Firewall system and firewall control method
It is made possible to appropriately execute packet filtering and unauthorized access detection in a situation in which mobile network communications are operated. A home agent 404 A acquires IP address, port number, and media type obtained by call control of a call control proxy server 403 A and sends them to a firewall 700 . A packet filtering unit 400 of the firewall 700 performs packet filtering so as to allow the IP packet determined according to the IP address and port number pair to pass through. An unauthorized access monitor 701 takes out information of the corresponding media type out of the normal access determination condition previously defined for each media type, monitors a packet based on the normal access determination condition, and detects that access deviating from normal access is unauthorized access.
1. A firewall system for controlling communications between an external network and an internal network, comprising:
a call control proxy section for relaying a call control sequence for establishing communications between terminals connected to the external network or the internal network;
an address correspondence information management section for managing the correspondence between new and old addresses of each terminal changed as the terminal moves or re-connects to the network;
a filtering control section for setting an address and port number pair as a filtering condition of a packet permitted to pass through between the internal network and the external network based on information of the address and the port number of the terminal used for communications obtained from the call control proxy section and information of the correspondence between new and old addresses obtained from the address correspondence information management section;
a packet filtering section for allowing a packet determined based on the filtering condition containing the address and port number pair to pass through;
a normal access determination condition storage section for storing a normal access determination condition defined for each communication media type; and
an unauthorized access detection section for detecting unauthorized access if a passing packet does not meet the normal access determination condition based on information obtained from the call control proxy section of the address, the port number, and the media type of the terminal used for communications, information of the correspondence between new and old addresses obtained from the address correspondence information management section, and the normal access determination condition obtained from the normal access determination condition storage section,
wherein said information obtained from the call control proxy section of the address, the port number, and the media type are determined by the call control proxy section during the call control sequence that establishes said communications between terminals.
2. The firewall system according to claim 1 ,
wherein the call control proxy section comprises a relay section information retention section for retaining information concerning a different trusted call control proxy section, and
wherein the filtering control section acquires information of an address and a port number in communications between terminals established via the different call control proxy section and sets a filtering condition based on the pair of the address and the port number.
3. The firewall system according to claim 1 , wherein the filtering control section sets a filtering condition based on the most recent address and port number pair if at least one of a terminal on the internal terminal and a terminal on the external terminal moves and address information obtained from the call control proxy section or the address correspondence information management section is changed.
4. The firewall system according to claim 1 , wherein, if at least one of a terminal on the internal terminal and a terminal on the external terminal moves and address information obtained from the call control proxy section or the address correspondence information management section is changed, the unauthorized access detection section determines the normal access determination condition based on the most recent address information.
5. A firewall control method for controlling communications between an external network and an internal network, the firewall control method comprising the steps of:
acquiring information of the address, the port number, and the media type of a terminal used for communications from a call control proxy section for relaying a call control sequence for establishing communications between terminals connected to the external network or the internal network, wherein said information is determined by the call control proxy section during the call control sequence that establishes said communications between terminals;
acquiring information of the correspondence between new and old addresses from an address correspondence information management section for managing the correspondence between new and old addresses of each terminal changed as the terminal moves or re-connects to the network;
setting an address and port number pair as a filtering condition of a packet permitted to pass through between the internal network and the external network based on the information of the address and the port number of the terminal used for communications and the information of the correspondence between new and old addresses; and
detecting unauthorized access if a passing packet does not meet the normal access determination condition based on the information of the address, the port number, and the media type of the terminal used for communications, the information of the correspondence between new and old addresses, and a normal access determination condition defined for each communication media type and stored in a normal access determination condition storage section.