), the distribution is made to the URL filter 22b, and the destination port number is SMTP (Simple Mail Transfer Protocol) and the destination. When the IP address is 1.1.1.1, the IP address is distributed to the AntiVirus filter 22c.

  Further, the packet distributed to one of the filters returns to the packet distribution unit 22a again after filtering. The packet distribution unit 22a distributes the packet to the next filter when the next filtering needs to be performed, and transfers the packet to the packet distribution unit 23 when the filtering is not necessary. Specifically, when the destination port number is SMTP (Simple Mail Transfer Protocol) and the source IP address is 10.2.2.2, first, the distribution is performed to the AntiVirus filter 22c, and the packet distribution is performed again after the filtering. Returning to the unit 22a, next, it distributes to the SPAM filter 22d.

  The URL filter 22b is a means for filtering by URL, and specifically performs filtering such as a browsing prohibited URL. For example, when a URL whose origin is unknown or a free mail is prohibited, filtering is performed so that the URL cannot be accessed even if an attempt is made to access the URL.

  The AntiVirus filter 22c is a means for filtering a computer virus. Specifically, the AntiVirus filter 22c includes a virus detection application, and filters whether a computer virus has sneaked into a received packet.

  The SPAM filter 22d is a means for filtering spam mails, and specifically filters packets including the structure of spam mails that distribute the same contents in large quantities.

  The packet delivery unit 23 is a means for delivering the filtered packet to the original transmission destination. Specifically, for a packet received via a wide area network whose destination is GIP (1.1.1.1 or 2.2.2.2), the destination GIP (1.1.1.1) Or, the packet is delivered via a virtual LAN connection in place of the PIP (10.1.1.1 or 10.2.2.2) corresponding to 2.2.2.2). For packets received via a virtual LAN whose source is PIP (10.1.1.1 or 10.2.2.2), the source PIP (10.1.1.1 or The GIP (1.1.1.1 or 2.2.2.2) corresponding to 10.2.2.2) is replaced and delivered to the wide area network 10 (see FIG. 4). Further, the packet delivery unit 23 includes a storage unit, and stores GIP / PIP information 19 for realizing replacement of GIP and PIP.

[Processing by packet filtering device]
Next, processing performed by the packet filtering apparatus will be described with reference to FIG. FIG. 5 is a flowchart showing the flow of packet filtering processing.

  First, when the packet receiving unit 21 receives a packet (Yes at Step S501), the packet distribution unit 22a distributes the packet to one of a plurality of filter units according to the type of packet (Step S502). For example, when the application type of the destination of the received packet is HTTP, it is distributed to the URL filter 22b.

  Subsequently, one of the plurality of filtering filters the packet according to the application type of the received packet (step S503). For example, the URL filter 22b performs filtering such as a browsing prohibited URL.

  Then, the packet delivery unit 23 adds the address information of the transmission source to the received packet and delivers it to the transmission destination. For example, when the transmission source is the terminal device A12a under contract, based on the stored GIP / PIP information 19, GIP is attached to the PIP and delivered.

[Effect of Example 1]
As described above, according to the first embodiment, a packet whose destination is a terminal device under contract (for example, the terminal device A12a connected to the corporate LAN A) is received by the wide area network, and the received packet And the filtered packets are delivered to the terminal device, so there is no need to take security measures for each connection point between the wide area network and the closed area network, and ISP companies that provide the wide area network and companies that use the wide area network In both cases, it is possible to prevent redundant capital investment and increase in operating costs for security measures, and there is no need to implement different security measures for each company using a wide area network. It is possible to prevent omission of information update.

  In addition, according to the first embodiment, since address information corresponding to a terminal device under contract is delivered in the received packet, it can be correctly delivered to the terminal device that is the original transmission destination, It is possible to receive a packet that has been changed to a source address to which the transmission destination can reply.

In addition, according to the first embodiment, the packet filtering device includes a plurality of filters that filter received packets according to the type of the packet, and the received packets are filtered by a plurality of filters according to the type of the packet. Since it is distributed to either, multiple security functions can be aggregated and deployed at one point, for example, various security measures such as unauthorized access, computer virus, Dos attack can be performed for each filter,
It is possible to prevent redundant capital investment for security measures and an increase in operation costs.

Further, according to the first embodiment, since the received packet is distributed according to the type of application that processes the packet, for example, security measures corresponding to various applications such as HTTP and MAIL can be taken, and redundant security measures can be taken. It is possible to prevent an increase in capital investment and operation costs.

  Although the packet filtering apparatus according to the first embodiment has been described so far, the present invention may be implemented in various different forms other than the above-described embodiments. Therefore, various different modes will be described below as a second embodiment.

  Further, in the above-described first embodiment, for the sake of convenience, FIG. 1 illustrates packet transmission / reception between two in-company LANs under contract and two in-company LANs under contract, but the present invention is not limited to this. The in-company LAN under contract may be increased or decreased, and the in-company LAN not under contract is connected to the wide area network 10 in the same manner as the C in-company LAN 14 and the D in-company LAN 15.

  Further, in the first embodiment described above, it is described that the security countermeasure service provided by the packet filtering device is contracted by the in-house LAN, but the present invention is not limited to this, and the terminal device is You may contract individually. In this case, the terminal device under the contract and the packet filtering device are connected by a virtual LAN.

  In the first embodiment described above, packet transmission / reception between the packet filtering device 11 and the terminal device connected to the closed network under contract (for example, the terminal device A12a connected to the corporate LAN 12) has been described. However, the present invention is not limited to this, and for example, packet filtering may be performed for packet transmission / reception with a terminal device directly connected to the wide area network 10 under contract.

  In the first embodiment, the case where the packet filtering apparatus is installed in the wide area network has been described. However, the present invention is not limited to this, and the data connected to the wide area network as shown in FIG. The packet filtering device 11 may be installed at a center or the like (for example, the LAN 60).

  In the first embodiment, the packet receiving unit 21 of the packet filtering apparatus 11 and the in-company A LAN 12 and the in-B company LAN 13 are connected to a secure line (for example, IPsec (Security Architecture for Internet Protocol), You may connect by VPN (Virtual Private Network), a private line, etc. which are implement | achieved by security protocols, such as TLS (Transport Layer Security) or SSL (Secure Sockets Layer). As a result, since the packet from the terminal device is received via the secure transmission path, it is possible to safely receive the packet from the terminal device of the transmission source without adding unauthorized information after filtering. .

  In the first embodiment, the packet delivery unit 23 of the packet filtering apparatus 11 is connected to the A corporate LAN 12 and the B corporate LAN 13 under contract with a secure line (for example, a VPN or a dedicated line). May be. Thus, since the packet is delivered to the terminal device via the secure transmission path, the filtered packet can be safely delivered to the destination terminal device without being exposed to danger such as eavesdropping. .

  In the first embodiment described above, the case of three types of filters in the packet filtering device has been described for convenience. However, the present invention is not limited to this, and the type or number of filters may be increased or decreased depending on the application. You may let them.

  In the first embodiment, the packet distribution unit 22a distributes the received packet to a plurality of filters based on the port number indicating the application type of the transmission destination of the received packet and the transmission source IP address or transmission destination IP address. Although described above, the present invention is not limited to this, and for example, the terminal device, distribution according to the contract status between the wide area network and the closed area network may be performed. Specifically, when contracting URL filtering and AntiVirus filtering with Company A and contracting with AntiVirus filtering only with Company B, packets with Company B as the source and destination are not distributed to the URL filter. .

  In the first embodiment described above, the packet distribution unit 22a distributes the received packet to a plurality of filters based on the port number indicating the transmission destination application type and the transmission source IP address or transmission destination IP address. However, this invention is not limited to this, For example, you may distribute according to the load condition of a some filter part. Specifically, a plurality of AntiVirus filters are prepared, and the filter is assigned with priority over the filter with the smallest load.

  Further, in the above-described first embodiment, the case where the port number indicating the application type of the transmission destination of the packet is identified and distributed to each filter has been described, but the present invention is not limited to this, The application type may be identified by other information included in the packet such as a payload (data portion excluding the packet header).

  In the first embodiment, the GIP / PIP information shown in FIG. 4 is information corresponding to the IP address. However, the present invention is not limited to this, and is divided into, for example, a plurality of network subnets. The network address may be used.

  Further, in the above-described first embodiment, a case has been described where one ISP provider provides packet filtering devices in a consolidated manner, but the present invention is not limited to this, and ISPs having different expertise for each filter. You may make it provide a trader.

  Further, each component of each illustrated apparatus is functionally conceptual, and does not necessarily need to be physically configured as illustrated. In other words, the specific form of distribution / integration of each device is not limited to the one shown in the figure, and all or a part thereof can be functionally or physically wide-area in arbitrary units depending on various loads and usage conditions. It can be distributed and integrated in a closed network connected to a network or a wide area network. Further, all or any part of each processing function performed in each device may be realized by a CPU and a program analyzed and executed by the CPU, or may be realized as hardware by wired logic.

  In the above embodiment, the packet filtering device that implements the present invention has been described from the functional aspect. However, each function of the packet filtering device may be realized by causing a computer such as a personal computer or a workstation to execute a program. it can. That is, the various processing procedures described in the above embodiments can be realized by executing a program prepared in advance on a computer. These programs can be distributed via a network such as the Internet. Further, these programs can be recorded on a computer-readable recording medium such as a hard disk, a flexible disk (FD), a CD-ROM, an MO, and a DVD, and can be executed by being read from the recording medium by the computer. That is, for example, a packet filtering device as shown in the embodiment or a CD-ROM storing a plurality of filters (may be a separate CD-ROM for each device) is distributed and this CD-ROM is distributed. Each computer may read and execute the program stored in the computer.

  As described above, the packet filtering apparatus according to the present invention is useful for filtering packets. In particular, for both ISP contractors and enterprises, it is possible to increase the redundant capital investment and operation cost of security measures. In addition to being able to prevent, it is suitable for preventing inconsistency of security measures and omission of update of security information.

1 is a system configuration diagram illustrating an overall configuration of a system. It is a block diagram which shows the structure of a packet filtering apparatus. It is a route diagram which shows the filter which distributes. It is a figure which shows GIP * PIP information. It is a flowchart which shows the flow of a packet filtering process. It is a figure at the time of installing the packet filtering apparatus in LAN.

Explanation of symbols

10 Wide area network 11 Packet filtering device 12 A Corporate LAN
12a Terminal device A
13 B Corporate LAN
13a Terminal device B
14C corporate LAN
14a Terminal device C
15 D Corporate LAN
15a Terminal device D
16 Virtual LAN that connects the packet filtering device to the corporate LAN
17 Virtual LAN that connects the packet filtering device to the corporate B LAN
18 Line connecting packet filtering device and wide area network 19 GIP / PIP information 20 Packet filtering device 21 Packet receiving unit 22 Filtering unit 22a Packet distribution unit 22b URL filter 22c AntiVirus filter 22d SPAM filter 23 Packet delivery unit 60 LAN

Claims (4)

Packets transmitted to the wide area network or the predetermined closed network and / or the wide area network or the predetermined closed network connected to the wide area network or different predetermined closed networks through different closed networks A packet filtering device for filtering packets transmitted from
A plurality of filter means for filtering the packet according to the type of the packet;
The packet transmitted from the wide area network or a packet and / or the plurality of terminal devices each being sent to a plurality of terminal devices each connected to the predetermined closed network each, each said wide area network or the predetermined closed network packet receiving means for receiving via said another closed network that is connected to,
A packet distribution unit that distributes the packet received by the packet reception unit to the plurality of filter units according to the type of the packet;
A packet delivery means for delivering a packet filtered by the plurality of filter means to a destination;
For each of a plurality of terminal devices connected to the predetermined closed network, address information used in the wide area network and used in the predetermined closed network and global address information set in the packet filtering device. Address information storage means for storing in association with private address information that is address information,
The packet delivery means refers to the address information storage means when the packet receiving means receives a packet addressed to a terminal device connected to the predetermined closed network via the wide area network. The destination is changed from the global address information to the private address information and delivered via the other closed network to which the destination is connected, and the packet addressed to the terminal device connected to the predetermined closed network is sent to the other closed network. When received via the network, the address information storage means is referred to change the source of the packet from the private address information to the global address information, and the destination of the packet is changed from the global address information to the private address information. And delivered via the other closed network to which the destination is connected, When a packet addressed to a terminal device connected to the network is received via the other closed network, the source of the packet is changed from private address information to global address information with reference to the address information storage means, and A packet filtering device for delivery via a wide area network .   The packet filtering device according to claim 1, wherein the packet delivery unit delivers the packet to the terminal device via a secure transmission path. It said packet receiving means, a packet filtering device according to claim 1 or 2, characterized in that to receive the packet from the terminal device via a secure transmission channel. The packet sorting unit, the packet filtering device according to any one of claims 1-3, characterized in that distribute according to the type of application that processes a packet received by said packet receiving means.

Images