WO2008075426A1 - Dispositif de commande de communication et procédé de commande de communication - Google Patents

Dispositif de commande de communication et procédé de commande de communication Download PDF

Info

Publication number
WO2008075426A1
WO2008075426A1 PCT/JP2006/325432 JP2006325432W WO2008075426A1 WO 2008075426 A1 WO2008075426 A1 WO 2008075426A1 JP 2006325432 W JP2006325432 W JP 2006325432W WO 2008075426 A1 WO2008075426 A1 WO 2008075426A1
Authority
WO
WIPO (PCT)
Prior art keywords
communication control
data
mail
control device
database
Prior art date
Application number
PCT/JP2006/325432
Other languages
English (en)
Japanese (ja)
Inventor
Mitsugu Nagoya
Genta Iha
Original Assignee
Duaxes Corporation
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by Duaxes Corporation filed Critical Duaxes Corporation
Priority to PCT/JP2006/325432 priority Critical patent/WO2008075426A1/fr
Priority to JP2007525095A priority patent/JPWO2008075426A1/ja
Publication of WO2008075426A1 publication Critical patent/WO2008075426A1/fr

Links

Classifications

    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06Q—INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
    • G06Q10/00—Administration; Management

Definitions

  • the present invention relates to a communication control technique, and more particularly to a communication control apparatus and a communication control method for discriminating inappropriate mail.
  • the present invention has been made in view of these circumstances, and a purpose thereof is to provide a technique for appropriately discriminating inappropriate mail.
  • This communication control device is a database that stores keywords that serve as criteria for determining whether or not a mail should be discarded, and a discriminator that accumulates mail and discriminates spam mail from the stored mail.
  • a mail is acquired at the front stage of the device, and a search unit for searching whether the mail includes a keyword stored in the database, and a mail including the keyword is discarded and not included.
  • an output unit for outputting a mail to the discrimination device.
  • the search unit may search the keyword directly from the mail body text stored in the payload of the communication packet without analyzing the header of the communication packet.
  • the keyword may be a URL of a content whose access should be prohibited.
  • the database may store a keyword set for each user.
  • the communication control device may further include a user identification unit that identifies a user using a mail address set as a destination of the mail.
  • the search unit may search whether the keyword set by the user identified by the user identification unit is included in the mail.
  • the output unit may replace the key word with another character string and output it to the determination device instead of discarding the mail including the keyword.
  • the output unit may notify the outside when an email including the keyword is detected! /.
  • the search unit may be configured by an FPGA (Field Programmable Gate Array), a wired logic circuit, or the like.
  • FPGA Field Programmable Gate Array
  • Another aspect of the present invention relates to a communication control method.
  • This communication control method accumulates mail and acquires the mail in the first stage of the discriminating device that discriminates the middle-level spam mail that is stored, and the criteria for determining whether or not the mail should be discarded
  • a step of searching for whether or not the keyword is included in the acquired mail by referring to a database storing key keywords to be used, and discarding and not including the mail including the keyword.
  • FIG. 1 is a diagram showing a configuration of a communication control system according to a base technology.
  • FIG. 2 is a diagram showing a configuration of a conventional communication control device.
  • FIG. 3 is a diagram showing a configuration of a communication control apparatus according to the base technology.
  • FIG. 4 is a diagram showing a configuration of a packet processing circuit.
  • FIG. 5 is a diagram illustrating a configuration of a position detection circuit.
  • FIG. 6 is a diagram showing another example of the position detection circuit.
  • FIG. 7 is a diagram showing another example of the position detection circuit.
  • FIG. 8 is a diagram showing an example of internal data of the first database.
  • FIG. 9 is a diagram showing another example of internal data of the first database.
  • FIG. 10 is a diagram showing still another example of internal data of the first database.
  • FIG. 11 is a diagram showing another example of the index circuit.
  • FIG. 14 is a diagram showing still another example of internal data of the first database.
  • FIG. 15 is a diagram showing an example of internal data of the second database.
  • FIG. 16 is a diagram showing another example of internal data of the second database.
  • ⁇ 17 It is a diagram showing another configuration example of the communication control apparatus according to the base technology.
  • FIG. 18 is a diagram illustrating a configuration of a communication control device including a plurality of communication control devices.
  • FIG. 19 is a diagram showing an example of internal data of a management table provided in the operation monitoring apparatus.
  • FIG. 20 is a diagram for explaining an operation method when a communication control device fails.
  • FIGS. 21 (a), 21 (b), and 21 (c) are diagrams for explaining a method of updating the database of the communication control device.
  • FIG. 22 is a diagram showing a configuration of a communication path control device provided for processing a packet by a plurality of communication control devices.
  • 10 Communication controller 20 Packet processing circuit, 30 Search circuit, 32 Position detection circuit, 3 3 Comparison circuit, 34 Index circuit, 35 Comparison circuit, 36 Binary search circuit, 36A, 36B, 36C Comparison circuit, 36Z control circuit, 40 Processing execution circuit, 50 1st database, 60 2nd database, 100 communication control system, 110 operation monitoring device, 120 connection management device, 130 message output device, 140 log management device, 150 database Server, 200 communication path control device, 300 communication management system, 310 user terminal, 320 ISP, 322 user database, 324 spam keyword database, 330 identification device, 340 SMTP server, 350 POP server, 390 Internet.
  • FIG. 1 shows the configuration of the communication control system related to the prerequisite technology.
  • the communication control system 100 includes a communication control device 10 and various peripheral devices provided to support the operation of the communication control device 10.
  • the base technology communication control device 10 implements a packet filtering function provided by an Internet service provider or the like.
  • the communication control device 10 provided in the network path acquires a packet transmitted / received via the network, analyzes the content, and determines whether communication is permitted. If communication is permitted, the communication control device 10 sends the packet to the network. When communication is prohibited, the communication control device 10 discards the packet and returns a warning message or the like to the transmission source if necessary.
  • communication control device 10 are provided and function as a single communication control device 10 .
  • individual communication control devices 10a, 10b, 10c,. are also referred to as communication control device 10 without distinction.
  • each communication control device 10 divides and holds at least a part of the database necessary for the bucket processing, but divides and holds it. At least one more than the number required for the installation. For example, if 100,000 units of data can be stored per unit, if the number of data is 300,000 or more and less than 400,000 units, the number of communication control devices required for operation is four.
  • Communication control device 10 for standby to be used in place of failure communication control device
  • One or more communication control devices 10 are provided for standby when the database included in the device 10 is updated, and a total of at least five communication control devices 10 are provided. Conventionally, it was necessary to duplicate the entire system for fault tolerance.
  • the operation status of the plurality of communication control devices 10a, 10b, 10c,... Is managed by the operation monitoring device 110.
  • the operation monitoring apparatus 110 of the base technology has a management table for managing the operation status of the communication control apparatus.
  • the peripheral devices include an operation monitoring device 110, a connection management device 120, a message output device 130, a mouth management device 140, and a database server 150.
  • the connection management device 120 manages the connection to the communication control device 10.
  • the connection management device 120 uses, for example, information that uniquely identifies a mobile phone terminal included in the packet when the communication control device 10 processes a packet that has also been transmitted with a mobile phone terminal force. Authenticate that you are a user who can enjoy these services. Once authenticated, the packet that has also been sent with the IP address temporarily attached to the mobile phone terminal is sent to the communication control device 10 without being authenticated by the connection management device 120 for a certain period of time.
  • the The message output device 130 outputs a message to the transmission destination or transmission source of the packet according to the result of communication permission / rejection determined by the communication control device 10.
  • the log management device 140 manages the operation history of the communication control device 10.
  • the database server 150 acquires the latest database from the outside and inputs it to the communication control device 10. In order to update the database without stopping the operation of the communication control apparatus 10, the communication control apparatus 10 may have a backup database.
  • the operation monitoring device 110 monitors the operation status of peripheral devices such as the communication control device 10, the connection management device 120, the message output device 130, the log management device 140, and the database server 150. The operation monitoring device 110 performs monitoring control of the communication control device 10 having the highest priority in the communication control system 100 and all peripheral devices.
  • the communication control device 10 is configured by a dedicated hardware circuit.
  • the operation monitoring device 110 uses a technique such as Japanese Patent No. 3041340 by the applicant of the present application, and a boundary scan circuit. By inputting / outputting monitoring data to / from the communication control device 10 and the like using the network, the operation status can be monitored even during operation of the communication control device 10.
  • the communication control system 100 of the base technology has various functions connected to the periphery of the communication control device 10 constituted by a dedicated hardware circuit for high-speed operation, as will be described below. By adopting a configuration that is controlled by the device group, various functions can be realized by the same configuration by appropriately replacing the software of the device group. According to the presupposed technology, such a highly flexible communication control system can be provided.
  • FIG. 2 shows a configuration of a conventional communication control device 1.
  • the conventional communication control apparatus 1 includes a communication control unit 2 on the reception side, a packet processing unit 3, and a communication control unit 4 on the transmission side.
  • Each of the communication control units 2 and 4 includes PHY processing units 5a and 5b that perform processing on the physical layer of the packet, and MAC processing units 6a and 6b that perform processing on the MAC layer of the packet.
  • the packet processing unit 3 includes a protocol processing unit that performs processing according to a protocol, such as an IP processing unit 7 that performs IP (Internet Protocol) protocol processing and a TCP processing unit 8 that performs TCP (Transport Control Protocol) protocol processing.
  • an AP processing unit 9 that performs application layer processing.
  • the AP processing unit 9 executes processing such as filtering according to data included in the packet.
  • the packet processing unit 3 is realized by software using a CPU that is a general-purpose processor and an OS that runs on a CPU.
  • the performance of the communication control device 1 depends on the performance of the CPU, and even if it is intended to realize a communication control device capable of processing large-capacity packets at high speed, it is naturally limited. There is. For example, with a 64-bit CPU, the maximum amount of data that can be processed simultaneously at one time is 64 bits, and there was no communication control device with higher performance.
  • maintenance work such as OS version upgrades that would never have the possibility of security holes was required.
  • FIG. 3 shows a configuration of the communication control apparatus according to the base technology.
  • the communication control device 10 of this base technology replaces the packet processing unit realized by software including the CPU and OS in the conventional communication control device with a packet configured by dedicated hardware using a wired logic circuit.
  • a processing circuit 20 is provided. Communication data that is not processed by the OS and software that runs on a CPU that is a general-purpose processing circuit By providing a dedicated hardware circuit for processing the above, it becomes possible to overcome the performance limitations caused by the CPU and OS, and realize a communication control device with high processing capability.
  • the communication data and the reference are used using the CPU.
  • the CPU needs to repeat the process of reading 64 bits from the communication data into the memory, comparing it with the reference data, and then reading the next 64 bits into the memory. The reading time is limited, and the processing speed is limited.
  • a dedicated hardware circuit configured by a wired logic circuit.
  • This circuit includes a plurality of comparators provided in parallel to enable comparison of data lengths longer than 64 bits, eg, data lengths of 1024 bits.
  • the communication control device 1 using a conventional CPU can process 1024 bits at a time instead of processing only 64 bits at a time, and the processing speed can be dramatically improved.
  • Increasing the number of comparators improves processing performance, but also increases cost and size, so it is only necessary to design an optimal hardware circuit in consideration of desired processing performance, cost, size, etc.
  • the dedicated hardware circuit may be implemented using FPGA (Field Programmable Gate Array)!
  • the communication control apparatus 10 of the base technology is configured by dedicated hardware using a wired logic circuit, and therefore does not require an OS (Operating System). For this reason, it is possible to reduce costs and man-hours for management and maintenance that require operations such as OS installation, bug handling, and version upgrade.
  • OS Operating System
  • CPUs unlike CPUs that require general-purpose functions, they do not include unnecessary functions, so you can reduce costs without using extra resources, reduce circuit area, and increase processing speed.
  • OS Unlike conventional communication control devices that use the network, there is no extra function, so there is little possibility of security holes, etc., and excellent resistance to attacks from malicious third parties via the network. ing.
  • the conventional communication control device 1 processes a packet by software premised on the CPU and the OS, receives all the data of the packet, performs a powerful protocol process, and passes the data to the application. .
  • the communication control apparatus 10 of the base technology since processing is performed by a dedicated hardware circuit, it is not necessary to start processing after receiving all the data of the packet. In this way, the process can be started at any time without waiting for the subsequent data to be received. For example, position detection processing in a position detection circuit described later can be started when position specifying data for specifying the position of comparison target data is received. As described above, since various processes can be executed in a floating manner without waiting for reception of all data, the time required to process packet data can be shortened.
  • FIG. 4 shows the internal configuration of the packet processing circuit.
  • the packet processing circuit 20 includes first databases 50A, 50B, and 50C that store reference data serving as a reference for determining the contents of processing to be performed on communication data (collectively, “first database 50”). ) And a search circuit 30 for searching whether the received communication data includes the reference data by comparing the communication data with the reference data, and the search result by the search circuit 30 and the communication data.
  • a second database 60 for storing the contents of processing to be executed in association with each other, and a processing execution circuit for processing communication data based on the search results by the search circuit 30 and the conditions stored in the second database 60 Including 40.
  • the search circuit 30 divides the reference data stored in the first database 50 into three or more ranges, the position detection circuit 32 for detecting the position of the comparison target data to be compared with the reference data from the communication data Index circuit 34, which is an example of a determination circuit that determines to which of the ranges the comparison target data belongs, and a binary search that searches for reference data that matches the comparison target data within the determined range Circuit 36.
  • Any search technique can be used as a method for searching the comparison target data from the reference data, but the binary search method is used in this prerequisite technique.
  • three first databases 50 are provided for this purpose.
  • the same reference data is stored in the first databases 50A, 50B, and 50C.
  • FIG. 5 shows the internal configuration of the position detection circuit.
  • the position detection circuit 32 includes a plurality of comparison circuits 33a to 33f for comparing the position specifying data for specifying the position of the comparison target data with the communication data.
  • six comparison circuits 33a to 33f are provided, but as will be described later, the number of comparison circuits may be arbitrary.
  • Communication data is input to each of the comparison circuits 33a to 33f with a predetermined data length, for example, shifted by 1 byte.
  • the plurality of comparison circuits 33a to 33f the position specifying data to be detected and the communication data are compared in parallel at the same time.
  • the character string "No. # # #” included in the communication data is detected and included in the character string.
  • the number “# # #” is compared with the reference data. If the data matches the reference data, the packet is allowed to pass. If it does not match, the packet is discarded. Light up.
  • the comparison circuit 33c matches, and it is detected that the character string “No.” exists as the third character from the top of the communication data. In this way, it is detected that numerical data as comparison target data exists after the position specifying data “No.” detected by the position detection circuit 32.
  • the multiple comparison circuits 33a to 33f are provided in parallel, enabling simultaneous parallel comparison processing that cannot be achieved with a CPU, and the processing speed can be greatly improved. .
  • the number of comparison circuits increases, the number of positions that can be compared simultaneously increases.Therefore, a sufficient number of comparison circuits are provided to obtain the desired detection speed in consideration of cost, size, etc. Just do it.
  • the position detection circuit 32 may be used as a circuit for detecting a character string for general purposes, not only for detecting position specifying data. It may also be configured to detect position specific data in bit units, not just character strings.
  • FIG. 6 shows another example of the position detection circuit.
  • predetermined data such as “ Padding such as “OOH” or “01H”.
  • the communication data to be compared with the position specifying data only the same data length as the position specifying data is extracted, and then the same data as the data padded to the position specifying data is padded.
  • the communication data may be copied as a work, and the copied data may be checked and input to the comparison circuits 33a to 33f.
  • the position detection circuit 32 can be used for general purposes regardless of the data length of the position specifying data.
  • FIG. 7 shows still another example of the position detection circuit.
  • the power for padding predetermined data after the position specifying data.
  • This data is treated as a field card.
  • the comparison circuits 33a to 33f determine that the data to be compared matches unconditionally.
  • the position detection circuit 32 can be used for general purposes regardless of the data length of the position specifying data.
  • FIG. 8 shows an example of internal data of the first database.
  • reference data used as criteria for determining processing contents such as knot filtering, routing, switching, and replacement is sorted and stored in ascending or descending order according to some sort condition. Yes.
  • 1000 reference data are stored.
  • the index circuit 34 determines to which of these ranges the comparison target data belongs.
  • 1000 pieces of reference data are divided into four ranges 52a to 52d, each having 250 pieces.
  • the index circuit 34 includes a plurality of comparison circuits 35a to 35c that compare the reference data at the boundary of the range with the comparison target data. By comparing the comparison target data and the boundary reference data simultaneously in parallel by the comparison circuits 35a to 35c, it is possible to determine which range the comparison target data belongs to by one comparison process.
  • the boundary reference data input to the comparison circuits 35a to 35c of the index circuit 34 may be set by a device provided outside the communication control device 10, or may be set in advance in the first database 50.
  • the reference data for the position may be entered automatically! In the latter case, even if the first database 50 is updated, the reference data at a predetermined position in the first database 50 is automatically input to the comparison circuits 35a to 35c. Processing can be executed.
  • the binary search circuit 36 executes a search by the binary search method.
  • the binary search circuit 36 further divides the range determined by the index circuit 34 into 2 n pieces, and compares the reference data at the boundary position with the comparison target data to determine which range it belongs to .
  • the binary search circuit 36 includes a plurality of comparators for comparing the reference data and the comparison target data in bit units, for example, 1024 in the base technology, and simultaneously executes 1024-bit bit matching.
  • the range is further divided into 2n, and the reference data at the boundary position is read out and compared with the comparison target data.
  • the comparison circuit 35a to 35c of the index circuit 34 is input with “361” as the comparison target data, and the reference data “378” at the boundary between the ranges 52a and 52b is input to the comparison circuit 35a as the reference data.
  • the reference data “937” at the boundary between the ranges 52b and 52c is input to the reference data “937” at the boundary between the ranges 52c and 52d, respectively.
  • the comparison circuits 35a to 35c perform comparison at the same time, and it is determined that the comparison target data “361” belongs to the range 52a. Thereafter, the binary search circuit 36 searches whether or not the comparison target data “361” exists in the reference data.
  • FIG. 9 shows another example of internal data of the first database.
  • the number of reference data is less than the number of data that can be held in the first database 50, here 1000.
  • the first database 50 stores the reference data in descending order from the last data position.
  • 0 is stored in the remaining data.
  • the search time for binary search can be made constant.
  • the binary search circuit 36 is self-explanatory, so the range can be specified without comparison and the next comparison can be made. it can. This can improve the search speed.
  • the reference data when the reference data is stored in the first database 50, the reference data is stored in ascending order of the first data position.
  • the comparison process as described above cannot be omitted in the remaining data.
  • the comparison technique described above is realized by configuring the search circuit 30 with a dedicated hardware circuit.
  • FIG. 10 shows still another example of internal data of the first database.
  • the number of reference data belonging to the range is not uniform, such as 500 for the range 52a and 100 for the range 52b, which do not divide the reference data evenly into three or more ranges. ing .
  • These ranges are set according to the frequency distribution of the reference data in the communication data. It may be determined. That is, the ranges may be set so that the sum of the appearance frequencies of the reference data belonging to the respective ranges is substantially the same. This can improve the search efficiency.
  • the reference data input to the comparison circuits 35a to 35c of the index circuit 34 may be changeable from the outside. As a result, the range can be set dynamically and the search efficiency can be optimized.
  • FIG. 11 shows another example of the index circuit.
  • the index circuit 34 uses three comparison circuits 35a to 35c to determine which of the four ranges 52a to 52d of the first data base 50 belongs to. Determined force
  • the indentus circuit 34 is provided with four comparison circuits 35d to 35g for determining whether the comparison target data is included in each of the four ranges 52a to 52d.
  • the comparison circuit 35d receives the 0th reference data, the 250th reference data, and the comparison target data in the first database 50, and compares each reference data with the comparison target data. Thus, it is determined whether or not the reference data is included in the range 52a.
  • the comparison results of .about.35g are input to the determination circuit 35z, and the determination circuit 35z outputs in which range the reference data is included.
  • the comparison circuits 35d to 35g may output whether or not the force is included between the two reference data to which the reference data is input, and may be larger than, included in the range, or smaller than the range. Either of them may be output. If it is determined that the comparison target data is not included in any of the ranges 52a to 52d, it is determined that the comparison target data does not exist in the first database 50. Therefore, until the subsequent binary search is performed. The search can be terminated.
  • FIG. 12 shows a configuration of a comparison circuit included in the binary search circuit.
  • the comparison circuit included in the binary search circuit 36 includes 1024 comparators 36a, 36b,. In each of the comparators 36a, 36b,..., The reference data 54 and the comparison target data 56 are input one bit at a time, and their magnitudes are compared.
  • the internal configurations of the comparison circuits 35a to 35c of the index circuit 34 are also the same. In this way, by executing the comparison process with a dedicated hardware circuit, a large number of comparison circuits can be operated in parallel and a large number of bits can be compared simultaneously, so that the comparison process can be performed at high speed. it can.
  • FIG. 13 shows a configuration of the binary search circuit.
  • the Neuna Research Circuit 36 is shown in Figure 12.
  • a comparison circuit 36A, 36B, and 36C including 1024 comparators 36a, 36b,... And a control circuit 36Z that controls these comparison circuits are included.
  • the data at the position 1Z2 in the search target range of the database in which the data is arranged in ascending or descending order is read and compared with the comparison target data.
  • the comparison target data is smaller, the comparison target data exists in the first half of the search target range, so the second time is the first search with the first half as the search target range, that is, the first search Read the data at 1Z4 position in the target range and compare it with the data to be compared. Conversely, if the comparison target data is larger, the comparison target data exists in the second half of the search target range.
  • the second half of the search target range is the 1Z2, that is, the position of 3Z4 in the first search target range. Read some data and compare with the data to be compared. In this way, the search target range is narrowed by half and finally reaches the target data.
  • three comparison circuits are provided to perform two searches simultaneously.
  • 2 n ⁇ 1 One comparison circuit may be provided.
  • the control circuit 36Z inputs the data at the position of lZ2 n , 2/2 ⁇ ⁇ , (2 n — l) Z2 n in the search target range to each of the 2 n — one comparison circuit, and Are simultaneously operated in parallel and compared with the data to be compared.
  • the control circuit 36Z obtains the comparison results of the respective comparison circuits and determines whether comparison target data has been searched. When any of the comparison circuits outputs a signal indicating that the data match, the control circuit 36Z determines that the comparison target data has been searched, and ends the Neuer research.
  • the next search is performed.
  • Data to be compared exists in the database If it exists, it should be in the range where the comparison result of 2 n — one comparison circuit is inverted. For example, when 15 comparison circuits are provided, the data at the 5Z16 position is smaller than the comparison target data.If the data at the 6Z16 position is larger than the comparison target data, the 5 Z16 force also falls within the range between 6Z16. There is data to be compared.
  • control circuit 36Z acquires the comparison result of each comparison circuit, determines the range where the comparison result is inverted as the next search target range, and determines the next search target range lZ2 n , 2/2 ⁇ ⁇ ⁇ ⁇ ⁇ (2 n -l) / 2 n position data is input to each comparison circuit.
  • first databases 50 are provided, and the first database 50A is connected to the comparison circuit 36A and supplies data at the position 1Z4 in the search target range to the comparison circuit 36A.
  • the first database 50B is connected to the comparison circuit 36B to supply the data at the position 2Z4 in the search target range to the comparison circuit 36B, and the first database 50C is connected to the comparison circuit 36C at the position 3Z4 in the search target range.
  • Some data is supplied to the comparison circuit 36C. As a result, data can be simultaneously read out in parallel to the respective comparison circuits, so that the time required for reading data can be further shortened and the binary search can be performed at high speed.
  • the search speed improves.
  • a sufficient number of comparison circuits may be provided to obtain a desired search speed. It is preferable to have as many first databases as the number of comparison circuits, but considering the cost, size, etc., V, and some comparison circuits may share the database.
  • FIG. 14 shows still another example of internal data of the first database.
  • the first database 50 shown in FIG. 14 stores URLs of contents to be filtered.
  • the data stored in the first database 50 may include predetermined data recognized as a wild card, for example, “OOH” or “01H”.
  • “http: //www.xx.xx/********* J is recognized as“******* ”force S Wino Red card.
  • Comparators 36a, 36b, ⁇ are determined to match regardless of the comparison target data. Therefore, all character strings starting with" http: ⁇ www.xx.xx / "are processed by the binary search circuit 36. Detected.
  • FIG. 15 shows an example of internal data of the second database.
  • the second database 60 includes a search result column 62 for storing the search result by the search circuit 30 and a processing content column 64 for storing the content of processing to be executed on communication data.
  • a search result column 62 for storing the search result by the search circuit 30
  • a processing content column 64 for storing the content of processing to be executed on communication data.
  • the processing execution circuit 40 searches the second database 60 based on the search result, and executes processing on the communication data.
  • the processing execution circuit 40 may also be realized by a wired logic circuit.
  • FIG. 16 shows another example of internal data of the second database.
  • the processing content is set for each reference data.
  • information about the route may be stored in the second database 60.
  • the process execution circuit 40 executes processes such as filtering, routing, switching, and replacement stored in the second database 60 according to the search result by the search circuit 30.
  • the first database 50 and the second database 60 may be integrated.
  • the first database and the second database are provided to be rewritable by an external force. By exchanging these databases, various data processing and communication control can be realized using the same communication control device 10. It is also possible to set up two or more databases that store the reference data to be searched and perform multi-step search processing! At this time, more complicated conditional branches may be realized by providing two or more databases that store search results and processing contents in association with each other. In this way, if multiple databases are used to perform multi-stage searches, multiple position detection circuits 32, index circuits 34, binary search circuits 36, etc. may be provided.
  • Data used for the above-described comparison may be compressed by the same compression logic.
  • the same comparison as usual is possible.
  • the amount of data to be loaded at the time of comparison can be reduced. If the amount of data to be loaded decreases, the data from the memory Since the time required for reading is reduced, the overall processing time can also be reduced.
  • the amount of the comparator can be reduced, it is possible to contribute to the downsizing, weight saving, and cost reduction of the apparatus.
  • the data used for the comparison may be stored in a compressed format, or may be compressed after being read from the memory and before the comparison.
  • FIG. 17 shows another configuration example of the communication control apparatus of the base technology.
  • the communication control device 10 shown in this figure has two communication control units 12 having the same configuration as the communication control device 10 shown in FIG.
  • a switching control unit 14 for controlling the operation of each communication control unit 12 is provided.
  • Each communication control unit 12 has two input / output interfaces 16 and is connected to two networks on the upstream side and the downstream side via the respective input / output interfaces 16.
  • the communication control unit 12 inputs communication data from either one of the network powers and outputs the processed data to the other network.
  • the switching control unit 14 switches the direction of communication data flow in the communication control unit 12 by switching input / output of the input / output interface 16 provided in each communication control unit 12. As a result, bidirectional communication control is possible, not just in one direction.
  • the switching control unit 14 may control one of the communication control units 12 to process an inbound packet and the other to process an outbound packet, or may control both to process an inbound packet. However, both parties may control to process outbound packets. As a result, for example, the direction of communication to be controlled can be made variable according to the traffic status and purpose.
  • the switching control unit 14 may acquire the operation status of each communication control unit 12, and may switch the direction of communication control according to the operation status. For example, when one communication control unit 12 is in a standby state and the other communication control unit 12 is operating, when it is detected that the communication control unit 12 has stopped due to a failure or the like, it is on standby as an alternative. The communication control unit 12 may be operated. As a result, the fault tolerance of the communication control device 10 can be improved. Further, when maintenance such as database update is performed on one communication control unit 12, the other communication control unit 12 may be operated as an alternative. This ensures proper maintenance without stopping the operation of the communication control device 10. Tenancy can be performed.
  • Three or more communication control units 12 may be provided in the communication control device 10.
  • the switching control unit 14 acquires the traffic state, and controls the communication direction of each communication control unit 12 so that more communication control units 12 are allocated to the communication control process in the direction with a large amount of communication. May be. As a result, even if the amount of communication in a certain direction increases, the decrease in communication speed can be minimized.
  • a part of the communication control unit 2 or 4 may be shared between the plurality of communication control units 12.
  • a part of the packet processing circuit 20 may be shared.
  • FIG. 18 shows a configuration of the communication control device 10 including a plurality of communication control devices 10a, 10b, 10c,. Since the first database 50 requires a large capacity in proportion to the number of data, the first database 50 is divided and held in the communication control devices 10a, 10b, 10c,. As will be described later, in the communication control system 100 of the base technology, the communication packet to be processed is supplied to all the communication control devices 10a, 10b, 10c,. 10 processes the received packet.
  • the communication control device 10a has a data ID power of 00000 1 to force "100000”
  • the communication control device 10b has a data ID of "100001” to "20000 0”
  • the communication control device 10c has a data ID of " Data from 200001 “to” 300000 "is held, and packets are processed by referring to the data held by each.
  • FIG. 19 shows an example of internal data of the management table 111 provided in the operation monitoring apparatus 110.
  • the management table 111 is provided with a device ID column 112, an operation status column 113, and a data ID column 114.
  • device IDs of the communication control devices 10a, 10b,... are stored.
  • the operation status column 113 the operation status of the communication control device is stored, and in the data ID column 114.
  • the range of data IDs to be handled by the communication control device is stored.
  • the operation status includes, for example, “in operation”, “standby”, “failure”, “data updating”, and the like.
  • the operation status column 113 is updated by the operation monitoring device 110 every time the operation status of the communication control devices 10a, 10b,. In the example shown in FIG.
  • the operation monitoring device 110 monitors the operation status of the plurality of communication control devices 10, and when it is detected that a trouble has occurred in any one of the communication control devices 10 and becomes inoperable, the operation monitoring device 110 The same data as the communication control device 10 whose operation has been stopped is stored in the communication control device 10 that is in the state, and the operation is switched to the communication control device 10. For example, as shown in FIG.
  • the data ID “100001” is assigned to the communication control device 10 with the device ID “6” in the standby state.
  • Either one of the data may be stored in advance in the standby communication control device 10 and may be set in the hot standby state or in the cold standby state.
  • the database server 150 acquires and holds the latest database from an external database at a predetermined timing.
  • the operation monitoring device 110 transfers and stores data from the database server 150 to the communication control device 10 in order to reflect the latest database held in the database server 150 to the communication control device 10 at a predetermined timing. Make it.
  • FIGS. 21 (a), 21 (b), and 21 (c) are diagrams for explaining how the database is updated.
  • Fig. 21 (a) as in Fig. 19, the communication control devices 10 with device IDs "1" to "5" are in operation, and the communication control device 10 with device ID "6" is in stand-alone. Indicates a situation.
  • the operation monitoring device 110 identifies the communication control device 10 that is currently in a stand-by state, and instructs the database server 150 to store data in the communication control device 10.
  • the operation monitoring apparatus 110 changes the operation status column 113 of the apparatus ID “6” to “data updating”.
  • FIG. 21B shows a situation where the database of the communication control apparatus 10 is being updated.
  • the database server 150 stores data handled by any of the communication control devices 10 in operation. Stored in the first database 50 of the communication control device 10 with the device ID “6” in standby. In the example of FIG. 21 (b), the data of the data ID “000001 to 100000”, which was assigned to the communication control device 10 of the device ID “1”, is stored in the communication control device 10 of the device ID “6”. Yes.
  • FIG. 21 (c) shows a situation where the database of the communication control device 10 with the device ID “6” is updated and the operation is started, and the communication control device 10 with the device ID “1” is put into a standby state instead.
  • the operation monitoring device 110 starts the operation of the communication control device 10 with the device ID “6” that holds the updated database, and at the same time before the update. Stops the operation of the communication control device 10 with device ID “1” that holds the database of and puts it into the standby state. As a result, the operation is switched to the communication control apparatus 10 whose database has been updated.
  • the communication control device 10 with the device ID “1” is started to operate, and the device ID “2” is started.
  • the operation of the communication control device 10 is stopped.
  • the data stored in each communication control device 10 is not fixed. It changes by. If a process for determining whether the user data exists in any communication control apparatus 10 before sending a packet to each communication control apparatus 10, an extra time is required for the process. Therefore, in the present embodiment, the received packet is supplied to all the communication control devices 10, and each communication control device 10 processes the packet.
  • a technique for realizing such a mechanism will be described.
  • FIG. 22 shows a configuration of a communication path control device provided for processing a packet by a plurality of communication control devices 10.
  • the communication path control device 200 includes a switch 210, an optical splitter 220, which is an example of a data supply unit, and a switch 230.
  • the switch 210 transmits the received packet to the communication control device 10.
  • an optical splitter 220 for supplying packets to the plurality of communication control devices 10a, 10b, and 10c in parallel is provided.
  • the optical splitter 220 The optical splitter 220 transmits the packet to each communication control device in parallel.
  • Each communication control device is set to a promiscuous mode in which all packets are received regardless of the destination MAC address in a mode in which only the packet addressed to its own MAC address is received.
  • each communication control device receives a parallel-cast packet from the optical splitter 220, it omits the MAC address matching process and acquires and processes all packets.
  • the communication control device 10 c transmits a response packet to the switch 210 without going through the optical splitter 220 when returning a packet to the transmission source, such as when communication is prohibited. If the communication is permitted as a result of processing the packet, the communication control device 10c sends the packet to the network.
  • a switch 230 for aggregating packets sent from the plurality of communication control devices 10a, 10b, 10c is provided between the communication control device 10 and the upstream communication line. Actually sends the packet to the switch 230, and the switch 230 sends the packet to the upstream communication line.
  • the switch 230 When the switch 230 receives the packet to which the transmission destination power of the packet is returned, if the returned packet does not require processing by the communication control device 10, the port 232 force of the switch 230 and the switch 210 of the switch 230 Sent to port 212 and sent from switch 210 to the source. Normally, on the Internet, the route at the time of transmission is recorded in the packet in order to secure a return route so that the response packet to the packet is surely returned to the sender. However, in the present embodiment, since a return route is prepared in advance in communication route control device 200, communication between devices is performed without recording the route, that is, without processing a packet. Thereby, useless processing can be omitted and the processing speed can be improved.
  • the communication control device 10 is configured to process packets in both directions. Also good.
  • the optical splitter 220 may be provided on both sides of the communication control device 10. Further, the bypass path from the switch 230 to the switch 210 may not be provided.
  • these communication control devices receive and process or discard all packets cast in parallel from the communication path control device 200, so that the devices are uniquely identified on the Internet. There is no need to assign an IP address.
  • IP address When executing packet processing as described above by a server device or the like, it is necessary to consider an attack on the server device.
  • the communication control device of this embodiment is a malicious third party via the Internet. Since power cannot be attacked directly, communication control can be performed safely.
  • FIG. 23 shows a configuration of a communication management system according to the embodiment.
  • the communication management system 300 performs processing for filtering spam mails using the communication control device 10 described in the base technology.
  • ISP 320 has an SMTP server 340 that relays e-mails, and an SMTP server 340 that receives inquiries from users in order to provide a service for sending and receiving e-mails to subscribed users. Is provided with a POP server 350 that obtains an e-mail addressed to the user from the SMTP server 340 and transmits it to the user.
  • the ISP 320 is provided with a discrimination device 330 for discriminating spam mail between the SMTP server 340 and the Internet 390, and provides a service for discarding or sorting spam mail.
  • the discriminator 330 accumulates e-mails that the SMTP server 340 intends to receive and analyzes the contents of the accumulated e-mails to discriminate spam mails.
  • the discriminator 330 is set up as an SMTP server. In this case, the discriminating device 330 discriminates and discards the medium spam mail of the mail received from the Internet 390, relays only normal mail and sends it to the SMTP server 340.
  • the SMTP server 340 also has the function of the determination device 330. Note that spam mail filtering may be performed only by the communication control device 10 without providing the discrimination device 330.
  • the processing in the discriminator 330 is performed by software.
  • the communication control device 10 described in the prerequisite technology is provided between the determination device 330 and the Internet 390, and an e-mail is acquired in the previous stage of the determination device 330, and the spam mail is filtered.
  • the communication control device 10 of the base technology can realize very high-speed search processing, and can perform filtering at a speed similar to the communication speed. Therefore, first, the communication control device 10 performs high-speed filtering using keywords, and then the discriminating device 330 performs more detailed analysis. As a result, the load on the discriminating apparatus 330 can be reduced, and spam mail can be filtered reliably.
  • a spam key key database 324 is provided as the first database 50.
  • the spam keyword database 324 stores keywords that serve as criteria for determining whether or not a mail should be discarded.
  • the keyword may be, for example, a URL of content such as a phishing site that should not be accessed, or a word that is contrary to public order and morals.
  • the search circuit 30B searches whether or not the keyword stored in the spam key database 324 is included in the e-mail. As described in the base technology, the search circuit 30B can search the data stored in the payload directly without analyzing the header of the packet acquired by the communication control unit 2. You can search email text based on the layout, and search for keywords directly in the mail text! /.
  • the spam keyword database 324 stores keywords set for each user. May be.
  • a search circuit 30A that functions as a user identification unit for identifying the user of the e-mail destination is provided before the search circuit 30B.
  • the user database 322 stores the user's email address and user ID in association with each other.
  • the search circuit 3 OA searches the user database 322 for a mail address set as an e-mail destination, acquires the user ID of the user, and notifies the search circuit 30B. If the spam keyword database 324 is sorted in ascending or descending order by user ID, the search circuit 30B notified of the user ID can quickly and easily acquire the keyword of the corresponding user.
  • the search circuit 30B searches whether or not the keyword set by the user identified by the search circuit 30A is included in the e-mail.
  • the search circuit 30A may also acquire the destination of the e-mail stored directly in the payload and collate it with the user database 322 without analyzing the packet header.
  • the function of the user identification unit may be realized by the connection management device 120 described in the base technology.
  • the second database 60 has a processing content for discarding the e-mail including the keyword stored in the spam keyword database 324 and outputting the e-mail to the determination device 330.
  • the processing execution circuit 40 functions as an output unit that discards the electronic mail including the keyword and outputs the electronic mail not included! / To the determination device 330.
  • the processing execution circuit 40 may replace the keyword with another character string and output it to the determination device 330 instead of discarding the mail including the keyword. For example, URLs to illegal sites such as phishing sites may be deleted or replaced with other URLs.
  • the processing execution circuit 40 may notify the outside when an email including the keyword is detected. Processing such as character string replacement and notification to the outside may be realized by the message output device 130 described in the base technology.
  • the present invention can be used in a communication control device that discriminates inappropriate emails.

Landscapes

  • Business, Economics & Management (AREA)
  • Engineering & Computer Science (AREA)
  • Economics (AREA)
  • Entrepreneurship & Innovation (AREA)
  • Human Resources & Organizations (AREA)
  • Marketing (AREA)
  • Operations Research (AREA)
  • Quality & Reliability (AREA)
  • Strategic Management (AREA)
  • Tourism & Hospitality (AREA)
  • Physics & Mathematics (AREA)
  • General Business, Economics & Management (AREA)
  • General Physics & Mathematics (AREA)
  • Theoretical Computer Science (AREA)
  • Data Exchanges In Wide-Area Networks (AREA)

Abstract

Un dispositif de commande de communication (10) comprend une base de données de mots-clés de pourriel (324), un circuit de recherche (30B) et un circuit d'exécution de traitement (40). La base de données de mots-clés de pourriel (324) stocke des mots-clés servant de critères pour déterminer si ou non écarter un courrier ou non. Le circuit de recherche (30B) acquiert un courrier à une étape précédente d'un dispositif d'identification (330) pour stocker des courriers et identifier un courrier de pourriel parmi les courriers stockés et recherche si ou non un mot-clé stocké dans la base de données de mots-clés de pourriel (324) est compris dans le courrier ou non. Le circuit d'exécution de traitement (40) sert d'unité de sortie pour écarter un courrier comprenant le mot-clé et émettre un courrier ne comprenant pas le mot-clé au dispositif d'identification (330).
PCT/JP2006/325432 2006-12-20 2006-12-20 Dispositif de commande de communication et procédé de commande de communication WO2008075426A1 (fr)

Priority Applications (2)

Application Number Priority Date Filing Date Title
PCT/JP2006/325432 WO2008075426A1 (fr) 2006-12-20 2006-12-20 Dispositif de commande de communication et procédé de commande de communication
JP2007525095A JPWO2008075426A1 (ja) 2006-12-20 2006-12-20 通信制御装置及び通信制御方法

Applications Claiming Priority (1)

Application Number Priority Date Filing Date Title
PCT/JP2006/325432 WO2008075426A1 (fr) 2006-12-20 2006-12-20 Dispositif de commande de communication et procédé de commande de communication

Publications (1)

Publication Number Publication Date
WO2008075426A1 true WO2008075426A1 (fr) 2008-06-26

Family

ID=39536065

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/JP2006/325432 WO2008075426A1 (fr) 2006-12-20 2006-12-20 Dispositif de commande de communication et procédé de commande de communication

Country Status (2)

Country Link
JP (1) JPWO2008075426A1 (fr)
WO (1) WO2008075426A1 (fr)

Cited By (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
WO2010021388A1 (fr) * 2008-08-21 2010-02-25 ヤマハ株式会社 Dispositif de relais, procédé de relais et support d'enregistrement
WO2010063213A1 (fr) * 2008-12-02 2010-06-10 腾讯科技（深圳）有限公司 Procédé et dispositif d’interception de pourriel

Citations (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
JPH11232304A (ja) * 1998-02-09 1999-08-27 Casio Comput Co Ltd 文章内容判定装置及びそれを用いた電子メール装置
JP2005222207A (ja) * 2004-02-04 2005-08-18 Duaxes Corp 通信データのフィルタリング方法及び装置
WO2006087832A1 (fr) * 2005-02-18 2006-08-24 Duaxes Corporation Dispositif de traitement de données

Family Cites Families (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
JP2005210455A (ja) * 2004-01-23 2005-08-04 Css:Kk 電子メール中継装置
WO2006123420A1 (fr) * 2005-05-20 2006-11-23 Duaxes Corporation Systeme de traitement de donnees

Patent Citations (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
JPH11232304A (ja) * 1998-02-09 1999-08-27 Casio Comput Co Ltd 文章内容判定装置及びそれを用いた電子メール装置
JP2005222207A (ja) * 2004-02-04 2005-08-18 Duaxes Corp 通信データのフィルタリング方法及び装置
WO2006087832A1 (fr) * 2005-02-18 2006-08-24 Duaxes Corporation Dispositif de traitement de données

Non-Patent Citations (1)

* Cited by examiner, † Cited by third party
Title
IKEDA F.: "Jidai o Sakidori suru Saisentan Gijutsu o Tettsei Shokai Kono Solution ga Sugoi!!", NETWORK WORLD, vol. 11, no. 2, 1 February 2006 (2006-02-01), pages 62 - 63, XP003022921 *

Cited By (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
WO2010021388A1 (fr) * 2008-08-21 2010-02-25 ヤマハ株式会社 Dispositif de relais, procédé de relais et support d'enregistrement
JP2010049449A (ja) * 2008-08-21 2010-03-04 Yamaha Corp 中継装置およびプログラム
US8676907B2 (en) 2008-08-21 2014-03-18 Yamaha Corporation Relay apparatus, relay method and recording medium
CN102132264B (zh) * 2008-08-21 2014-04-30 雅马哈株式会社 中继装置、中继方法以及记录介质
WO2010063213A1 (fr) * 2008-12-02 2010-06-10 腾讯科技（深圳）有限公司 Procédé et dispositif d’interception de pourriel

Also Published As

Publication number Publication date
JPWO2008075426A1 (ja) 2010-04-02

Similar Documents

Publication Publication Date Title
JP4554675B2 (ja) 通信制御装置及び通信制御システム
JP4087427B2 (ja) データ処理システム
JP4554671B2 (ja) 通信制御装置
JPWO2007141835A1 (ja) 通信管理システム、通信管理方法、及び通信制御装置
JP4571184B2 (ja) 通信管理システム
JP4188409B2 (ja) 通信管理システム、通信管理方法、及び通信制御装置
JP4574675B2 (ja) 通信管理システム
WO2008062542A1 (fr) Appareil de commande de communication
WO2008004284A1 (fr) Procédé et dispositif permettant la régulation des communications
WO2008075426A1 (fr) Dispositif de commande de communication et procédé de commande de communication
JP4146505B1 (ja) 判定装置及び判定方法
JP4319246B2 (ja) 通信制御装置及び通信制御方法
JPWO2009066343A1 (ja) 通信制御装置及び通信制御方法
WO2008065721A1 (fr) Dispositif de test
KR20080017046A (ko) 데이터 프로세싱 시스템
JP5380710B2 (ja) 通信制御装置
JP4676530B2 (ja) 通信制御装置
JP4638513B2 (ja) 通信制御装置及び通信制御方法
JP5156892B2 (ja) ログ出力制御装置及びログ出力制御方法
JPWO2009066347A1 (ja) 負荷分散装置
JPWO2009066344A1 (ja) 通信制御装置、通信制御システム及び通信制御方法
KR20080057284A (ko) 통신 관리 시스템, 통신 관리 방법, 및 통신 제어 장치
JPWO2009066341A1 (ja) 検知回路及び検知方法
JPWO2009066349A1 (ja) 通信制御装置及び通信制御方法
JPWO2009069178A1 (ja) 通信制御装置及び通信制御方法

Legal Events

Date Code Title Description
WWE Wipo information: entry into national phase

Ref document number: 2007525095

Country of ref document: JP

121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 06835052

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

122 Ep: pct application non-entry in european phase

Ref document number: 06835052

Country of ref document: EP

Kind code of ref document: A1