Communication Control Device, Communication Control System, Communication Control Method, and Communication Control Program

• US 20090178110A1
• Filed: 03/01/2007
• Published: 07/09/2009
• Est. Priority Date: 03/03/2006
• Status: Abandoned Application

• Current Assignee: NEC Corporation
• Original Assignee: NEC Corporation
• Inventors: Higuchi, Naoshi
• Application Number:
  US12/281,507
• Publication Number:
  US 20090178110A1
• Time in Patent Office: Days
• US Class Current: 726/1
• CPC Class Codes: G06F 13/387 for adaptation of different data processing systems to different peripheral devices, e.g. protocol converters for incompatible systems, open system

Abstract

The communication control device of the present invention includes: a communication parameter acquisition means (105) for acquiring communication parameters that specify the transmission origin of an outside apparatus based on existence information of the outside apparatus that is received from a communication network, an apparatus identifier acquisition means (104) for acquiring from the outside apparatus an apparatus identifier that is an identifier for the outside apparatus, a policy determination means (106) for determining a communication policy for permitting or prohibiting communication with the outside apparatus that is specified by the apparatus identifier, a communication selection rule combining means (107) for combining communication selection rules based on the communication policy and communication parameters, and a communication pass control means (108) for passing or blocking communication with the outside apparatus based on the communication selection rules that have been combined by the communication selection rule combining means.

Claims

1. A communication control device for, when communication is carried out with an outside apparatus by way of a communication network, determining and controlling whether communication with said outside apparatus is to be permitted or not, said communication control device comprising:

a communication parameter acquisition means for acquiring communication parameters specifying the transmission origin of said outside apparatus based on existence information of said outside apparatus that is received from said communication network;

an apparatus identifier acquisition means for acquiring an apparatus identifier from said outside apparatus, said apparatus identifier being an identifier for said outside apparatus;

a policy determination means for determining a communication policy for permitting or prohibiting communication with an outside apparatus specified by said apparatus identifier;

a communication selection rule combining means for combining communication selection rules based on said communication policy and said communication parameters; and

a communication pass control means for passing or blocking communication with said outside apparatus based on communication selection rules that have been combined by said communication selection rule combining means.

2. The communication control device according to claim 1, further comprising:

a communication selection rule storage means for storing said communication selection rules and said apparatus identifiers in association with each other with said apparatus identifiers as keys and said communication selection rules that have been combined as values;

an old communication selection rule deleting means for releasing from said communication pass control means settings of communication selection rules that have been extracted from said communication selection rule storage means with apparatus identifiers as keys; and

communication selection rule setting means for both causing storage of sets of said apparatus identifiers and said communication selection rules in said communication selection rule storage means and making settings in said communication pass control means.

3. The communication control device according to claim 1, wherein said policy determination means both determines a first communication policy based on specific designated information that is received from an user of said outside apparatus by way of said outside apparatus, and further, determines the same content as said first policy for second and succeeding communication policies.

4. A communication control device according to claim 2, further comprising:

a communication selection rule updating means for, when reconnecting with said outside apparatus, both updating said communication selection rules that are stored in said communication selection rule storage means to communication selection rules that are newly determined and setting updated communication selection rules in said communication pass control means;

wherein said communication selection rule updating means is provided together with said communication selection rule setting means.

9. A communication control system for, when carrying out communication between a terminal device and an outside apparatus by way of a communication network, determining and controlling whether to permit said communication or not;

wherein;

said outside apparatus includes an existence information transmission means for transmitting existence information that indicates an existence of said outside apparatus itself to said terminal device; and

said terminal device is provided with a communication control device according to claim 1 as a communication control means, and includes a communication means for executing communication by way of said communication network and a user interface means for receiving and supplying necessary information.

5. A communication control device for, when performing communication with an outside apparatus by way of a communication network, controlling whether communication with said outside apparatus is to be permitted or not, said communication control device comprising:

a policy storage means for storing a policy indicating permission or blockage of communication with said outside apparatus for each of apparatus identifier that uniquely identifies said outside apparatus;

an apparatus discovery means for detecting said outside apparatus based on existence information that is received from said communication network and that indicates an existence of said outside apparatus;

a communication parameter acquisition means for acquiring from said existence information communication parameters that specify the transmission origin of said outside apparatus that has been discovered by said apparatus discovery means;

an apparatus identifier acquisition means for acquiring from said existence information said apparatus identifier that has been discovered by said apparatus discovery means;

a policy determination means for both reading from said policy storage means a policy for an apparatus identifier that has been acquired by said apparatus identifier acquisition means and determining said policy that has been read as the policy of said outside apparatus;

a communication selection rule combining means for, based on said policy that has been determined by said policy determination means, said apparatus identifier acquired by said apparatus identifier acquisition means, and said communication parameters that have been acquired by said communication parameter acquisition means, combining communication selection rules that indicate whether to pass or block communication for an outside apparatus to which said apparatus identifier is assigned; and

a communication pass control means for passing or blocking communication with said outside apparatus based on said communication selection rules that have been combined.

6. The communication control device according to claim 5, further comprising:

a policy inquiry means for functioning when said policy determination means is unable to determine a policy of said apparatus identifier because said policy for said apparatus identifier was not stored in said policy storage means and inquiring for the policy of said outside apparatus to which said apparatus identifier has been assigned;

wherein said policy determination means both determines that said policy for which said policy inquiry means has inquired is to be the policy of said outside apparatus and causes said policy that has been determined to be stored in said policy storage means.

7. The communication control device according to claim 5, further comprising:

a communication selection rule storage means for storing communication selection rules that have been combined by said communication selection rule combining means together with corresponding said apparatus identifier; and

a communication selection rule storage determination means for determining whether communication selection rules having the same apparatus identifier as new communication selection rules that have been combined by said communication selection rule combining means are already stored or not in said communication selection rule storage means;

wherein said communication selection rule storage determination means, upon determining that communication selection rules of an apparatus identifier that are the same as newly combined communication selection rules are already stored in said communication selection rule storage means, updates said communication selection rules that are stored to the communication selection rules that have been newly combined.

8. The communication control device according to claim 5, wherein an electronic signature is implemented in said existence information;

said communication control device further comprising;

a transmission origin authentication means for authenticating the transmission origin of said outside apparatus based on a signature that is implemented in existence information received from said outside apparatus; and

a reliability determination means for determining whether the transmission origin of said outside apparatus that has been authenticated by said transmission origin authentication means can be trusted;

wherein when said reliability determination means determines that the transmission origin of said outside apparatus can be trusted, said policy determination means makes the policy of said outside apparatus “

permit communication,” and

when said reliability determination means determines that the transmission origin of said outside apparatus cannot be trusted, said policy determination means makes the policy of said outside apparatus “

block communication.”

10. A communication control method for, when carrying out communication with an outside apparatus by way of a communication network, determining and controlling whether to permit communication with said outside apparatus or not;

said method comprising;

an apparatus identifier/communication parameter acquisition step of acquiring, from said outside apparatus, an apparatus identifier that is the identifier for said outside apparatus and communication parameters that specify the transmission origin of said outside apparatus from existence information of said outside apparatus that is received from said communication network;

a policy determination step of determining a communication policy for permitting or prohibiting communication with said outside apparatus that is specified by said apparatus identifier;

a communication selection rule combining step of combining communication selection rules based on said communication policy and said communication parameters; and

a communication pass control step carried out in a communication pass control means that functions based on communication selection rules that have been combined and sets passage or blockage of communication with said outside apparatus.

11. The communication control method according to claim 10, further comprising before said communication pass control step:

a communication selection rule storage step of storing in a communication selection rule storage means said apparatus identifier and said communication selection rules in association with each other with said apparatus identifier as a key and said combined communication selection rules as values;

an old communication selection rule deletion step of releasing settings from said communication pass control means for communication selection rules acquired from said communication selection rule storage means with said apparatus identifier as key; and

a communication selection rule setting step of both storing sets of said apparatus identifier and said communication selection rules in said communication selection rule storage means and setting in said communication pass control means.

12. The communication control method according to claim 11, further comprising a communication selection rule updating step of, when said communication selection rules are newly combined due to reconnection with said outside apparatus and before execution of said communication pass control step, updating said communication selection rules stored in said communication selection rule storage means to communication selection rules that have been newly determined.

13. A communication control method for, when carrying out communication with an outside apparatus by way of a communication network, controlling whether or not to permit communication with said outside apparatus;

said method comprising;

an outside apparatus detection step of detecting said outside apparatus based on existence information that is received from said communication network and that indicates existence of said outside apparatus;

an apparatus identifier/communication parameter acquisition step of acquiring from said existence information communication parameters that specify the transmission origin of said outside apparatus that has been detected and the corresponding apparatus identifier;

a policy determination step of reading from a policy storage means, in which policies are stored in advance for each apparatus identifier, a policy that indicates whether to permit or block communication with an outside apparatus to which said apparatus identifier that has been acquired is assigned and determining said policy as the policy of said outside apparatus;

a communication selection rule combining step of, based on said policy that has been determined, and said apparatus identifier and communication parameters that have been acquired, combining communication selection rules that indicate whether to pass or block communication for said outside apparatus to which said apparatus identifier is assigned; and

a communication pass control step of executing determination based on said communication selection rules that have been combined and passing or blocking communication with said outside apparatus.

14. The communication control method according to claim 13, further comprising before said policy determination step:

a policy inquiry step for, when the policy for an apparatus identifier that was acquired in said apparatus identifier/communication parameter acquisition step was not stored in a policy storage means that was provided in advance and the policy for said apparatus identifier therefore cannot be determined, inquiring to the outside for the policy of said outside apparatus to which said apparatus identifier is assigned; and

a policy re-storing step for both determining the policy that obtained by inquiry as the policy of said outside apparatus and again storing said policy in said policy storage means.

15. The communication control method according to claim 13, further comprising before said communication pass control step:

a communication selection rule storage determination step for determining whether communication selection rules having the same apparatus identifier as communication selection rules that were combined in said communication selection rule combining step are already stored in a communication selection rule storage means that was provided in advance; and

a communication selection rule updating step for, when it is determined that communication selection rules of said apparatus identifier that have been combined are already stored, updating said communication selection rules that are stored to newly combined communication selection rules.

16. The communication control method according to claim 13, wherein an electronic signature is implemented in said existence information, said communication control method further comprising:

a transmission origin authentication step for authenticating the transmission origin of said outside apparatus based on a signature implemented in existence information that is received from said outside apparatus;

a reliability determination step for determining whether the transmission origin of said outside apparatus that has been authenticated can be trusted or not; and

a communication permission determination step for making the policy of said outside apparatus “

permit communication”

when it is determined that the transmission origin of said outside apparatus can be trusted and making the policy of said outside apparatus “

block communication”

when it is determined that the transmission origin of said outside apparatus cannot be trusted.

17. A communication control program products for, when carrying out communication with an outside apparatus by way of a communication network, determining and controlling whether or not to permit communication with said outside apparatus;

said program causing a computer to execute processes of;

an apparatus identifier/communication parameter acquisition step of acquiring, from said outside apparatus, an apparatus identifier that is the identifier for said outside apparatus and communication parameters that specify the transmission origin of said outside apparatus based on existence information of said outside apparatus that is received from said communication network;

a policy determination step of determining a communication policy for permitting or prohibiting communication with said outside apparatus that is specified by said apparatus identifier;

a communication selection rule combining step of combining communication selection rules based on said communication policy and said communication parameters; and

a communication pass control step carried out in a communication pass control means that functions based on communication selection rules that have been combined and that sets passage or blockage of communication with said outside apparatus.

18. The communication control program products according to claim 17, said program causing a computer to, before said communication pass control step, execute further processes of:

a communication selection rule storage step of storing in a communication selection rule storage means said apparatus identifier and said communication selection rules in association with each other with said apparatus identifier as a key and said combined communication selection rules as values;

an old communication selection rule deletion step of releasing settings from said communication pass control means for communication selection rules acquired from said communication selection rule storage means with said apparatus identifier as key; and

a communication selection rule setting step of both storing sets of said apparatus identifier and said communication selection rules in said communication selection rule storage means and setting in said communication pass control means.

19. The communication control program products according to claim 17, said program causing a computer to, in said policy determination step, execute a process of both determining a first communication policy based on specific designated information that is received as input by way of said outside apparatus from an user of said outside apparatus and determining the same content as said first communication policy for second and succeeding communication policies.

20. The communication control program products according to claim 18 for causing a computer to execute a process of a communication selection rule updating step of, when said communication selection rules are newly combined due to reconnection with said outside apparatus and before execution of said communication pass control step, updating said communication selection rules stored in said communication selection rule storage means to communication selection rules that have been newly determined.

21. A communication control program products for, when carrying out communication with an outside apparatus by way of a communication network, determining and controlling whether or not to permit communication with said outside apparatus;

said program causing a computer to execute processes of;

an outside apparatus detection step of detecting said outside apparatus based on existence information that is received from said communication network and that indicates existence of said outside apparatus;

an apparatus identifier/communication parameter acquisition step of acquiring from said existence information communication parameters that specify the transmission origin of said outside apparatus that has been detected and the corresponding apparatus identifier;

a policy determination step of reading from a policy storage means, in which policies are stored in advance for each apparatus identifier, a policy that indicates whether to permit or block communication with an outside apparatus to which said apparatus identifier that has been acquired is assigned and determining said policy as the policy of said outside apparatus;

a communication selection rule combining step of, based on said policy that has been determined and said apparatus identifier and communication parameters that have been acquired, combining communication selection rules that indicate whether to pass or block communication for said outside apparatus to which said apparatus identifier is assigned; and

a communication pass control step of executing determination based on said communication selection rules that have been combined and passing or blocking communication with said outside apparatus.

22. The communication control program products according to claim 21, said program causing a computer to further execute, before said policy determination step, processes of:

a policy inquiry step for, when the policy for an apparatus identifier that was acquired in said apparatus identifier/communication parameter acquisition step was not stored in a policy storage means that was provided in advance and the policy for said apparatus identifier therefore cannot be determined, inquiring to the outside for the policy of said outside apparatus to which said apparatus identifier is assigned; and

a policy re-storing step for both determining the policy that was obtained by inquiry as the policy of said outside apparatus and again storing said policy in said policy storage means.

23. The communication control program products according to claim 21, said program causing a computer to further execute, before said communication pass control step, processes of:

a communication selection rule storage determination step for determining whether communication selection rules having the same apparatus identifier as communication selection rules that were combined in said communication selection rule combining step are already stored in a communication selection rule storage means that has been provided in advance; and

a communication selection rule updating step for, when it is determined that communication selection rules of said apparatus identifier that have been combined are already stored, updating said communication selection rules that are stored to newly combined communication selection rules.