JP5453941B2 - Communication control device - Google Patents

Description

  The present invention relates to a communication system for performing communication between a local network and an Internet service provider (ISP) network, and a communication control apparatus used in the communication system.

  In a conventional communication system using a public line of the Internet or a communication carrier, an access point (AP) of a local network and an Internet service provider (ISP) network are secured due to a layer 2 route acquisition for obtaining an IP address and security problems. In the meantime, a communication method for constructing a tunnel is used. This tunneling technology is used in technologies such as VPN (Virtual Private Network) and L2TP (Layer 2 Tunneling Protocol) that virtually connect bases, and is realized by encapsulation that inserts a new header into a packet. (For example, refer to Patent Document 1).

FIG. 7 shows an example of communication between the local network and the ISP network. The user terminal 5 in the local network 1 goes to the ISP network 3 using the public line 2 through the tunnel 6 established between the access point 4 in the network and the tunnel termination device 7 of the ISP network 3. Connecting. In the ISP network, a DHCP server 9 for assigning an IP address, a public line connection device 12, and the like are provided.

FIG. 8 shows a frame format of a packet transmitted in the tunnel. Here, PPP (Point-to-Point Protocol) communication using L2TP is taken as an example. The data 14 transmitted to the public line or the Internet is encapsulated using the L2TP header, the UDP header, and the tunnel IP header, and the in-tunnel data 13 is constructed. The tunnel IP header is an address between the AP of the local network and the tunnel terminating device of the ISP network. By using this technology, it looks like a dedicated line from the client or server, and it is possible to secure a communication path and realize secure communication.

Japanese Patent Laid-Open No. 11-146016

In the system as described above, there is a problem that communication closed to the local network that does not need to access the ISP network, such as access to a local server unique to the local network, is impossible from the access point 4. It was.

  The present invention relates to a communication control apparatus provided in a local network including an access point that performs communication using an Internet service provider network and tunneling for the Internet service provider network, and a destination address of a packet passing through the communication control apparatus If the destination address is the address of a local server provided in the local network, the tunneling for the Internet service provider network is terminated and the tunneling for local server access between the access point and the locus server is performed. If the destination address is other than the address of the local server, the tunnel for the Internet service provider network is used as it is. It is obtained so as to control so as to use.

According to the present invention, communication with a local server is possible even in communication using a tunneling technique.

FIG. 2 is a system configuration diagram illustrating a local server access function according to the first embodiment. 3 is a diagram illustrating a configuration example of a communication control device according to Embodiment 1. FIG. 4 is a flowchart illustrating an example of packet processing of the communication control device in the first embodiment. 6 is a diagram illustrating a configuration example of a communication control device according to Embodiment 2. FIG. 10 is a flowchart illustrating an example of DNS processing of the communication control device in the second embodiment. FIG. 11 is a diagram illustrating an example of a frame format of an external access control message in the second embodiment. It is a figure which shows the structure of the communication system using the existing tunneling technique. It is a figure which shows the example of the encapsulation frame format used for the existing tunneling technique.

Embodiment 1 FIG.
FIG. 1 is a system configuration diagram showing a local server access function of the present invention.

  In FIG. 1, in the local network 1, a communication control device 15 is disposed between the access point 4 and the tunnel termination device 7, a tunnel 17 is provided between the access point 4 and the communication control device 15, and the communication control device 15 and the tunnel are provided. A tunnel 19 is constructed between the terminal devices 7. The local server 16 is connected to the communication control device 15 and constructs a tunnel 18 between the communication control device 15 and the local server 16.

  Further, as shown in FIG. 2, the communication control device 15 includes a tunnel termination / construction function unit 22 and a packet monitoring function unit 23.

Next, the operation will be described.
First, a tunnel 17 and a tunnel 19 are constructed between the access point 4 and the tunnel termination device 7. Here, the tunnel 17 and the tunnel 19 are divided for convenience, but the two tunnels are the same. The user terminal 5 uses the tunnels 17 and 19 to perform connection establishment such as authentication processing with the ISP network and IP address acquisition.

The communication control device 15 monitors the destination address of the packet transmitted from the user terminal 5 in the packet monitoring function unit 23 and notifies the tunnel termination / construction function unit 22 of the destination address. If the destination address is other than the designated destination address, the packet is transmitted from tunnel 17 to tunnel 19. On the other hand, if it is a designated destination address, a replacement process to the local server tunnel 18 is performed. Here, the specified destination address is the address of the local server, and may be specified by a parameter of the communication control device, or may be set by remote operation using SNMP (Simple Network Management Protocol), The effect of the present invention is not limited by the method.

The same applies to packets received from the ISP network side. The packet monitoring function unit 23 monitors the packet destination address, notifies the tunnel termination / construction function unit 22 of the destination address, and the tunnel termination / construction function unit. If the destination address is other than the designated address, the packet is transmitted from the tunnel 19 to the tunnel 17, and if it is the designated address, the replacement process to the local server tunnel 18 is performed.
On the other hand, the packet received from the local server is reassigned to the tunnel 17 if it is destined for the user terminal, and is reassigned to the tunnel 19 if it is any other destination.

FIG. 3 is a flowchart showing the operation of the communication control apparatus. First, the communication control apparatus performs reception port determination 24 for the received packet. When a packet is received from the user terminal side port, destination address determination 25 is performed. If the destination address is other than the designated address, the packet is transmitted 26 from the tunnel 17 to the tunnel 19 and transmitted 27 to the ISP network side. If the destination address is a designated address, the ISP network tunnel 17 is terminated 28 and a local server tunnel 18 is constructed 29, and then transmitted 30 to the local server side. Here, the termination of the tunnel is a function for terminating the protocol used for the tunnel among the encapsulated packets. Also, the construction of a tunnel indicates a function for encapsulating a packet.

In the reception port determination 24, when a packet is received from the ISP network side port, a destination address determination 31 is performed. If the destination address is other than the designated address, the packet is transmitted 32 from the tunnel 19 to the tunnel 17 and transmitted 33 to the user terminal side. If the destination address is the designated address, the ISP network tunnel 19 is terminated 34, the local server tunnel 18 is constructed 35, and then transmitted 36 to the local server side.

Further, in the reception port determination 24, when a packet is received from the local server side port, a destination address determination 37 is performed. When the destination address is the address of the user terminal or a network address including the user terminal, the local server tunnel 18 is terminated 38 and the ISP network tunnel 17 is constructed 39, and then transmitted 40 to the user terminal side. On the other hand, if the destination address is an address on the ISP network side, the local server tunnel 18 is terminated 41, the ISP network tunnel 19 is constructed 42, and then transmitted to the ISP network side 43.

In the present embodiment, the processing of the communication control device is determined by the reception port, but may be determined by the transmission source address or the network address. It is also possible to determine the processing based on the identifier of the receiving tunnel. Further, in the discrimination processing based on the destination address, the same processing can be performed as long as the identifier can discriminate the transmission destination.

Furthermore, in the present embodiment, an example of a system configuration in which a communication control device is installed as a device independent of an access point as shown in FIG. 1 has been shown. However, by operating as an integrated device with an access point, It is possible to reduce the termination / construction process.

  As described above, by installing the communication control device in the local network and terminating / constructing the tunnel with the destination address, communication with the local server is possible even in communication using the tunneling technology. This makes it possible to distribute information having characteristics of facilities and places within the local network. Examples of the use include operation information within a train, regional information distribution along a route, facility information within a public facility, event information, and the like. In addition to the above effects, the communication is closed in the local network, so that communication with less delay can be realized and the effect of reducing the line load of the public network can be obtained. This effect is particularly effective for a mobile phone network or a WiMAX network in which a public line is wirelessly transmitted.

Embodiment 2. FIG.
In the first embodiment described above, local server communication is realized. Next, an embodiment for encouraging the use of a local network and controlling access to an external network will be described.

FIG. 4 shows a configuration diagram of the communication control apparatus in such a case.
In FIG. 4, in addition to the packet monitoring function unit 23 and the tunnel termination / construction function unit 22 that implement local server communication, the DNS agent function unit 20 that performs access control using DNS, and the access control status for each user terminal. It comprises an access control state management unit 21 to be managed.

Next, an access control operation by the communication control apparatus will be described.
In the present embodiment, access control is performed using a DNS message transmitted when accessing an external server from a user terminal. The DNS is an operation in which a user terminal makes a domain inquiry using a DNS request message to the DNS server, and the DNS server notifies an IP address corresponding to the inquired domain using a DNS response.

The packet monitoring function unit 23 monitors a packet received from the user terminal, and notifies the DNS agent function unit 20 if the packet is a DNS request message. The DNS agent function unit 20 inquires of the access control state management unit 21 about the access control state of the MS. If the access control state management unit 21 permits access to the external network, the DNS agent function unit 20 directly transmits a DNS request to the ISP network. On the other hand, if the access control state of the MS is an access restriction state to the external network, the IP address of the local server is notified using a DNS response.

FIG. 5 shows a flowchart of access control. When the DNS request is received 44 from the user terminal, the access control state determination 45 is performed. If it is in the external access restricted state, the local server IP address notification 46 and DNS response transmission 47 to the user terminal are performed for all DNS requests to restrict external access. On the other hand, if the access control state is the external access permission state, the DNS request is transmitted 48 to the DNS server as it is.

The local server determines the external access restriction or permission of the user terminal, and notifies the communication control device using an external access control message. The determination at the local server may be performed by authentication using a user ID and password, or other authentication algorithms. A method is also conceivable in which an access permission time is set by a timer or the like, the external access permission state is shifted to the external access restriction state at the time of timeout, and the communication control device is notified using an external access control message. The external access control message to the communication control device has a frame structure as shown in FIG. 6, for example, and is a message that can notify the user terminal identifier 49 and the external access permission / restriction 50.
The communication control apparatus that has received the external access control message manages the external access control state for each user terminal in the access control state management unit 21.

In the external access permission state, the DNS agent function unit 20 makes a proxy response to the local server IP address using a DNS response message in response to an inquiry using the DNS request to the local server.

In the present embodiment, the configuration example in which the user terminal is authenticated in the local server and notified to the communication control apparatus has been described. However, the communication control apparatus can be provided with an authentication function. In the above configuration, the external access control message is not necessary.

As described above, in this embodiment, the external access control function using the DNS message is used to control the external access permission / restriction state of the user terminal, thereby prompting the user terminal to use the local network and Traffic load can be reduced. Further, by authenticating the user terminal to the external network, the authorized user terminal is identified, and secure communication is possible.

  As described above, the present invention is applicable to communication between networks using a tunnel.

1 local network, 2 public line, 3 ISP network, 4 access point, 5 user terminal, 7 tunnel termination device, 15 communication control device, 16 local server, 17 tunnel, 18 tunnel, 19 tunnel, 20 DNS agent function unit, 22 Tunnel termination / construction function unit, 23 packet function monitoring unit, 49 user terminal identifier, 50 access permission / restriction.

Claims (3)

A packet monitoring function unit that monitors and notifies whether the destination address of the packet and the packet is a DNS request message;
A tunnel termination / construction function unit for terminating and constructing a tunnel for encapsulating and transmitting a packet based on a destination address of the packet notified from the packet monitoring function unit;
An access control state management unit for notifying the access control state of the user terminal based on an access control message indicating access permission or restriction to the external server of the user terminal notified from the local server in the local network;
A DNS agent function unit for determining whether to transmit a DNS request message notified from the packet monitoring function unit to the external server based on the access control state notified from the access control state management unit;
Equipped with a,
The tunnel termination / construction function unit constructs a tunnel for an Internet service provider network between an access point in the local network and a tunnel termination device in an Internet service provider network,
If the destination address of the packet notified from the packet monitoring function unit is the address of the local server, the Internet service provider network tunnel is terminated, and a local server access tunnel is established with the local server, Send notified packet,
If the destination address of the packet sent from the packet monitoring unit is other than the address of the local server, the communication control apparatus characterized that you send a packet to be notified by the Internet service provider network tunnel. The communication control apparatus according to claim 1, wherein the DNS agent function unit responds to the DNS request message with the address of the local server when the user terminal is in an external access restricted state. If the user terminal is in an external access permitted state, the DNS agent function unit responds to the DNS request message for inquiring the local server with the address of the local server, and sends other DNS request messages to the external server. The communication control device according to claim 1, wherein the communication control device transmits to the communication device.

Images