Communication system and method for executing application program that specifies no communication parameter

In a TCP/UDP communication system, a communication process begins with a receipt of a communication request from an application program that does not specify a predetermined communication parameter such as source port number. A port number is dynamically assigned to the communication request. The communication process is then suspended and communication control data associated with the application program is supplemented with the assigned source port number to generate supplemented communication control data. The communication process is then resumed to establish communication over a communications network, and the established communication is controlled according to the supplemented communication control data.

BACKGROUND OF THE INVENTION

1. Field of the Invention

The present invention relates generally to communication systems and more specifically to a communication system and method for executing an application program that does not specify a predetermined communication parameter such as source port number.

2. Description of the Related Art

An application execution environment is composed of a CPU, an Operating System (OS) and middleware to execute an application program, such as client's software, server's software and peer-to-peer software. In a prior art application execution environment that executes an application program for internet communication, it is necessary to map a source port number to TCP/IP or UDP/IP communication control data that is uniquely associated with the application program before communication control (bandwidth allocation, data transfer and communication shutoff) is performed. Some application programs explicitly specify the source port number to the application execution environment before a TCP/IP or UDP/IP communication is established. If such an application program is executed in combination with one or more other application programs, an undesirable situation can occur as a result of a single source port number being coincidentally used by more than one application program. To avoid this it is recommended that application programs be written not to specify a source port number. As a result, if communication control such as “firewall” is performed using an application program that does not specify a source port number, the source port number must be dynamically assigned, as described in Japanese Patent Publication 2004-78507. However, the TCP/UDP communication control data cannot be maintained in the application execution environment for all application programs since the communication environment for all application programs since the communication control data is uniquely associated with each application program and since the source port number is not determined beforehand. One solution would be to write an application program that specifies a source port number at the instant it issues a communication request. However, writing such an application is a difficult task.

SUMMARY OF THE INVENTION

In order to eliminate the need to modify application programs, the present invention has the object of providing a communication system and method capable of presetting communication control data into an application execution environment even if the latter has the ability to dynamically assign a source port number (i.e., a predetermined communication parameter) prior to the establishment of communication such as connection setup procedure according to the TCP/IP protocol or transmission of a packet according to the UDP/IP protocol.

According to the general aspect of the present invention, there is provided a communication system comprising communication setup means that initiates a communication process according to a communication protocol in response to a communication request from the application program and suspends the communication process, the application program not specifying a predetermined communication parameter, assignment means that dynamically assigns a communication parameter as the predetermined communication parameter to the communication request, supplement means that supplements communication control data associated with the application program with the assigned communication parameter to generate supplemented communication control data during the time the communication process is suspended, and communication control means arranged to be set with the supplemented communication control data from the supplement means. The communication setup means resumes the communication process when the communication control means is set with the control data to establish communication over a communications network, and the communication control means performs control on the established communication according to the supplemented communication control data.

According to a first aspect, the present invention provides a communication system comprising communication setup means that initiates a communication process according to a communication protocol in response to a communication request from the application program which does not specify a predetermined communication parameter, assignment means that dynamically assigns a communication parameter as the predetermined communication parameter to the communication request, hook means that causes the communication setup means to suspend the communication process in response to the communication parameter being assigned to the communication request, supplement means that supplements communication control data associated with the application program with the assigned communication parameter to generate supplemented communication control data when the communication process is being suspended, and communication control means arranged to be set with the supplemented communication control data from the supplement means. The hook means causes the communication setup means to resume the communication process when the communication control means is set with the control data to establish communication over a communications network, and the communication control means performs control on the established communication according to the supplemented communication control data.

According to a second aspect, the present invention provides communication system comprising at least one computer system and a server connected to the at least one computer system. The at least one computer system comprises communication setup means that initiates a communication process according to a communication protocol in response to a communication request from the application program and suspends the communication process, the application program no specifying a predetermined communication parameter, and assignment means that dynamically assigns a communication parameter as the predetermined communication parameter to the communication request. The server comprises supplement means that receives the assigned communication parameter from the at least one computer system and supplements communication control data corresponding to the application program with the received communication parameter, and communication control means arranged to be set with the supplemented communication control data from the supplement means. The communication setup means of the at least one computer system resumes the communication process when the communication control means is set with the control data to establish communication over a communications network, and the communication control means of the server performs control on the established communication according to the supplemented communication control data.

According to a third aspect, the present invention provides a communication system comprising at least one computer system and a server connected to the at least one computer system. The at least one computer system comprises communication setup means that initiates a communication process according to a communication protocol in response to a communication request from the application program and suspends the communication process, the application program not specifying a predetermined communication parameter, assignment means that dynamically assigns a communication parameter as the predetermined communication parameter to the communication request, and identity decision means that determines the hardware identity of the first computer system and the application identity of the application program of the first computer system. The server comprises a memory that stores at least one communication control data, search means that uses the hardware and application identities determined by the at least one computer system as search keys to make a search through the memory for detecting corresponding communication control data, supplement means that receives the hardware and application identities and the assigned communication parameter from the at least one computer system and supplements the detected communication control data with the received communication parameter if the hardware and application identities received with the communication parameter are matched to the hardware and application identities that correspond to the detected communication control data, and communication control means arranged to be set with the supplemented communication control data from the supplement means. The communication setup means of the at least one computer system that is identified by the matched hardware identity resumes the communication process when the communication control means is set with the control data to establish communication over a communications network, and the communication control means of the server performs control on the established communication according to the supplemented communication control data.

According to a fourth aspect, the present invention provides a method of communication, comprising the steps of initiating a communication process according to a communication protocol in response to a communication request from an application program that does not specify a predetermined communication parameter, dynamically assigning a communication parameter as the predetermined communication parameter to the communication request, suspending the communication process, supplementing communication control data associated with the application program with the assigned communication parameter to generate supplemented communication control data, resuming the communication process to establish communication over a communications network, and controlling the established communication according to the supplemented communication control data.

According to a fifth aspect, the present invention provides a method of communication for at least one computer system and a server connected to the at least one computer system, the method comprising the steps of initiating a communication process in the at least one computer system according to a communication protocol in response to a communication request from the application program which does not specify a predetermined communication parameter, suspending, in the at least one computer system, the communication process, dynamically assigning, in the at least one computer system, a communication parameter as the predetermined communication parameter to the communication request, determining, in the at least one computer system, the hardware identity of the at least one computer system and the application identity of the application program of the at least one computer system, making a search, in the server, through at least one communication control data by using the hardware and application identities determined by at least one computer system as search keys for detecting corresponding control data, receiving, at the server, the hardware and application identities and the communication parameter from the at least one computer system and supplementing the detected communication control data with the received communication parameter if the hardware and application identities received with the communication parameter are identical to the hardware and application identities that correspond to the detected control data, resuming, in the at least one computer system, the communication process to establish communication over a communications network, and controlling, in the server, the established communication according to the supplemented communication control data.

According to a sixth aspect, the present invention provides a method of communication for at least one computer system and a server connected to the at least one computer system, the method comprising the steps of initiating (a) a communication process in the at least one computer system according to a communication protocol in response to a communication request from the application program which does not specify a predetermined communication parameter, (b) suspending, in the at least one computer system, the communication process, (c) dynamically assigning, in the at least one computer system, a communication parameter as the predetermined communication parameter to the communication request, (d) determining in the at least one computer system, the hardware identity of the at least one computer system and the application identity of the application program of the at least one computer system, (e) receiving, at the server, the hardware and application identities determined by step (d) from any of the computer systems and making a search through a plurality of communication control data for detecting communication control data that corresponds to the received hardware and application identities, (f) receiving, at the server, the communication parameter assigned by step (c) and the hardware and application identities determined by step (d) from the at least one computer system and supplementing the communication control data detected by step (e) with the communication parameter if the hardware and application identities received with the communication parameter are matched to the hardware and application identities that correspond to the detected control data, (g) resuming, in the at least one computer system that is identified by the matched hardware identity, the communication process to establish communication over a communications network, and (h) controlling, in the server, the established communication according to the supplemented communication control data.

DETAILED DESCRIPTION

Referring now toFIG. 1, there is shown a communication system of the present invention, which comprises a computer system108encased in a single housing. The computer system includes at least one communication means102connected through wireless or wireline channels100to a communications network NW or an IP network. A computer104is connected to the communication means102to operate on an Operating System and to a storage device106in which data and/or software programs are stored.

FIG. 2is an illustration of functional blocks of a first embodiment of the present invention represented by a system of interconnected functional blocks that executes the Operating System, the middleware and an application program, using the hardware ofFIG. 1. The system is represented by an application execution environment220indicated by a dotted rectangle, and includes a TCP/UDP communication setup means202, a source port number (or communication parameter) assignment means204and a TCP/UDP communication control means206that is connected between the communication setup means202and the communications network NW. TCP/UDP communication setup means202is connected to an application program200that contains programmed instructions for data communication. In response to a user's communication request from the application program, requesting the establishment of a TCP/IP or UDP/IP communication with a remote terminal via the network NW, the communication setup means202initiates a communication process according to the TCP/IP or UDP/IP protocol. Application program200co-operates with the communication setup means202to establish communication to the network via the TCP/UDP communication control means206.

Further included in the environment220is an extended application execution environment222. The environment222is an extended part of the environment220and operates during the time the communication setup means202is “hooked” in a manner described below in order to intervene its communication process.

As a part of its communication process, the communication setup means202calls the source port number assignment means204to dynamically assign a source port number to the communication request from the application program200. The dynamically assigned port number (PN) is supplied to the extended application environment222. Note that in the present invention the application program200never specifies a source port number.

TCP/UDP communication control means206receives communication control data from the extended application execution environment222to perform a number of control functions, which include bandwidth assignment, transfer of packets and shutoff of communication, for example.

Extended application execution environment222is comprised of an identity decision means208that determines the identity of the file name of application program200and a hook means210that receives the assigned source port number from the assignment means204and stores the received port number in memory for later use.

Hook means210is installed as a software module, or “CALL function” on the extended application execution environment222. The operation of this CALL function starts with the process of communication setup means202and proceeds through the assignment means204to the hook means210. In response to the assignment of the source port number, the hook means210is called and the CALL function suspends the communication process that has been initiated by the communication setup means202in response to receipt of the communication request from the application program200. At the same time, the hook means210supplies a search request to the identity decision means208, receives the assigned port number and hands it to a supplement means216. As a result, the CALL function of the hook means210proceeds to the supplement means216.

In response to the search request from the hook means210, the identity decision means208determines the identity of application program200by using its file name and supplies the application identity (AID) of the program200to a search means212. Using the AID as a search key, the search means212makes a search through a memory or lookup table214in which a number of application identities (AIDS) are mapped to a number of communication control data in a one-to-one or one-to-many correspondence for detecting control data that corresponds to the AID of application program200currently being used.

Supplement means216receives the communication control data associated with the application program200from the search means212. Since this control data has no information on the source port number, the supplement means216supplements the control data with the source port number received from the hook means210to produce supplemented communication control data. The CALL function of the hook means210proceeds to a control data setting means218.

Control data setting means218receives the supplemented communication control data from the supplement means216and sets the received data into the TCP/UDP communication control means206. When this occurs, the CALL function of hook means210returns from the process of data setting means218through the processes of supplement means216back to the hook means210and thence to the assignment means204to the communication setup means202in order to resume its communication process. Thus, packets are formulated and forwarded according to the TCP/IP or UDP/IP protocol to the network through the communication control means206.

FIG. 3is an illustration of a software implementation of the communication system of the present invention represented by a flowchart whose routine is broadly divided into a first subroutine executed by the application execution environment220and a second subroutine executed by the extended application execution environment222.

In the first subroutine, a communication process is initiated by the communication setup means202. The communication process begins with decision step300to determine whether a user's TCP/UDP communication request is issued from the application program200, which specifies no source port number as described above. If a communication request is issued from the application program200, flow proceeds to step302to dynamically assign a source port number, as a part of the communication process, to the communication request, and flow exits the first subroutine and enters the second subroutine.

The second subroutine begins with step304to suspend the execution of the communication process initiated by the communication setup means202in the first subroutine. At step306, the identity AID of application program200is determined, and the determined AID is used as a search key to search through the lookup table214for detecting the communication control data corresponding to the application program200(step308). At step310, the communication control data associated with the program200is supplemented with the source port number assigned at step302, and the supplemented control data is set into the communication control means206(step312). At step313, the execution of the communication process by the communication setup means202is resumed, with flow leaving the second subroutine to return to the first subroutine.

In the first subroutine, the communication setup means202is activated, at step314, to resume its communication process in which packets are formulated and forwarded onto the network through the communication control means206according to the TCP/IP or UDP/IP protocol. At step316, the communication control means206performs control on the forwarded packets according to the control data already set in step312.

As described above with reference toFIGS. 2 and 3, the operation of extended application execution environment222begins with the assignment of a source port number to a user's communication request by the assignment means204and ends with the setting of communication control data into the communication control means206. Since the control data set in the control means206is supplemented with the source port number dynamically assigned by the assignment means204, the present invention allows communication control data to be written in advance of the receipt of a communication request from an application program of the type which does not explicitly specifies a source port number. As a result, the only function needs to be performed by the application program200is to request the communication setup means202to establish a TCP or UDP communication.

FIG. 4is an illustration of a system of interconnected functional blocks that executes the Operating System, the middleware and an application program using the hardware ofFIG. 1according to a second embodiment of the present invention. The system is represented by an application execution environment424, and includes a TCP/UDP communication setup means402, a source port number assignment means404and a TCP/UDP communication control means406that is connected between the communication setup means402and the communications network NW. TCP/UDP communication setup means402is connected to an application program400that specifies no source port number. Communication setup means402initiates a communication process according to the TCP/IP or UDP/IP protocol in response to a user's communication request from the application program, in the same manner as that performed in the first embodiment. Thus, the application program400co-operates with the TCP/UDP communication means402to set up a communication to the network via the TCP/UDP communication control means406.

Similar to the previous embodiment, the application execution environment424includes an extended application execution environment426, which operates during the time the communication means402is hooked in a manner described below.

Extended application execution environment426is comprised of an identity decision means408that determines the identity of application program400and a communication call hook means410that receives a communication request from the application program400.

Similar to the previous embodiment, the communication call hook means410is installed as a “CALL function” software module on the extended application execution environment426. The operation of this CALL function starts with the process of communication setup means402and proceeds to the hook means410.

In response to receipt of the communication request, the CALL function of the hook means410suspends the execution of a communication process, which would otherwise be initiated in the communication setup means402in response to receipt of the communication request from the application program400. Simultaneously, the hook means410supplies a search request to the identity decision means408and the CALL function of hook means410proceeds to a source port number assignment call means418that calls the port number assignment means404.

Meanwhile, the identity decision means408responds to the search request from the hook means410to determine the AID of application program400and supplies the determined AID to a search means412. Using the AID as a search key, the search means412searches through a lookup table414for detecting communication control data that corresponds to the AID of application program400and supplies the detected control data to a supplement means416.

Meanwhile, the PN assignment call means418calls the PN assignment means404to dynamically assign a source port number to the communication request and supplies the assigned port number to a port number receive means420, which receives and supplies the assigned source port number to the supplement means416. Supplement means416supplements the control data received from the search means412with the source port number to produce supplemented communication control data. The supplemented communication control data is supplied to a control data setting means422, which sets the supplemented control data into the communication control means406. By the time the supplemented control data is set into the communication control means406by the data setting means422, the CALL function of the hook means410has proceeded through the means418,404,420,416and422, and now returns to the communication setup means402to resume its communication process.

FIG. 5is an illustration of a software implementation of the second embodiment represented by a flowchart whose routine is broadly divided into a first subroutine executed by the extended application execution environment426and a second subroutine executed by the application execution environment424.

The first subroutine begins with decision step500, which determines if a communication request is issued from the application program400. If so, flow proceeds to step502to suspend the execution of a communication process, which would otherwise be initiated by the communication setup means402in response to the communication request. At step502, a source port number is dynamically assigned to the communication request, and flow proceeds to step506to determine the identity of application program400. At step508, the determined AID is used as a search key to search through the lookup table414for detecting the communication control data corresponding to the application program400. At step510, the communication control data associated with the program400is supplemented with the source port number assigned at step504, and the supplemented control data is set into the communication control means406(step512). At step514, the execution of the communication process by the communication setup means402is resumed, with flow leaving the first subroutine to enter the second subroutine.

In the second subroutine, the communication setup means402is activated, at step516, to initiate its communication process by formulating and forwarding packets onto the network through the communication control means406according to the TCP/IP or UDP/IP protocol. At step518, the communication control means406performs control on the forwarded packets according to the control data already set in step512.

A communication system according to a third embodiment of the present invention is shown inFIGS. 6 to 8. InFIG. 6, the communication system comprises a plurality of computer systems600-1through600-N of similar configuration and a separate computer system, or server608connected to the computer systems600-1˜600-N. Server608is connected to the communications network NW. Each computer system600includes a communication means602, a computer603and a storage device604. Server608comprises communication means610and612, a computer614and a storage device616. Communication means610is connected to the communication means602of all computer systems600-1˜600-N and the communication means612is connected to the communications network NW. Both communication means610and612are connected to the computer614.

FIG. 7illustrates a hardware implementation of the third embodiment in which an application execution environment722is installed on the hardware of each computer system600and an application execution environment724is installed on the hardware of server608. Since the computer systems600are substantially identical, discussion of only one application execution environment722that runs on one of the computer systems600as a representative will suffice, it being understood that the discussion applies to the application execution environments that run on the other computer systems600.

Although application execution environments of the other computer systems are connected to the application execution environment724it may be sufficient to show only one application execution environment722.

Application execution environment722includes a TCP/UDP communication setup means702, a source port number assignment means704, and an extended application execution environment726, which operates during the time the communication setup means702is hooked in a manner described below. TCP/UDP communication setup means702is connected to an application program700that contains programmed instructions for data communication. In response to a user's communication request from the application program, requesting the establishment of a TCP/IP or UDP/IP communication with a remote terminal via the network NW, the communication setup means702initiates a communication process according to the TCP/IP or UDP/IP protocol and instructs the port number assignment means704to dynamically assign a source port number to the communication request.

Extended application execution environment726is comprised of an identity decision means707that determines the identity of the hardware on which the application program700is installed by analyzing the serial number of the housing in which the computer system is encased, and the identity of application program700. The identity of the hardware can be alternatively determined by writing such serial number into the application program700and reading it when the identity of the application program is determined.

A hook means710is provided to receive the assigned source port number from the assignment means704, the received port number being stored in memory for later use.

In a manner similar to the previous embodiments, the hook means710is a “CALL function” software module installed on the extended application execution environment726. The operation of the CALL function proceeds from the communication setup means702through the PN assignment means704to the hook means710.

On the other hand, the application execution environment727includes a TCP/UDP communication control means706connected to the TCP/UDP communication setup means702of each computer system, a search means712, a memory or lookup table714, a supplement means716and control data setting means717. The CALL function of hook means710will proceed through the hook means710and supplement means716to the control data setting means717and return to the communication setup means702.

Search means712is connected to the identity decision means707of each computer system600to receive its hardware identity (HID) and the application identity (AID). Lookup table712stores a plurality of communication control data mapped to corresponding hardware identities and corresponding application identities. Supplement means716is connected to the output of search means712and to the hook means710of each computer system600.

In response to receipt of the port number, the hook means710instructs the communication setup means702to suspend its communication process. At the same time, the hook means710supplies a search request to the identity decision means707.

In response to the search request from the hook means710, the identity decision means707determines the HID and AID as mentioned above and supplies them to the hook means710and the search means712. Using the HID and the AID as search keys, the search means712makes a search through a memory or lookup table714for detecting corresponding communication control data.

From the search means712the supplement means716receives the communication control data associated with the application program700and the hardware on which the environment722is running, and the HID and the AID. In addition, the supplement means716receives the assigned port number, the HID and the AID from the hook means710. Supplement means716compares the HID and AID received from the search means712with the HID and AID received from the hook means710. If they match, the supplement means716verifies that they are originated from a single communication request. If a racing condition occurs among communication requests issued simultaneously from the computer systems600, a mismatch can occur. The above comparison can avoid mishandling of the simultaneously generated communication requests.

Since this communication control data gives no information as to source port number, the supplement means716supplements it with the source port number received from the hook means710to produce supplemented communication control data.

A control data setting means717receives the supplemented communication control data from the supplement means716and sets the received data into the TCP/UDP communication control means706. At the same time, the control data setting means717communicates to the hook means710the fact that the PN-supplemented control data is set into the control means706. In response the hook means710instructs the communication setup means702to resume the communication process by starting to formulate and forward packets according to the TCP/IP or UDP/IP protocol to the network through the communication control means706.

FIG. 8is an illustration of a software implementation of the communication system of the third embodiment. The routine begins with decision step800that determines if a communication request is received from the application program700. If a communication request is received, the communication setup means702initiates a communication process, and flow proceeds to step802to dynamically assign a source port number, as a part of the communication process, to the received communication request. At step804, the execution of the communication process is suspended. At step806, the HID and AID are determined by the identity decision means707of any computer system600.

At step807, the search means712of the server608receives HID and PID from the identity decision means707of any computer system600and uses them as search keys to search through the lookup table714for detecting corresponding communication control data. At decision step808, the supplement means716receives assigned port number (PN), HID and AID from the hook means710of any computer system600and compares the HID and AID received with the assigned port number with the HID and AID used in step807for a match or mismatch. If they do not match, flow proceeds to the end of the routine.

If the HID and AID received with the assigned port number are identical to the HID and AID of step807, flow proceeds to step810to supplement the communication control data detected by step807with the source port number received with the matched HID and AID.

At step812, the supplemented communication control data is set into the communication control means706, and the execution of the communication process of the computer system600identified by the matched HID is resumed (step813).

At step814, the communication setup means702resumes its communication process by formulating and forwarding packets according to the TCP/IP or UDP/IP protocol through the communication control means706to the network NW. At step816, the communication control means706performs control on the forwarded packets according to the control data already set in step812.

The third embodiment shown inFIGS. 6 to 8is advantageous in that, in comparison with the previous embodiments, the amount of processing load for executing the application program700and the amount of processing load for performing the function of the communication control means706are distributed among different computer systems. As a result, the individual processing burdens of the computers603and614can be reduced.

A further advantage of the third embodiment is that a single lookup table714can be shared among the computer systems600-1˜600-N, instead of installing separate lookup tables on the computer systems600-1˜600-N.

A fourth embodiment of the present invention is shown inFIGS. 9 and 10. InFIG. 9, the communication system comprises a communication terminal900including a wireline Ethernet interface902that interfaces the terminal900to a wireline Ethernet network ENW, a computer904and a hard disk drive906as an external storage device of the computer904.

InFIG. 10, a Web browser1000operates an application program. As a part of its functions, the Web browser1000invokes a network-related system call1006(which is a mechanism used by an application program to request service from the Operating System) in order to establish communication through a packet filter1030with a remote Web server1004via an IP network1002over wireline Ethernet. If a UNIX Operating System is used, the system call1006includes a socket system call1008(formulate-a-socket request for connection to Web server1004), a bind system call1010, a connect system call1012(connection request to Web server1004), and receive system call (data acquisition request from Web server1004).

In a typical example, the Web browser100successively invokes the socket system call1008, the connect system call1012and the receive system call1014in the order named. The bind system call1010, whose normal function includes the ability to explicitly specify a source port number, is not invoked since the Web browser1000usually operates without specifying a source port number.

When the Web browser1000invokes the connect system call1012, a network connection request process (i.e., the communication process) by the connect system call1012is performed to establish a connection to the network via the packet filter1030and a SPN (source port number) assignment OS internal function1016is called for assigning a source port number (#48932, for example) within the connect system call1012(depending on different Operating Systems, the OS internal function1016is not installed as an independent function but installed as a part of the process of other function). As a result, the communication process that begins with the operations of the network-related system call1006and a part of the packet filter1030, as a communication setup means, are suspended.

The OS internal function1016for source port number assignment is modified to implement the present invention. More specifically, the OS internal function1016is modified such that a hook function1018is called at the instant immediately after all functions of the internal processes of SPN assignment OS internal function1016are performed.

Hook function1018hands the source port number assigned by the OS internal function1016to a control data supplement process1020for supplementing packet filter control data with the assigned port number supplied from the hook function1018through a process-to-process communication provided by a UNIX domain socket. Hook function1018obtains the process ID of the calling Web browser1000and hands it to a ps-command call process1022, using a process-to-process communication of UNIX domain socket. (Note that in the UNIX Operating Systems, process IDs are used to identify running processes and such IDs can be easily obtained in the network-related system call1006). In response to the process ID from the hook function1018, the ps-command call process1022identifies the file name of the corresponding process and uses a process-to-process communication of the UNIX domain socket to hand it to a database search process1024that makes a search for packet filter control data.

Using the identified file name as a search key, the database search process1024makes a search through a packet filter control database1026and acquires Web browser control data1028. Web browser control data1028includes a source port #X (unknown), a destination port #80, and control data specifying “send to virus detection process”. Database search process1024uses a process-to-process communication to supply the acquired control data1028to control data supplement process1020to supplement the Web browser control data1028with the source port number assigned by the OS internal function1016to produce supplemented Web browser control data1032, which is supplied to a packet filter control data setting process1034via a UNIX-domain socket's process-to-process communication. Web browser control data1032includes the assigned source port #48932, a destination port #80, and “send to virus detection process” control data, which is now complete for the packet filter1030to function properly.

Packet filter control data setting process1034now performs the setting of the complete Web browser control data into the packet filter1030by rewriting its setup file and rebooting it.

The intervening operation that started in response to the assignment of a source port number by the hook function1018now ends with the setting of the complete control data into the packet filter1030. Since the network connection request process by the connect system call1012is complete, the communication process is resumed by the receive system call1014that performs a data acquisition process for receiving data from the Web server1004. When a packet is received from the Web server1004, the packet filter1030transfers the received data to virus detection process1036according to the supplemented control data. When the received data is checked for virus and verified, the packet filter1030sends the verified data to the Web browser1000.

It is seen from the foregoing description that the TCP/IP communication can be controlled by the packet filter1030without modifying the Web browser1000and without writing a source port number into the Web browser control data1028.

Additionally, the present invention can be used for enhancing the security of personal computers as well as mobile telephones whose software has an extendable capability. Furthermore, the present invention can also be used in applications for making a database search for synonyms and in programs for implementing an information search system in a computer.

While mention has been made of a source port number, other communication parameter such as network address could equally be as well used for application programs that do not specify such a communication parameter.