JP6180613B2 - COMMUNICATION DEVICE, COMMUNICATION CONTROL METHOD, AND PROGRAM - Google Patents

Description

  The present invention relates to a communication device, a communication control method, and a program.

  Conventionally, a communication device such as a portable terminal capable of data communication is known (for example, see Patent Document 1). The communication device may employ a configuration in which data communication by an application running on the communication device is permitted by default, but only data communication by an application selected by the user is prohibited.

  Here, the communication device performs permission or prohibition of data communication by filtering processing. Further, the communication device counts the data communication amount for management. The data to be counted is data for which data communication is permitted in the filtering process.

JP, 2015-162701, A

  In this case, depending on the method for counting the amount of data communication, there may be a difference between the count of the data communication amount and the amount of data actually transmitted to the network side.

  Therefore, the present invention has been made in view of the above points, and provides a communication device, a communication control method, and a program capable of reducing the difference between the count of data communication amount and the amount of data actually transmitted to the network side. The purpose is to do.

A communication device according to an embodiment of the present invention that achieves the above object is as follows.
Data communication is prohibited by default,
Receives a data communication request from the application,
According to the UID of the requested application, the data communication of the application is permitted and the data communication amount of the application is counted.
Depending ID of group to which the requested application belongs, in response to the UID to avoid counting the data traffic of the application that the data communication is permitted.

In addition, a communication device according to an embodiment of the present invention,
Depending ID of the group before Symbol requested application belongs may prohibit data communication of the application.

A communication device according to an embodiment of the present invention that achieves the above object is as follows.
When the requested UID of the application satisfies the filtering condition for communication permission, the data communication amount of the application is counted.
Depending on the ID of the group to which the requested application belongs, the data traffic of the application may not be counted.

In addition, a communication device according to an embodiment of the present invention,
Data communication of all applications may be prohibited by default .
In addition, a communication device according to an embodiment of the present invention,
Based on the communication permission condition according to the UID and the communication prohibition condition according to the group ID , even if the UID of the requested application satisfies the communication permission condition, the ID of the group to which the application belongs is the communication. If the prohibition condition is also satisfied, a packet filter may be provided so as not to count the data communication amount of data communication based on the request of the application.

In addition, a communication control method according to an embodiment of the present invention includes:
In the communication device,
A step of prohibiting data communication by default;
Receiving a data communication request from the application;
Depending on the UID of the requested application, the data communication of the application is permitted and the amount of data communication of the application is counted. However , depending on the ID of the group to which the requested application belongs, the data depends on the UID. communication is permitted and a step to avoid counting the data traffic of the application.

In addition, a program according to an embodiment of the present invention is
To a computer that functions as a communication device,
A step of prohibiting data communication by default;
Receiving a data communication request from the application;
Depending on the UID of the requested application, the data communication of the application is permitted and the amount of data communication of the application is counted. However , depending on the ID of the group to which the requested application belongs, the data depends on the UID. and a step of not to count the data traffic of the application communication is permitted.

  According to the communication device, the communication control method, and the program according to the embodiment of the present invention, it is possible to reduce the difference between the count of the data communication amount and the data amount actually transmitted to the network side.

2 is a functional block diagram illustrating a schematic configuration example of a communication apparatus according to Embodiment 1. FIG. 1 is a diagram illustrating an appearance of an example of a communication device according to Embodiment 1. FIG. 3 is a block diagram illustrating an example of a data flow according to Embodiment 1. FIG. It is a figure explaining the sequence of the filtering process which concerns on Embodiment 1. FIG. It is a figure explaining an example of the sequence which transmits data from an application. It is a figure explaining the sequence of the filtering process which concerns on Embodiment 2. FIG. 10 is a flowchart of filtering processing according to the third embodiment. 14 is a flowchart of data amount counting processing according to the fourth embodiment. It is a flowchart of the data amount count process which concerns on a comparative example.

(Embodiment 1)
Hereinafter, a communication device according to an embodiment will be described in detail with reference to the drawings. The communication apparatus according to the present embodiment can be a mobile device such as a mobile phone or a smartphone. However, the communication device according to the present embodiment is not limited to a portable device, and performs data communication such as a desktop PC, a notebook PC, a tablet PC, a home appliance, an industrial device (FA device), a dedicated terminal, and the like. Various electronic devices can be provided.

[Device configuration]
FIG. 1 is a functional block diagram illustrating a schematic configuration example of the communication device 1 according to the present embodiment. As illustrated in FIG. 1, the communication device 1 includes a control unit 10, a communication unit 11, a storage unit 12, a display unit 13, and an operation unit 14. The control part 10 is connected to the communication part 11, the memory | storage part 12, the display part 13, and the operation part 14, and controls these.

  The control unit 10 can be configured by an operating system (hereinafter also referred to as an OS) and a processor or a microcomputer that can execute application software (hereinafter also referred to as an application). The OS is, for example, Android (registered trademark). The application will be described later.

  The communication unit 11 includes an I / F (interface) device 111 as a communication interface for performing cellular communication, wireless LAN communication, or the like. The I / F device 111 includes a modem 112 and a wireless LAN device 113. The communication unit 11 is connected to a network side such as the Internet using the I / F device 111, and performs data communication with the network side. As a result, the communication device 1 can perform data communication with the network side. The communication unit 11 is connected to the control unit 10 and acquires data to be output to the network side from the control unit 10. The control unit 10 selects data to be output to the communication unit 11 by filtering processing. The filtering process will be described later. Further, the control unit 10 acquires data received from the network side from the communication unit 11.

  When connected to the network side by the cellular communication method, a charge system based on a pay-per-use system is generally adopted in which a communication fee increases in accordance with an increase in the amount of data (packets) to be communicated. On the other hand, when connected to the network side by a method such as wireless LAN communication, it is generally not such a fee structure.

  The storage unit 12 can be configured by, for example, a semiconductor memory. The storage unit 12 stores various information or data, or a program such as an OS or application executed by the control unit 10. The control unit 10 acquires and executes a program stored in the storage unit 12. The control unit 10 stores data generated by executing the program in the storage unit 12. The storage unit 12 can also function as a work memory.

  The display unit 13 displays characters, images, operation objects, pointers, and the like based on information acquired from the control unit 10. The display unit 13 is, for example, a display device such as a liquid crystal display, an organic EL display, or an inorganic EL display, but is not limited thereto.

  The operation unit 14 includes a physical key such as a numeric keypad, a touch pad, or a touch panel. The control unit 10 moves a pointer or the like displayed on the display unit 13 or selects an operation object according to the input content acquired from the operation unit 14.

  FIG. 2 is a diagram illustrating an appearance of an example of the communication device 1 according to the present embodiment. As shown in FIG. 2, the communication device 1 according to the present embodiment is a so-called folding (flip type or clamshell type) feature phone. In the communication device 1, the upper housing 2 and the lower housing 3 are connected by a hinge portion 4 so as to be rotatable. The upper housing 2 includes a display unit 13, and the lower housing 3 includes an operation unit 14. The operation unit 14 includes a touch pad 141 in a portion where no physical key is provided in addition to a physical key such as a numeric keypad. For example, the communication device 1 accepts an operation for selecting an operation object using a physical key, and accepts a movement operation such as a pointer using a touch pad 141.

[application]
The application is installed in the communication device 1 so as to be executable by the control unit 10 and stored in the storage unit 12. When an application is installed in the communication device 1, a unique user identifier (hereinafter also referred to as UID) is assigned to each application. The application is executed by the control unit 10 as a process associated with the UID on the OS.

  When the application is executed by the control unit 10, the application accesses a resource such as a file system. When each application accesses a resource indefinitely, the use area of the resource by each application may overlap, and in this case, the application may not be executed normally. Therefore, access to resources is restricted by a UID associated with a process executed on the OS so that resource usage by applications does not affect each other. That is, the resources accessible from each process are limited to the resources of processes associated with the same UID.

  Each application is further assigned a group identifier (hereinafter also referred to as GID or group ID). The GID specifies a group to which a unique UID assigned to each application belongs. Only one UID may belong to one group, or a plurality of UIDs may belong to one group. When an application is executed as a process associated with a UID, this process is also associated with a GID. Further, the resources accessible from each process may be limited by extending the target to the resources of the processes associated with the same GID as well as the same UID.

  The application is executed in the foreground (hereinafter also referred to as FG) or the background (hereinafter also referred to as BG). The state in which the application is being executed by the FG is, for example, a state in which the execution status is displayed on the display unit 13 so that the user can confirm, or the user can operate using the operation unit 14. The state in which the application is being executed by the BG is, for example, a state in which the execution status is not displayed on the display unit 13 and the user cannot operate, or the user is operating unintentionally.

[Data communication control]
An application executed by the control unit 10 uses the communication unit 11 to perform data communication with a network side such as the Internet. As described above, the application is executed as a process associated with the UID on the OS. A UID is associated with data transmitted from the application. The control unit 10 determines whether to permit or prohibit (restrict) data transmission based on the UID associated with the data, thereby permitting or prohibiting data communication related to data transmitted from each application. You can control. Hereinafter, in the description according to the present embodiment, data communication refers to data communication performed in principle by the communication unit 11 with the network side.

  FIG. 3 is a block diagram illustrating an example of a data flow according to the present embodiment. In FIG. 3, a control unit 10 and a communication unit 11 are provided on the terminal side. Then, the communication unit 11 is connected to the network side and performs data communication with the network side.

  In FIG. 3, the control unit 10 executes an application A 16a and an application B 16b as processes on the OS. The application executed by the control unit 10 requests data communication with the network side as necessary. For example, the application A 16a requests data transmission toward the network side. In this case, the data transmitted from the application A 16a toward the network side is input to the packet filter 15 operating in the control unit 10. Similarly, data transmitted from the application B 16b to the network side is input to the packet filter 15 from the application B 16b.

  The packet filter 15 performs a data filtering process from the control unit 10 toward the network side. The filtering process is a process for determining whether to permit or prohibit transmission of data requested by an application based on a set filtering condition. The filtering condition includes, for example, ip_rule or ip_route. These filtering conditions are stored in the storage unit 12 and referred to by the packet filter 15. Hereinafter, the operation of setting the filtering condition includes an operation of storing the filtering condition in the storage unit 12. The filtering condition may be held in the control unit 10 without being stored in the storage unit 12.

  ip_rule includes, for example, a condition for determining whether data whose transmission source is X may be transmitted to the network side. ip_route includes, for example, a condition for determining a route (such as a relay router) for transmitting data in which Y is specified as a transmission destination to the network side.

  In FIG. 3, the flow of data transmitted from the application A 16a is indicated by a solid line arrow, and the flow of data transmitted from the application B 16b is indicated by a broken line arrow. Among these, the data transmitted from the application A 16 a is not prohibited from being transmitted by the filtering process in the packet filter 15 and is transmitted to the communication unit 11. On the other hand, transmission of data transmitted from the application B 16 b is prohibited by the filtering process in the packet filter 15 and is not transmitted to the communication unit 11. This operation is shown in FIG. 3 by pointing the dashed arrow to the description “reject”.

  Data that has passed through the packet filter 15 (in the case of FIG. 3, data transmitted from the application A 16 a indicated by a solid arrow) is input to the communication unit 11. The communication unit 11 transmits data to the network side using the I / F device 111. When transmitting data to the network side, the communication unit 11 can appropriately determine whether to use cellular communication by the modem 112, use wireless LAN communication by the wireless LAN device 113, or use another communication method.

[Filtering processing]
Whether data communication for data transmitted from the application is permitted or prohibited is determined based on the UID assigned to the data transmission source application. Hereinafter, data transmitted from an application to which X is assigned as a UID (hereinafter also referred to as an application having a UID X) is also referred to as data having a UID X. Further, the filtering condition used for performing the filtering process of the data with the UID X is also referred to as the filtering condition for the data with the UID X.

  For example, the packet filter 15 has a filtering condition of permitting only data communication related to data transmitted from an application having a UID of 1. Further, the filtering condition may be a combination of a plurality of conditions.

  Here, a data communication sequence when the filtering process according to the present embodiment is performed will be described. The filtering process according to the present embodiment is based on the premise that permission or prohibition of data communication related to data transmitted by an application operating in BG is determined. The following description of the filtering process according to the present embodiment is based on the above assumption.

  In the filtering process according to the present embodiment, a filtering condition for prohibiting data communication by default (hereinafter also referred to as a default communication prohibiting condition) is set. Since the default communication prohibition condition is set, all data communication is prohibited unless another filtering condition is further set. The default communication prohibition condition is set when the communication device 1 is shipped, or is set when the communication device 1 is initialized. In other words, in the present embodiment, “default” means that it is preset as a standard operation at a predetermined timing (for example, when the communication device 1 is shipped, when the communication device 1 is initialized, etc.). It shall be.

  In the present embodiment, in order to execute necessary data communication, a filtering condition in which a condition for permitting data communication (hereinafter also referred to as a communication permission condition) is used in addition to the default communication prohibition condition. . In this case, the communication permission condition has priority over the default communication prohibition condition.

  FIG. 4 is a diagram illustrating a filtering process sequence according to the present embodiment. FIG. 4 shows a sequence of the application A 16a, application B 16b, framework, communication control unit, kernel, and modem 112.

  As described above, the modem 112 is hardware that functions as a communication interface that performs cellular communication. In FIG. 4, the data communication by the cellular communication using the modem 112 is described. However, instead of the modem 112, the data is replaced by another I / F device 111 such as the wireless LAN device 113 and the data by another communication method is used. Communication may be performed.

  The kernel, the communication control unit, and the framework are software, and are executed by the control unit 10. In FIG. 4, 0 is assigned as the UID to the communication control unit.

  The framework is software including a group of functions for operating an application on the OS. Generally, the function of each application is realized by combining the function groups prepared by the framework.

  The kernel is software that forms the core of the OS, and manages processing in hardware such as the communication unit 11 based on processing by software such as an application so that the functions of the hardware can be used.

  The communication control unit is a daemon program that performs network-related processing, and performs processing that connects the framework and the kernel. In particular, the communication control unit processes data for enabling the kernel to use the functions of the communication unit 11. In the present embodiment, the communication control unit outputs a condition for determining whether the kernel permits or prohibits data output to the communication unit 11 to the kernel.

  In the present embodiment, the filtering process is described as being performed by the packet filter 15. Here, the packet filter 15 is a virtual processing unit, and actual filtering processing is performed by the communication control unit and the kernel.

  The application A 16a and the application B 16b are processes that operate on the OS. In FIG. 4, 1 is assigned as the UID to the application A 16a, and 2 is assigned as the UID to the application B 16b.

  Hereinafter, the sequence shown in FIG. 4 will be described. When an application that operates BG transmits data, data communication by cellular communication is prohibited by default (step S1). That is, a default communication prohibition condition relating to data transmitted from an application that operates BG is set as the filtering condition. In FIG. 4, the fact that the default communication prohibition condition is set is recognized by the kernel, the communication control unit, and the framework. In particular, when the kernel recognizes that the default communication prohibition condition is set, the kernel does not transmit data to the modem 112.

  Subsequently, the framework acquires a data communication permission request (hereinafter, also referred to as a data communication permission request for data with a UID of 1) related to data with a UID of 1 when the application operates on the BG (step S2). Subsequently, the framework outputs a communication permission request for data having a UID of 1 to the communication control unit (step S3).

  The communication control unit acquires a communication permission request for data having a UID of 1 (step S4). Subsequently, the communication control unit outputs a communication permission request for data having a UID of 1 to the kernel (step S5).

  The kernel acquires a communication permission request for data having a UID of 1 (step S6). Through the operations in steps S3 to S6, a communication permission request for data having a UID of 1 is transmitted to the kernel. That is, a communication permission condition relating to data having a UID of 1 is set as a filtering condition.

  Subsequently, when the application A 16a requests data communication in the BG operation (step S7), since the kernel recognizes that the communication permission condition relating to the data with the UID of 1 is set, the data communication is permitted. (Step S8). Then, the modem 112 performs data communication for transmitting data having a UID of 1 to the network side (step S9).

  On the other hand, when the application B 16b to which 2 is assigned as the UID requests data communication in the BG operation (step S10), the kernel recognizes that the communication permission condition relating to the data with the UID 2 is not set. Therefore, the kernel prohibits data communication based on the default communication prohibition condition (step S11).

<Data transmission sequence from application>
In steps S7 to S9 of FIG. 4, it has been described that the application requests data communication and the modem 112 performs data communication. Hereinafter, these sequences will be described more specifically with reference to FIG. FIG. 5 shows a sequence of the application A 16a, the framework, the kernel, and the modem 112. The application A 16a, the framework, the kernel, and the modem 112 are the same as those in FIG.

  Regardless of whether the application A16a operates in FG or BG, a data communication request (hereinafter, also referred to as a data communication request with a UID of 1) related to data (data with a UID of 1) transmitted from the application A16a. ) Is output to the framework on the OS on which the application A 16a is running (step S101).

  The framework acquires a data communication request with a UID of 1 (step S102). Subsequently, the framework outputs a data communication request with a UID of 1 to the kernel (step S103).

  The kernel acquires a data communication request with a UID of 1 (step S104). Subsequently, the kernel outputs data to the modem 112 based on the data communication request whose UID is 1 (step S105). The modem 112 performs data communication for transmitting data having a UID of 1 to the network side (step S106).

  By the operation of the sequence shown in FIG. 5 described above, data transmitted from the application is output to the communication unit 11 and transmitted to the network side.

  The first embodiment has been described above. According to the filtering process according to the UID according to the present embodiment, data communication related to data transmitted from the application B 16b in which the filtering condition is not explicitly set by the user can be prohibited. That is, there is a high possibility that data communication not intended by the user is prohibited.

  In the present embodiment, the method for prohibiting data communication by the cellular communication method using the modem 112 as the I / F device 111 has been mainly described. However, the I / F device 111 is not limited to the modem 112 and may be a wireless LAN device 113 or the like. That is, the data communication control method of the communication apparatus 1 according to the present embodiment is not limited to data communication using the cellular communication method, and can be applied to data communication using another communication method such as a wireless LAN communication method.

  In the present embodiment, data communication may be permitted by default for functions necessary for transmitting data permitted for data communication. The functions that are permitted to perform data communication by default include, for example, a VPN (Virtual Private Network) tunneling function, a DNS (Domain Name System) name resolution function, or a tethering function. Data communication related to these functions may be permitted only if it operates when the user intends. Conditions for permitting data communication related to these functions may be set as filtering conditions prior to default communication prohibition conditions.

  Further, the filtering process according to the present embodiment is performed for data communication of an application operating in BG, but is not limited thereto, and may be performed for data communication of an application operating in FG. In other words, the filtering process according to the present embodiment may determine whether to allow or prohibit data communication related to data transmitted by an application that is performing an FG operation.

(Embodiment 2)
In the first embodiment, the filtering process is performed according to the UID. However, the filtering process may be performed according to the GID. Hereinafter, as Embodiment 2, a filtering process according to GID will be described.

  FIG. 6 is a diagram for explaining the sequence of the filtering process according to this embodiment. FIG. 6 shows a sequence of the application A 16a, the application B 16b, the framework, the communication control unit, the kernel, and the modem 112. The framework, communication control unit, kernel, and modem 112 are the same as those in FIG.

  In FIG. 6, an application A 16a is an application with a GID of 1, and an application B 16b is an application with a GID of 2.

  Hereinafter, the sequence shown in FIG. 6 will be described. When an application that operates BG transmits data, data communication by cellular communication is prohibited by default (step S701). That is, a default communication prohibition condition relating to data transmitted from an application that operates BG is set as the filtering condition. In FIG. 6, the fact that the default communication prohibition condition is set is recognized by the kernel, the communication control unit, and the framework. In particular, when the kernel recognizes that the default communication prohibition condition is set, the kernel does not transmit data to the modem 112.

  Subsequently, the framework acquires a data communication permission request (hereinafter, also referred to as a data communication permission request for data with GID 1) related to data with GID 1 when the application operates on BG (step S702). Subsequently, the framework outputs a communication permission request for data with GID 1 to the communication control unit (step S703).

  The communication control unit acquires a communication permission request for data having a GID of 1 (step S704). Subsequently, the communication control unit outputs a communication permission request for data having a GID of 1 to the kernel (step S705).

  The kernel acquires a communication permission request for data having a GID of 1 (step S706). Through the operations in steps S703 to S706 described above, a communication permission request for data having a GID of 1 is transmitted to the kernel. That is, a communication permission condition related to data with GID 1 is set as the filtering condition.

  Subsequently, when the application A 16a requests data communication in the BG operation (step S707), the kernel recognizes that the communication permission condition relating to the data having the GID of 1 is set, so the data communication is permitted. (Step S708). Then, the modem 112 performs data communication for transmitting data with GID 1 to the network side (step S709).

  On the other hand, when the application B16b with GID 2 requests data communication in the BG operation (step S710), the kernel recognizes that the communication permission condition relating to the data with GID 2 is not set. Therefore, the kernel prohibits data communication based on the default communication prohibition condition (step S711).

  In steps S707 to S709 in FIG. 6, the application requests data communication, and the modem 112 performs data communication. Since this data communication is performed in the same sequence as in FIG. 5 of the first embodiment, the description thereof is omitted.

  As described above, a filtering process similar to the filtering process according to the UID of the first embodiment can be realized by setting the filtering condition according to the GID.

[Filtering processing in VPN]
As an example of performing filtering processing according to GID, filtering processing when data is encapsulated to perform data communication using a VPN tunneling function will be described. In the present embodiment, the communication apparatus 1 further includes a VPN device. The VPN device has a protocol for encapsulating acquired data. A unique UID is assigned to the protocol of the VPN device. Hereinafter, a UID assigned to a protocol is also referred to as a protocol UID. The VPN device encapsulates data from the application based on this protocol. Then, the VPN device outputs the encapsulated data to the communication unit 11. The correspondence between the encapsulated data and the UID assigned to the application that transmits the data is lost. The encapsulated data is newly associated with the UID of the encapsulated protocol.

  The VPN device may have a plurality of protocols for encapsulating data. In this case, the UID of each protocol is different. The encapsulated data is associated with the UID of the encapsulated protocol. When the VPN device has a plurality of protocols for data encapsulation, the UIDs of these protocols belong to a common group. This common group is assigned a GID. Therefore, a common GID is associated with a plurality of protocols included in the VPN device. Hereinafter, the GID that is commonly associated with a plurality of protocols of the VPN device is also referred to as the GID of the VPN device. The encapsulated data is newly associated with the GID of the VPN device having the encapsulated protocol. Further, the protocol possessed by the VPN device may be included in the application. In this case, the protocol possessed by the VPN device is also referred to as a VPN application.

  The data encapsulated in the VPN device is associated with the UID of the protocol to be encapsulated. As described above, the VPN device has a plurality of protocols. Therefore, there are a plurality of UIDs that may be associated with the data encapsulated in the VPN device. When performing filtering processing on encapsulated data, when setting filtering conditions according to the UID, the same number of filtering conditions as the number of protocols are set.

  On the other hand, GID is also associated with the encapsulated data. A common GID is associated with a plurality of protocol UIDs of the VPN device. Therefore, when setting filtering conditions according to GID, it is only necessary to set one filtering condition common to each protocol.

  The second embodiment has been described above. According to this embodiment, permission or prohibition of data communication by an application can be easily set.

  Also in this embodiment, the I / F device 111 is not limited to the modem 112 but may be a wireless LAN device 113 or the like. That is, the data communication control method of the communication apparatus 1 according to the present embodiment is not limited to data communication using the cellular communication method, and can be applied to data communication using another communication method such as a wireless LAN communication method.

(Embodiment 3)
As a third embodiment, a case will be described in which filtering processing according to GID is executed following filtering processing according to UID. In the present embodiment, it is assumed that a default communication prohibition condition is set as the filtering condition.

  FIG. 7 is a flowchart showing the filtering process according to the present embodiment. First, the packet filter 15 acquires a data communication request related to data having a UID of X and a GID of Y from the application (step S801). Subsequently, the packet filter 15 determines whether or not a communication permission condition (hereinafter, also referred to as a communication permission condition according to the UID) related to the data with the UID X is set as the filtering condition (step S802).

  If the communication permission condition according to the UID is not set (step S802: NO), the packet filter 15 does not output data to the modem 112 (step S805), and the flowchart of FIG.

  When the communication permission condition according to the UID is set (step S802: YES), the packet filter 15 uses the condition for prohibiting the data communication related to the data with the GID Y (hereinafter, the communication prohibition condition according to the GID). (Also referred to as) is set as a filtering condition (step S803).

  When the communication prohibition condition according to GID is set (step S803: YES), the packet filter 15 does not output data to the modem 112 (step S805), and the flowchart of FIG.

  When the communication prohibition condition according to GID is not set (step S803: NO), the packet filter 15 outputs data to the modem 112 (step S804), and the flowchart of FIG.

  The third embodiment has been described above with reference to the flowchart shown in FIG. In the present embodiment, by executing the filtering process according to the UID and GID, it is possible to increase variations in the setting method of permission or prohibition of data communication of the application.

  Also in this embodiment, the I / F device 111 is not limited to the modem 112 but may be a wireless LAN device 113 or the like. That is, the data communication control method of the communication apparatus 1 according to the present embodiment is not limited to data communication using the cellular communication method, and can be applied to data communication using another communication method such as a wireless LAN communication method.

(Embodiment 4)
As a fourth embodiment, a method for counting the amount of data communication when performing filtering processing according to UID and GID will be described. In the present embodiment, counting of the data communication amount is executed in the packet filter 15. In the present embodiment, it is assumed that a default communication prohibition condition is set as the filtering condition.

  FIG. 8 is a flowchart showing data amount counting processing according to the present embodiment. First, the packet filter 15 acquires a data communication request related to data having a UID of X and a GID of Y from the application (step S901).

  Subsequently, the packet filter 15 determines whether or not data communication related to data having a UID of X and a GID of Y is prohibited (step S902). Step S902 determines whether to prohibit data communication according to UID or GID, and is performed by the same processing as steps S802 and S803 of FIG. 7 of the third embodiment. That is, when the communication permission condition according to the UID is set (step S802: YES), and when the communication prohibition condition according to the GID is not set (step S803: NO), the packet filter 15 It is determined that communication is not prohibited (permitted). On the other hand, when the communication permission condition according to UID is not set (step S802: NO), or when the communication prohibition condition according to GID is set (step S803: YES), the packet filter 15 It is determined that data communication is prohibited.

  If it is determined that data communication is prohibited (step S902: YES), the packet filter 15 does not count the data communication amount for the data requested for data communication (step S903). Subsequently, the packet filter 15 does not output the data to the modem 112 (step S904), and ends the flowchart of FIG.

  When it is determined that data communication is not prohibited (step S902: NO), the packet filter 15 counts the data communication amount for the data requested for data communication (step S903). Subsequently, the packet filter 15 outputs the data to the modem 112 (step S904), and ends the flowchart of FIG.

  As described above with reference to FIG. 8, by doing so, the difference between the data communication amount counted by the packet filter 15 and the amount of data output by the packet filter 15 to the modem 112 is reduced. Can do.

<Comparative example>
FIG. 9 is a flowchart showing the data amount counting process according to the comparative example. First, the packet filter 15 acquires a data communication request related to data having a UID of X and a GID of Y from an application (step S1001).

  Subsequently, the packet filter 15 determines whether to prohibit data communication related to data with a UID of X (step S1002). Step S1002 determines whether to prohibit data communication according to the UID, and is performed by the same process as step S802 of FIG. 7 in the third embodiment. That is, when the communication permission condition corresponding to the UID is set (step S802: YES), the packet filter 15 determines that data communication is not prohibited (permitted). On the other hand, when the communication permission condition according to the UID is not set (step S802: NO), the packet filter 15 determines to prohibit the data communication.

  When it is determined that data communication is prohibited according to the UID (step S1002: YES), the packet filter 15 does not count the data communication amount for the data requested for data communication (step S1003). Subsequently, the packet filter 15 does not output the data to the modem 112 (step S1004), and ends the flowchart of FIG.

  When it is determined that data communication is not prohibited according to the UID (step S902: NO), the packet filter 15 counts the data communication amount for the data requested for data communication (step S1005).

  Subsequently, the packet filter 15 determines whether to prohibit data communication related to data with GID Y (step S1006). Step S1006 determines whether to prohibit data communication according to the GID, and is performed by the same processing as step S803 in FIG. 7 of the third embodiment. That is, when the communication prohibition condition corresponding to the GID is set (step S803: YES), the packet filter 15 determines to prohibit the data communication. On the other hand, when the communication prohibition condition according to GID is not set (step S803: NO), the packet filter 15 determines not to prohibit (permit) data communication.

  When it is determined not to prohibit data communication according to GID (step S1006: NO), the packet filter 15 outputs the data to the modem 112 (step S1007), and the flowchart of FIG. In this case, after the data communication amount is counted for the data requested for data communication in step S1005, the data is output to the modem 112. Therefore, the amount of data communication that the packet filter 15 counts matches the amount of data that the packet filter 15 outputs to the modem 112.

  When it is determined that data communication is prohibited according to the GID (step S1006: YES), the packet filter 15 does not output the data to the modem 112 (step S1004), and the flowchart of FIG. 9 ends. In this case, after the data communication amount is counted for the data requested for data communication in step S1005, the data is not output to the modem 112. Therefore, the amount of data communication that the packet filter 15 counts does not match the amount of data that the packet filter 15 outputs to the modem 112.

  As described above, the comparative example has been described with reference to FIG. 9. In the comparative example, the amount of data communication counted by the packet filter 15 may not match the amount of data output by the packet filter 15 to the modem 112. It can happen.

  The embodiment 4 has been described above. According to the present embodiment, in comparison with the comparative example, it is possible to reduce the difference between the data communication amount counted by the packet filter 15 and the amount of data output from the packet filter 15 to the modem 112.

  Also in this embodiment, the I / F device 111 is not limited to the modem 112 but may be a wireless LAN device 113 or the like. That is, the data communication control method of the communication apparatus 1 according to the present embodiment is not limited to data communication using the cellular communication method, and can be applied to data communication using another communication method such as a wireless LAN communication method.

  Although the present invention has been described based on the drawings and examples, it should be noted that those skilled in the art can easily make various modifications and corrections based on the present disclosure. Therefore, it should be noted that these variations and modifications are included in the scope of the present invention. For example, the functions included in each component, each step, etc. can be rearranged so that there is no logical contradiction, and multiple components, steps, etc. can be combined or divided into one It is. Further, although the present invention has been described centering on an apparatus, the present invention can also be realized as a method including steps executed by each component of the apparatus. Further, although the present invention has been described mainly with respect to the apparatus, the present invention can also be realized as a method, a program executed by a processor included in the apparatus, or a storage medium storing the program, and is within the scope of the present invention. It should be understood that these are also included.

  In the above-described embodiment, the wireless LAN is exemplified as a data communication method based on a method that is not a pay-per-use system. A data communication system such as

DESCRIPTION OF SYMBOLS 1 Communication apparatus 10 Control part 11 Communication part 111 I / F device 112 Modem 113 Wireless LAN device 12 Storage part 13 Display part 14 Operation part 15 Packet filter 16a Application A
16b Application B

Claims (7)

Data communication is prohibited by default,
Receives a data communication request from the application,
According to the UID of the requested application, the data communication of the application is permitted and the data communication amount of the application is counted.
A communication device that does not count the data communication amount of the application to which the data communication is permitted depending on the ID of the group to which the requested application belongs.   The communication apparatus according to claim 1, wherein data communication of the application is prohibited depending on an ID of a group to which the requested application belongs. When the requested UID of the application satisfies the filtering condition for communication permission, the data communication amount of the application is counted.
The communication apparatus according to claim 1, wherein the data communication amount of the application is not counted depending on an ID of a group to which the requested application belongs.   The communication apparatus according to any one of claims 1 to 3, wherein data communication of all applications is prohibited by default. Based on the communication permission condition according to the UID and the communication prohibition condition according to the group ID , even if the UID of the requested application satisfies the communication permission condition, the ID of the group to which the application belongs is the communication. The communication device according to any one of claims 1 to 4 , further comprising: a packet filter that prevents counting of data communication amount of data communication based on the request of the application when a prohibition condition is also satisfied. In the communication device,
A step of prohibiting data communication by default;
Receiving a data communication request from the application;
Depending on the UID of the requested application, the data communication of the application is permitted and the amount of data communication of the application is counted. However, depending on the ID of the group to which the requested application belongs, the data depends on the UID. And a step of not counting the amount of data communication of the application that is permitted to communicate. To a computer that functions as a communication device,
A step of prohibiting data communication by default;
Receiving a data communication request from the application;
Depending on the UID of the requested application, the data communication of the application is permitted and the amount of data communication of the application is counted. However, depending on the ID of the group to which the requested application belongs, the data depends on the UID. And a step of not counting the data communication amount of the application for which communication is permitted.

Images