JPH1070576A - Fire wall dynamic control method - Google Patents

Abstract

PROBLEM TO BE SOLVED: To properly execute the filter setting of a fire wall to a moving terminal dial-up-connected to an internet service provider(ISP) and its user and to properly permit access to a home network resource. SOLUTION: When the terminal 21 dial-up-connected to ISP 30 access to an internal network 20 within the fire wall 22 through the internet 10, user information of the terminal 21 is sent from ISP 30 to judge whether the terminal 21 is a moving terminal moved from the internal network 20 based on this user information. When it is the moving terminal, the filter of the fire wall 22 is set to permit communication between the terminal 21 and the internal network 20, and communication between the terminal 21 and the internal network 20 is executes through an IP tunnel.

Description

DETAILED DESCRIPTION OF THE INVENTION

[0001]

The present invention relates to a method for dynamically controlling a firewall.

[0002]

2. Description of the Related Art When an in-house network is connected to the Internet, it is necessary to prevent unauthorized access from the Internet. However, if the communication between the external network and the internal network is completely cut off, even if the user tries to access the home network from the outside via the Internet, this becomes impossible.

(Firewall and Filtering Process) For this reason, it is essential to construct a firewall (firewall) for selectively passing external communication via the Internet.

[0004] Conventionally, a firewall performs a filtering process of passing only a packet permitted in advance among data packets communicated between an internal network and an external network, and blocking other packets.

[0005] Usually, the filter is set by the I of the source terminal.
This is performed by specifying a P (Internet Protocol) address, an IP address of a transmission destination terminal, a type of a used protocol, a port number, and the like. For example, TCP (Transmission Control Protocol) from an external specific IP address to an internal arbitrary host (terminal)
(col: transmission control protocol) When communication is performed by the protocol, a setting is made such that only those using a certain port number (for example, 110) are permitted.

The port numbers are TCP, UDP
(User Datagram Protocol) is an identifier used to specify a process of an upper layer.

[0007] However, a user carries a portable computer such as a notebook personal computer, and moves to an Internet service provider (ISP).
der)), it is difficult to perform appropriate filtering when connecting to the Internet via a dial-up connection (also referred to as a PPP connection) to access a home network.

[0008] The IP address used for Internet communication is represented by a 4-byte numerical value, and the high-order part of the IP address represents the network to which the terminal is connected.
This is because the lower part is the identification number of the terminal in the network. In other words, a terminal (mobile host: MH (MobileHo
abbreviated as st)),
The IP address assigned to the mobile terminal changes each time it is connected, and communication cannot be performed using the IP address in the home network as it is. As described above, in the case of dial-up connection, since the IP address of the mobile terminal is not constant, it is not possible to specify the IP address of the source terminal of the data packet and the IP address of the destination terminal in the firewall and set a filter. Will be possible.

[0009] Even if it is possible to appropriately set the filter of the firewall and allow only authorized mobile terminals and their users to access from outside to inside, the user is usually allowed to use the home terminal on the home network. It is not always possible to use various internal network resources such as a shared disk being accessed, an in-house database, and an in-house page of the World Wide Web (WWW).

[0010] This is because access to these internal network resources may be individually restricted, and in that case, access permission and non-permission are often determined based on the IP address of the client terminal. is there.

(Mobile IP) Next, a mobile IP (Mobile-IP) currently being standardized will be described with reference to FIG. Mobile IP is a technology that enables other terminals to always communicate with the mobile terminal using the same IP address, no matter where the terminal moves and connects to the Internet. However, the current mobile IP is not compatible with a network having a firewall due to specifications.

In FIG. 3, 100 is the Internet,
200 is the home network of the mobile terminal 201, 202
Is a home agent (abbreviated as HA (Home Agent)) on the home network 200, 203 is a router,
Reference numeral 300 denotes an ISP, 400 denotes another network, and 401 denotes a terminal on another network 400.

Here, the IP address of the home network 200 to which the mobile terminal 201 is normally connected is [13
3.128.8.0], the IP address of the mobile terminal 201 in the home network 200 is [133.128.8.81], and the IP address of the home agent 202 is [133.128.8.0].
128.8.100], and the IP address assigned when the mobile terminal 201 makes a dial-up connection to the ISP 300 is [130.54.20.199].

Generally, a terminal 4 of a certain network 400
When a packet is sent from the terminal 01 to the terminal 201,
The terminal 201 is delivered to the home network 200 to which the terminal 201 is normally connected, as indicated by a route indicated by reference numeral 501 in FIG. Therefore, the terminal 201 is connected to another network such as I
When moving to the SP 300, it is necessary to transfer the packet to the destination network 300.

In order to perform this transfer, in the mobile IP, an agent host is installed in each of a source network and a destination network. An agent host installed in a source network is called a home agent. The agent host installed on the destination network is a foreign agent (FA
(Abbreviated as Foregin Agent). The mobile terminal itself can also play the role of a foreign agent. In FIG. 3, it is assumed that the mobile terminal 201 has a foreign agent function.

When the terminal 201 moves from the home network 200 and makes a dial-up connection 301 to the ISP 300, the temporary IP address [130.
54.20.199] is assigned.

The mobile terminal 201 notifies the home agent 202 of the home network 200 of this IP address and the IP address [133.128.8.81] of the home network 200 to which the mobile terminal 201 is normally connected via the ISP 300 and the Internet 100. Keep it. As a result, the terminal 201 having the IP address [133.128.8.81] is moving and the IP address temporarily acquired by the home agent 202 is [130.54.20.199].
Since it is known, it is recorded in the database.

When a packet addressed to the terminal 201 arrives from the terminal 401 in a certain network 400 using the normal IP address [133.128.8.81], the home agent 202 receives the packet instead of the terminal 201 (path 502).
reference). The home agent 202 embeds the packet addressed to the mobile terminal 201 from the terminal 401 into the temporarily acquired packet for the IP address [130.54.20.199], and transfers the packet to the mobile terminal 201 via the Internet 100 and the ISP 300 ( See path 503). The mobile terminal 201 extracts the original packet from the received packet and, if necessary, sends the ISP 30
0 and the packet is sent via the Internet 100 (see path 504).

As described above, according to the mobile IP, the terminal 401 gives the moving terminal 201 its normal I
Packets can be sent using the P address [133.128.8.81].

However, communication is performed between the mobile terminal 201 and the home agent 202 using the temporarily acquired IP address [130.54.20.199].

That is, in the current mobile IP, the packet transmitted from the mobile terminal 201 includes the temporarily acquired I
Since no processing is performed using the P address, routing is performed as usual. Accordingly, in the above-described setting of the firewall by the filter processing, only communication between the mobile terminal 201 and the home agent 202 is permitted, so that the mobile terminal 201 communicates with an internal host (terminal) in the home network 200 other than the home agent 202. Can't do it. This means that access of the mobile terminal 201 to various internal network resources is restricted.

[0022]

SUMMARY OF THE INVENTION In view of the above-mentioned problems, the present invention provides a dynamic firewall capable of performing appropriate filter settings for a mobile terminal and its user who are dial-up connected to an Internet service provider (ISP). It is an object of the present invention to provide a control method and a firewall dynamic control method capable of appropriately permitting the terminal and a user to access a home network resource from outside.

[0023]

According to the present invention, first, by obtaining user information from an Internet service provider, it is possible to appropriately set a filter based on the user information. Further, the present invention solves the problem of access restriction to home network resources by improving and combining the filter setting with the mobile IP technology currently being standardized.

That is, the firewall dynamic control method according to the present invention is characterized in that the terminal connected to the Internet service provider by dial-up accesses the internal network inside the firewall via the Internet from the Internet service provider. Sending the terminal user information to
The internal network determines whether or not the terminal is a mobile terminal that has moved from the internal network based on the user information, and when the terminal is a mobile terminal, permits communication between the terminal and the internal network. It is characterized by setting a firewall filter.

Further, the firewall dynamic control method according to the present invention is characterized in that, after setting the filter, communication between the terminal and the internal network is performed by an IP tunnel,
Alternatively, transmission of the user information of the terminal is further performed between an agent host provided in an Internet service provider and a firewall management host which sets a firewall filter provided in an internal network. It is performed between a terminal and a home agent provided in an internal network.

[0026]

DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS An embodiment of the present invention will be described below with reference to FIGS. FIG. 1 is a diagram showing an example of a system configuration to which a firewall dynamic control method according to the present invention is applied, and FIG. 2 is a mobile IP corresponding to a firewall.
FIG.

In FIG. 1, reference numeral 10 denotes the Internet, 2
0 indicates a plurality of home networks 20A, 20B, 20C
, A mobile terminal normally connected to the internal network 20, 22 a firewall, 23 a host for firewall management, 24
Denotes a home agent provided in each of the home networks 20A, 20B, 20C, 30 denotes an ISP (Internet service provider), 31 denotes a provider authentication server of the ISP 30, and 32 denotes an agent host of the ISP 30.

It is assumed that the mobile terminal 21 has a foreign agent function for mobile IP, dials up with the ISP 30 at the destination, and tries to connect to the internal network 20 via the Internet 10.

In the present embodiment, the ISP
A mechanism for controlling the firewall based on the user information obtained from 30 and a mobile IP mechanism corresponding to the firewall 22 are provided.

(Dynamic Control Mechanism of Firewall) First, a configuration of a dynamic control mechanism of a firewall that controls the firewall 22 based on user information obtained from the ISP 30 will be described with reference to FIG.

When the user of the mobile terminal 21 makes a dial-up connection to the ISP 30, a user account (ID)
And password. In the ISP 30, the provider authentication server 31 determines whether or not the user input data is appropriate. Only when the data is appropriate, the ISP 30 assigns an IP address to the mobile terminal 21 and connects to the Internet 100. Therefore, the ISP 30 can always grasp the user information as to which user is currently connected by dial-up and which IP address has been assigned to the mobile terminal 21 based on the user account and the password. I have.

Therefore, if the internal network 20 obtains this user information from the ISP 30 and knows which user is currently using which IP address, it is possible to appropriately perform the above-described filter setting. As a result, only communication from a user who is allowed to access the internal network 20 in advance can be permitted, and access from a user who does not have access to the inside can be excluded.

Therefore, as shown in FIG. 1, by providing a firewall management host 23 in the internal network 20, a mechanism for adding / deleting a filter is prepared. Further, an agent host 32 is provided on the ISP 30 side, and only communication between the agent host 32 and the firewall management host 23 is permitted. In this communication, both the firewall management host 23 and the agent host 32 can use fixed IP addresses, so that there is no obstacle to the firewall filter setting. Specifically, the following procedures (1) to (7) are employed. The following procedure (n) corresponds to the same symbol (n) in FIG.

(1) The mobile terminal 21 which accesses the inside from the outside issues a connection establishment request with the internal network 20 via the agent host 32 of the ISP 30. (2) The agent host 32 transmits the IP address of the mobile terminal 21
Look up the address and account at dial-up connection. (3) The agent host 32 relays the message from the mobile terminal 21 to the firewall management host 23 only when the mobile terminal 21 is connected with a specific account permitted to access the inside of the firewall 22. (4) In mobile IP, end-to-end authentication is performed between the mobile terminal and the home agent. Therefore, end-to-end authentication is performed between the mobile terminal 21 and the home agent 24 through the firewall management host 23. Perform two-end authentication. (5) If the authentication is successful, the home agent 24 sends a message to that effect to the firewall management host 23. (6) As a result, the firewall management host 23 changes the filter setting of the firewall 22 so that the communication between the mobile terminal 21 and the home agent 24 is passed. (7) When the communication between the mobile terminal 21 and the home agent 24 is enabled by changing the settings of the firewall 22, the firewall management host 23 notifies the home agent 24 of the fact and via the agent host 32 The mobile terminal 21 is also notified. Upon receiving this notification, the home agent 24 sets an IP tunnel to the mobile terminal 21, and the mobile terminal 21 sets an IP tunnel to the home agent 24.
A bidirectional IP tunnel 40 is set.

The mobile terminal 21 communicates with each terminal of the internal network 20 using the IP tunnel 40.
However, it is assumed that the mobile terminal 21 periodically sends a message for continuation of the connection to the firewall management host 23, and the firewall management host 23 automatically deletes the filter setting for the host whose continuation request has been interrupted. It is assumed.

As described above, it is possible to set the firewall 22 that permits only the communication whose start point and end point are clearly limited only during a necessary period. Further, the setting of the bidirectional IP tunnel 40 is possible.

As described above, the mobile IP specifications currently being standardized do not correspond to the network 20 having the firewall 22. Therefore, to make the mobile IP compatible with the firewall 22,
It is improved as described below and used in combination with the above-described filter setting method.

(Mobile IP for Firewall)
With reference to FIG. 2, a method of combining mobile IP and firewall dynamic control will be described.

A packet transmitted from the mobile terminal 21 to the terminal 25 inside the firewall 22 is transmitted through a route 52 shown in FIG.
Embedded in the packet addressed to the home agent 24 and transmitted. Home agent 24 extracts the original packet from the received packet. Then, the home agent 24 delivers the original packet to the network 20 again, as shown by a route 53 in FIG. 2, to deliver the packet to the internal terminal 25 which is the original destination. Reference numeral 26 in FIG. 2 indicates a router. When the mobile terminal 21 is in the network 20, the mobile terminal 21 communicates with the terminal 25 via the route 51.

As described above, by performing bidirectional encapsulation (tunneling) between the mobile terminal 21 and the home agent 24, even when access is individually restricted in the network 20, the mobile terminal 21 Since the access can be permitted based on the IP address when the mobile terminal 21 is normally connected to the mobile terminal 20, communication between the mobile terminal 21 and the terminal 25 inside the firewall 22 is possible.

[0041]

According to the present invention, it is possible to set a firewall that allows only communication from a specific user during a dial-up connection in cooperation with an ISP.

Further, according to the present invention, by improving and combining the mobile IP, even from the outside, it is possible to access the commonly used internal network resources with exactly the same authority as when connecting to the internal network. It is possible.

[Brief description of the drawings]

FIG. 1 is a diagram showing an example of a system configuration to which a firewall dynamic control method according to the present invention is applied.

FIG. 2 is an explanatory diagram of a mobile IP corresponding to a firewall.

FIG. 3 is an explanatory diagram of a conventional mobile IP that does not support a firewall.

[Explanation of symbols]

 DESCRIPTION OF SYMBOLS 10 Internet 20 Internal network 20A, 20B, 20C Home network 21 Mobile terminal with foreign agent function 22 Firewall 23 Firewall management host 24 Home agent 25 Internal terminal 26 Router 30 ISP (Internet service provider) 31 Provider authentication server 32 Agent host 40 Two-way IP tunnel 51 Communication route before moving 52, 53 Communication route after moving

Claims (3)

[Claims] When a terminal connected to an Internet service provider by dial-up accesses an internal network inside a firewall via the Internet, sending user information of the terminal from the Internet service provider to the internal network; The internal network determines whether or not the terminal is a mobile terminal that has moved from the internal network based on the user information, and when the terminal is a mobile terminal, permits communication between the terminal and the internal network. A firewall dynamic control method, wherein a firewall filter is set in the firewall. 2. The dynamic firewall control method according to claim 1, wherein, after setting the filter, communication between the terminal and an internal network is performed by an IP tunnel. 3. Transmission of user information of the terminal between an agent host provided in an Internet service provider and a firewall management host provided in an internal network for setting a filter of a firewall, and communication by the IP tunnel. 3. The dynamic firewall control method according to claim 2, wherein the method is performed between the terminal and a home agent provided in an internal network.