Communication control apparatus, firewall apparatus, and data communication method

• US 8,745,719 B2
• Filed: 12/10/2007
• Issued: 06/03/2014
• Est. Priority Date: 11/28/2002
• Status: Expired due to Fees

• Current Assignee: NTT Docomo Incorporated (Nippon Telegraph and Telephone Corporation)
• Original Assignee: NTT Docomo Incorporated (Nippon Telegraph and Telephone Corporation)
• Inventors: Kitahama, Hideki, Ishida, So
• Primary Examiner(s): McNally, Michael S
• Application Number:
  US11/953,474
• Publication Number:
  US 20080107068A1
• Time in Patent Office: 2,367 Days
• Field of Search: 726/11, 370/28, 370/29, 370/31, 370/38
• US Class Current: 726/11
• CPC Class Codes: H04L 63/0263 Rule management
• CPC Class Codes: H04L 63/0272 Virtual private networks
• CPC Class Codes: H04W 12/02 Protecting privacy or anonymity, e.g. protecting personally identifiable information [PII]
• CPC Class Codes: H04W 8/082 for traffic bypassing of mobility servers, e.g. location registers, home PLMNs or home agents
• CPC Class Codes: H04W 8/10 between location register and external networks
• CPC Class Codes: H04W 80/04 Network layer protocols, e.g. mobile IP [Internet Protocol]

Abstract

A communication control system 1 according to the present invention is provided with a home agent apparatus 10, a plurality of firewall devices 20-40, and a mobile station 50. When the mobile station 50 is connected, for example, to the firewall device 20, the firewall device 20 receives identification information and a configuration file of the mobile station 50 from the home agent apparatus 10 and constructs a firewall for the mobile station 50, using the configuration file. When the firewall device 20 receives an IP packet, it selects a firewall suitable for the mobile station 50 being a destination of the packet and determines the propriety of passage thereof according to a filtering condition set in this firewall.

Claims

1. A communication control apparatus for implementing transmission and reception of data to and from a plurality of firewall devices connectible to a mobile station, the communication control apparatus comprising:

a memory configured to store firewall configuration information suitable for the mobile station, in correspondence with identification information of the mobile station;

circuitry configured to detect a first firewall device of the plurality of firewall devices connected to the mobile station, wherein

the communication control apparatus, the mobile station, and each of the plurality of firewall devices are separate and distinct stand-alone devices, and

the circuitry is configured to receive a binding update packet from the mobile station, the binding update packet indicating that the mobile station has moved and is now connected to a second firewall device; and

a communication interface configured to transmit, in response to the detection of the second firewall device connected to the mobile station, a request for forwarding the firewall configuration information corresponding to the identification information of the mobile station to the first firewall device to which the mobile station was previously connected, wherein

the request for forwarding the firewall configuration information includes information requesting that the first firewall device forward the firewall configuration information to the communication control apparatus or information requesting that the first firewall device forward the firewall configuration information to the second firewall device.

2. The communication control apparatus of claim 1, wherein the communication interface is configured to receive the binding update packet transmitted by the mobile station, the binding update identifying the mobile station and the second firewall device.

3. The communication control apparatus of claim 1, wherein

the circuitry is configured to generate a firewall configuration file from the firewall configuration information stored in the memory, and

the communication interface is configured to transmit the firewall configuration file to the mobile station.

4. The communication control apparatus of claim 1, wherein the communication interface receives the firewall configuration from the first firewall device in response to the request for forwarding the firewall configuration information, and forwards the firewall configuration received from the first firewall device to the second firewall device.

5. A data communication method in which a communication control apparatus comprising a memory configured to store firewall configuration information suitable for a mobile station, in correspondence with identification information of the mobile station, implements transmission and reception of data to and from a plurality of firewall devices connectible to the mobile station, the data communication method comprising:

detecting a first firewall device of the plurality of firewall devices connected to the mobile station, wherein

the communication control apparatus, the mobile station, and each of the plurality of firewall devices are separate and distinct stand-alone devices, and

the detecting includes receiving a binding update packet from the mobile station, the binding update packet indicating that the mobile station has moved and is now connected to a second firewall device; and

transmitting, in response to the detection of the second firewall device connected to the mobile station, a request for forwarding the firewall configuration information corresponding to the identification information of the mobile station, to the first firewall device to which the mobile station was previously connected, wherein

the request for forwarding the firewall configuration information includes information requesting that the first firewall device forward the firewall configuration information to the communication control apparatus or information requesting that the first firewall device forward the firewall configuration information to the second firewall device.

6. A firewall apparatus for implementing relaying in transmission and reception of data between a communication control apparatus, and a plurality of mobile stations, the communication control apparatus storing, for each of the mobile stations, firewall configuration information suitable for the mobile station in correspondence with identification information of the mobile station, the firewall apparatus comprising:

a communication interface configured to receive, from the communication control apparatus in response to detection of the mobile station switching from being connected to a preceding firewall device to the firewall device, the identification information of the mobile station and the firewall configuration information, both of which were obtained from the preceding firewall device; and

circuitry configured to generate a firewall for the mobile station using the received firewall configuration file, wherein

the firewall apparatus, the preceding firewall device, the communication control apparatus, and the plurality of mobile stations are separate and distinct stand-alone devices.