JP7619610B2 - Communication equipment and communication device - Google Patents

Description

Application of Article 30, Paragraph 2 of the Patent Act MS TODAY Volume 29, No. 4, Issue 258 (published October 1, 2020) Published by M-Systems Research Institute Co., Ltd., Published on pages 6 to 7

Article 30, paragraph 2 of the Patent Act applies Website https://www. m-system. co. jp/mstday/pdf/mst2020.pdf/mst2010.pdf (Published on September 24, 2020) Published by M-System Engineering Co., Ltd.

Article 30, paragraph 2 of the Patent Act applies. Website: https://www. m-system. co. jp/mstday/backnum/2020/10/product1/index. html (Published on September 24, 2020) Published by M-System Engineering Co., Ltd.

Article 30, paragraph 2 of the Patent Act applies. Website https://www. m-system. co. jp/P_release/PR_sg6/sg6_201007. html (published on October 7, 2020) M-System Engineering Co., Ltd.

Applicable to Article 30, Paragraph 2 of the Patent Act Security Gateway SG6 Catalog 2020-12 First Edition First Printing NC-8591 500662 (Published on December 18, 2020) Published by M-Systems Research Institute Co., Ltd. Announced on pages 1 to 4

Article 30, paragraph 2 of the Patent Law applies Website https://www. m-system. co. jp/pub/catalog_j/data_pdf/F/500662.pdf (Published on December 21, 2020) M-System Engineering Co., Ltd.

Article 30, paragraph 2 of the Patent Law applies Website https://www. m-system. co. jp/mssjapanese/PDF/NS/S/nssg6.pdf (Published on October 8, 2020) M-System Engineering Co., Ltd.

Article 30, paragraph 2 of the Patent Act applies Website https://www. m-system. co. jp/koho/searchproducts/DispDetail. aspx? id=31617 (published on October 8, 2020) M-System Engineering Co., Ltd.

Article 30, paragraph 2 of the Patent Law applies Website https://www. m-system. co. jp/mssjapanese/PDF/NM/S/nmsg6_a. pdf (Published on October 8, 2020) M-System Engineering Co., Ltd.

Article 30, paragraph 2 of the Patent Law applies Website https://www. m-system. co. jp/mssjapanese/PDF/NM/S/nmsg6_b. pdf (Published on October 8, 2020) M-System Engineering Co., Ltd.

Article 30, paragraph 2 of the Patent Law applies Website https://www. m-system. co. jp/mssjapanese/PDF/NM/S/nmsg6_c. pdf (Published on October 8, 2020) M-System Engineering Co., Ltd.

Article 30, paragraph 2 of the Patent Law applies Website https://www. m-system. co. jp/mssjapanese/PDF/NG/S/ngsg6.pdf (Published on October 8, 2020) M-System Engineering Co., Ltd.

Article 30, paragraph 2 of the Patent Law applies Website https://www. m-system. co. jp/mssjapanese/PDF/NS/S/nssg6.pdf (Published on December 24, 2020) M-System Engineering Co., Ltd.

Article 30, paragraph 2 of the Patent Law applies Website https://www. m-system. co. jp/mssjapanese/PDF/NM/S/nmsg6_b. pdf (Published on December 24, 2020) M-System Engineering Co., Ltd.

Applicable under Article 30, Paragraph 2 of the Patent Law. Sold by M-Systems Engineering Co., Ltd. at F.A. Techno Co., Ltd.'s Tokyo West Sales Office.

The present invention relates to a communication device and a communication apparatus.

Patent document 1 describes a broker for use in a secure communications network such as the Internet that is configured to mediate client transactions received over a secure network link, such as a secure socket layer (SSL) link.

Special table 2003-504714

The problem to be solved is to provide a communication device and a communication apparatus that can realize suitable communication control.

A communications device according to a first aspect of the present invention includes a first port group capable of establishing a connection using a first communication standard, and a second port group capable of establishing a connection using a second communication standard that is more secure than the first communication standard, and after a connection using the first communication standard and a connection using the second communication standard are established, receives first data transmitted using the first communication standard from the first port group and transmits the first data from the second port group using the second communication standard, receives second data transmitted using the second communication standard from the second port group and transmits the second data using the first communication standard. and a control unit that controls transmission from the first port group, wherein the control unit is capable of control operation in a first mode when a client is provided on the first port group side, and is capable of control operation in a second mode when a server is provided on the first port group side, and when the control unit controls operation in the first mode, it receives a connection request from the client from the first port group and transmits the connection request from the second port group, and when the control unit controls operation in the second mode, it receives the connection request from the second port group and transmits the connection request from the first port group.

The present invention provides a communication device and a communication apparatus that can realize suitable communication control.

FIG. 1 is a diagram for explaining a communication device according to the first embodiment. FIG. 2 is a diagram for explaining the communication device of the first embodiment. FIG. 3 is another diagram for explaining the communication device of the first embodiment. FIG. 4 is a diagram for explaining the operation of the communication device of the first embodiment. FIG. 5 is another diagram for explaining the operation of the communication device of the first embodiment. FIG. 6 is a diagram for explaining the operation of the communication device of the second embodiment. FIG. 7 is a diagram for explaining a communication device according to the third embodiment. FIG. 8 is another diagram for explaining the communication device of the third embodiment.

(First embodiment (standard mode))

Figure 1 is a diagram for explaining the communication device of the first embodiment, Figure 2 is a diagram for explaining the communication equipment of the first embodiment, and Figure 3 is another diagram for explaining the communication equipment of the first embodiment.

In FIG. 1, communication device 1 is, for example, a device that transfers information across multiple networks. Here, a network is, for example, a device that forms a connection (logical communication path) using a communication line to enable data exchange between multiple computers.

In FIG. 1, the communication device 1 includes a client device 10, a first communication device 20, a first router 30, a second router 50, a second communication device 60, and a server device 70.

In this embodiment, the client device 10, the first communication device 20, and the first router 30 are provided within the first network 41.

In the first network 41, the client device 10 and the first communication device 20 can establish a connection (logical communication path) using a first communication standard. The first communication standard can be, for example, an industrial protocol used in an in-house LAN environment in which a local IP address is set for each terminal in a LAN environment based on TCP/IP (Transmission Control Protocol/Internet Protocol).

Examples of the first communication standard include TCP, Modbus/TCP, Modbus/RTU (remote terminal unit), SLMP (Seamless Message Protocol), and HTTP (Hyper Text Transfer Protocol). The first network 41 may include devices other than the client device 10 and the first communication device 20 that are capable of connecting using the first communication standard.

The first communication device 20 and the first router 30 can establish a connection using a second communication standard that is more secure than the first communication standard. The second communication standard can be, for example, a communication standard in which electronic certificates held by the devices performing communication are exchanged, or a communication standard that is more secure than login/password authentication. It is also preferable that encryption is implemented for the second communication standard.

Examples of the second communication standard include TLS (Transport Layer Security) and SSL (Secure Sockets Layer). The first network 41 may include devices other than the first communication device 20 and the first router 30 that are capable of connecting using the second communication standard.

The second router 50, the second communication device 60, and the server device 70 shown in FIG. 1 are provided within the second network 42.

In the second network 42, the second communication device 60 and the server device 70 can establish a connection using the first communication standard. The second network 42 may include devices other than the second communication device 60 and the server device 70 that can establish a connection using the first communication standard.

The second router 50 and the second communication device 60 can establish a connection using the second communication standard. The second network 42 may include devices other than the second router 50 and the second communication device 60 that can establish a connection using the second communication standard.

The first network 41 (first router 30) and the second network 42 (second router 50) are adjacent to each other via the Internet 40. A connection can be established between the first router 30 and the Internet 40, and between the second router 50 and the Internet 40, using the second communication standard.

The client device 10 is, for example, a client PC (personal computer).

The number of client devices may be one, or the first network 41 may include a plurality of client devices such as client device 11 (not shown), client device 12 (not shown), and client device 13 (not shown). Each of the plurality of client devices 11 to 13 is capable of communicating with the server device 70 in the same manner as the client device 10.
The communication device 1 may include a client device (not shown) that is provided in a network different from the first network 41 and is capable of communicating with the server device 70. Each of the multiple client devices may be provided in the same network or in different networks.

The first communication device 20 is a communication device capable of connecting to the client device 10. The first communication device 20 operates in a client mode to connect to the client device 10.

The first router 30 is a router capable of connecting to the first communication device 20 and the second router 50. A router is, for example, a device capable of connecting (connecting or relaying) between multiple different networks.

The server device 70 is, for example, a field device that controls devices provided in a factory, a server computer, etc. There may be one server device, or there may be multiple server devices such as a server device 71 (not shown), a server device 72 (not shown), and a server device 73 (not shown) provided in the second network 42. Each of the multiple server devices 71 to 73 is capable of communicating with the client devices 10 to 13 in the same manner as the server device 70.
The communication device 1 may include a server device (not shown) that is provided in a network different from the second network 42 and is capable of communicating with the client device 10. Each of the multiple server devices may be provided in the same network or in different networks.

The second communication device 60 is a communication device capable of connecting to a server device 70 .
The second communication device 60 operates in a server device mode for connecting to the server device 70. The first communication device 20 and the second communication device 60 may be devices having different circuit components and electric circuits, or may be devices having the same circuit components and electric circuits.
In this embodiment, the first communication device 20 and the second communication device 60 are devices having the same circuit components and electrical circuits, and by making the settings described below, the first communication device 20 is made to operate in a client mode and the second communication device 60 is made to operate in a server device mode.

The second router 50 can connect to the second communication device 60 and the first router 30.

The first communication device 20 of this embodiment will be described with reference to Figure 2.

The first communication device 20 has a control unit 210, a memory 220, a first port group P21, and a second port group P22.

The first port group P21 is a port group that can establish a connection (logical communication path) using the first communication standard. The first port group P21 has a first port P21a for the first communication, a second port P21b for the first communication, and third and fourth ports P21c to P21d for the first communication.

The second port group P22 is a port group that can establish a connection using a second communication standard that is more secure than the first communication standard. The second port group P22 has a first port P22a for second communication, a second port P22b for second communication, and third and fourth ports P22c to P22d for second communication.

The control unit 210 performs control for establishing connections with the ports of the client devices 10 to 13, control for establishing connections with the first router 30 and other routers (not shown), data transfer control after the connection is established, connection cutoff control, encryption, decryption, etc.

The memory 220 stores information necessary for the control of the control unit 210. For example, the memory 220 stores information necessary for control to establish a connection, data transfer control after the connection is established, connection disconnection control, encryption, decryption, etc.

The control unit 210 controls the transmission of data etc. received from the second communication first port P22a from the first communication first port P21a. The control unit 210 also controls the transmission of data etc. received by the first communication first port P21a from the second communication first port P22a.

Similarly, the control unit 210 controls the transmission of data etc. received from the second port for second communication P22b from the second port for first communication P21b, and the transmission of data etc. received from the second port for first communication P21b from the second port for second communication P22b.

Similarly, the control unit 210 controls the transmission of data etc. received from the third and fourth ports P22c to 22d for the second communication from the third and fourth ports P21c to 21d for the first communication, and the transmission of data etc. received from the third and fourth ports P21c to 21d for the first communication from the third and fourth ports P22c to 22d for the second communication.

The client device 10 has a control unit 110 that performs various controls, and a first port P11a that can be connected to a first communication first port P21a of a first communication device 20 using a first communication standard.
The control unit 110 can control the reception of data, etc. supplied from the first port P21a for first communication of the first communication device 20 at the first port P11a, and the transmission of data, etc. from the first port P11a to the first port P21a for first communication.

The first router 30 has a control unit 310 that performs various controls, a first port P31a that can be connected to the first port P22a for second communication of the first communication device 20 using the second communication standard, and a second port P32a.

The control unit 310 can control the reception of data, etc. supplied from the first port P22a for second communication of the first communication device 20 at the first port P31a and the transmission of the data from the second port P32a to the Internet 40. The control unit 310 can also control the reception of data, etc. supplied from the Internet 40 at the second port P32a and the transmission of the data from the first port P31a to the first port P22a for second communication.

The second communication device 60 of this embodiment will be described with reference to Figure 3.

The second communication device 60 has a control unit 610, a memory 620, a first port group P61, and a second port group P62.

The first port group P61 is a port group that can establish a connection using the first communication standard. The first port group P61 has a first port P61a for the first communication, a second port P61b for the first communication, and third and fourth ports P61c to P61d for the first communication.

The second port group P62 is a port group that can establish a connection using a second communication standard that is more secure than the first communication standard. The second port group P62 has a first port P62a for second communication, a second port P62b for second communication, and third and fourth ports P62c to P62d for second communication.

The control unit 610 performs control for establishing connections with ports of server devices 70 to 73, control for establishing connections with the second router 50 and other routers (not shown), data transfer control after the connections are established, connection cutoff control, encryption, decryption, etc.

The memory 620 stores information necessary for the control of the control unit 610. For example, the memory 620 stores information necessary for control to establish a connection, data transfer control after the connection is established, connection cutoff control, encryption, decryption, and the like.
The control unit 610 controls the transmission of data received from the second communication first port P62a from the first communication first port P61a. The control unit 610 also controls the transmission of data received from the first communication first port P61a from the second communication first port P62a.

Similarly, the control unit 610 controls the transmission of data etc. received from the second to fourth ports P62b to 62d for the second communication from the second to fourth ports P61b to 61d for the first communication. The control unit 610 also controls the transmission of data etc. received from the second to fourth ports P61b to 61d for the first communication from the second to fourth ports P62b to 62d for the second communication.

In FIG. 3, the second router 50 has a control unit 510 that performs various controls, a first port P51a that can be connected to the second port P32a of the first router 30 using the second communication standard, and a second port P52a that can be connected to the first second communication port P62a of the second communication device 60 using the second communication standard.

The control unit 510 controls the reception of data, etc. supplied from the second port P32a of the first router 30 to the Internet 40 at the first port P51a, and the transmission of the data from the second port P52a to the second communication first port P62a of the second communication device 60. The control unit 510 also controls the reception of data, etc. supplied from the second communication first port P62a of the second communication device 60 at the second port P52a, and the transmission of the data from the first port P51a (via the Internet 40) to the second port P32a of the first router 30.

The server device 70 has a control unit 710 that performs various controls, and a first port P71a that can be connected to the first communication first port P61a of the second communication device 60 using the first communication standard. The control unit 710 can receive data, etc. supplied from the first communication first port P61a of the second communication device 60 at the first port P71a, and can control the transmission of data, etc. from the first port P71a to the first communication first port P61a.

Figure 4 is a diagram for explaining the operation of the communication device of the first embodiment, and Figure 5 is another diagram for explaining the operation of the communication device of the first embodiment.

The operation of the communication device 1 of this embodiment will be described below with reference to Figures 4 and 5. In Figures 4 and 5, the same components as those shown in Figures 1 to 3 are given the same reference numerals, and duplicate descriptions will be omitted.

(STEP 1) Setting In step 1, the first communication device 20, the second communication device 60 and the second router 50 perform the following setting operations.
(1) Setting of the first communication device 20 The first communication device 20 can perform a setting operation in a first mode (hereinafter referred to as a standard mode) or a second mode (hereinafter referred to as a reverse connection mode) in order to establish a connection. When performing a setting operation in the standard mode, the user transmits information to the first communication device 20 indicating that the mode is the standard mode.

When the control unit 210 receives information indicating that the mode is standard mode, it stores the information indicating that the mode is standard mode in the memory 220, and starts the setting operation by referring to the information indicating that the mode is standard mode stored in the memory 220.

Next, the user transmits information on the number of listening ports for TCP connections (e.g., 1, 2, 4, 8) to the first communication device 20. When the control unit 210 receives the information on the number of listening ports for TCP connections, it stores the information on the number of listening ports for TCP connections in the memory 220 and performs the operation of setting the number of listening ports for TCP connections.

Next, the user supplies client information for the number of listening ports for the TCP connection to the first communication device 20. The control unit 210 sets up the client based on the supplied information. Specifically, for example, as shown in FIG. 5, the control unit 210 (a) stores in the memory 220 the listening port number 502 (P21a) for the TCP connection, (b) stores in the memory 220 the destination port number 802 (P62a) for the TLS connection, and (c) stores in the memory 220 the IP address or domain name (server1.jp) of the destination of the TLS connection, and sets up the client based on the information stored in the memory 220.

(2) Setting of the second communication device 60 The second communication device 60 can also perform a setting operation in the first mode (hereinafter referred to as the standard mode) or the second mode (hereinafter referred to as the reverse connection mode) to establish a connection, similar to the first communication device 20. When performing a setting operation in the standard mode, the user transmits information to the second communication device 60 indicating that the mode is the standard mode.

When the control unit 610 receives information indicating that the mode is standard mode, it stores the information indicating that the mode is standard mode in the memory 620, and starts the setting operation by referring to the information indicating that the mode is standard mode stored in the memory 620.

Next, the user transmits information on the number of standby ports for TLS connections (e.g., 1, 2, 4, 8) to the second communication device 60. When the control unit 610 receives the information on the number of standby ports for TLS connections, it stores the information on the number of standby ports for TLS connections in the memory 620 and performs the operation of setting the number of standby ports for TLS connections.

Next, the user supplies server information for the number of waiting ports for the TLS connection to the second communication device 60. The control unit 610 sets the server based on the supplied information. Specifically, for example, as shown in FIG. 5, the control unit 610 (a) stores in memory 620 that the client authentication is valid, (b) stores in memory 620 the waiting port number 802 (P62a) for the TLS connection, (c) stores in memory 620 the destination port number 502 (P71a) for the TCP connection, and (d) stores in memory 620 the IP address or domain name (192.168.1.200) of the server device 70, and sets the server based on the information stored in memory 620.

(3) Setting of the second router 50 The user transmits information required for setting to the second router 50. As a result, the control unit 510 of the second router 50 (a) opens the port set in the TLS reception port 802 (P62a) of the server function of the second communication device 60, and passes it through to the second communication device 60, and (b) makes it possible to identify the destination from outside using a fixed IP address or DDNS.

(STEP 2) Connection In step 2, the client device 10, the first communication device 20, the second communication device 60, and the second router 50 perform the following connection operations.
The client device 10 establishes a TCP connection to the first communication device 20. Next, the first communication device 20 establishes a TLS connection to the second communication device 60 (via the first router 30 and the second router 50). Next, the second communication device 60 establishes a TCP connection to the server device 70. This allows the client device 10 to connect to the server device 70.

While the client device 10 is connected to the server device 70, it is preferable for the client device 10 to perform the following operations, for example.
(A) The first communication device 20 requests a server certificate from the second communication device 60 and verifies whether the signature on the certificate is from a trusted certificate authority (server authentication).
(a) The second communication device 60 requests a client certificate from the first communication device 20 and verifies whether the signature on the client certificate is from a reliable certificate authority (client authentication). Note that the client authentication performed by the second communication device 60 may be omitted.
(c) The first communication device 20 and the second communication device 60 start public key cryptography communication using the public key attached to the certificate. Here, communication (key exchange) is performed to exchange common key information (not a public key or a private key) between the two devices. Because this communication is encrypted using public key cryptography, there is an extremely low risk of it being intercepted.
(d) The first communication device 20 and the second communication device 60 start common key cryptographic communication using a common key. Note that the upper layer application protocol starts from this state.

Here we will explain in more detail about mutual authentication (server authentication, client authentication) during a TLS connection.

To perform mutual authentication, the system administrator must first set up a local certification authority (LCA). Specifically, for example, an LCA can be set up within one PC. By setting up an LCA, an LCA certificate is created and stored as electronic data within the PC. Note that a specific program, such as an LCA construction support tool, may be used to set up an LCA.

Next, the certificate for the main body, created using a specified program or the like, is transferred to the first communication device 20 and the second communication device 60. The certificate exchanged between the first communication device 20 and the second communication device 60 during TLS connection contains the signature of the LCA. To confirm that this is definitely the signature of the LCA previously constructed, the certificate of that LCA is required. For this reason, when the main body certificate is transferred to the first communication device 20 and the second communication device 60, the LCA certificate is also transferred.

When the main certificate is transferred to the first communication device 20 and the second communication device 60, the main private key (file format) required for encrypted communication is also transferred. In this way, the main certificate, the LCA certificate, and the main private key are transferred to the first communication device 20 and the second communication device 60.

(STEP 3) Transfer In step 3, the first communication device 20 and the second communication device 60 perform the following transfer operation.
(a) The first communication device 20 transmits data received from a TCP-connected client device 10 to a TLS-connected second communication device 60 (via the first router 30 and the second router 50), and conversely transmits data received from the second communication device 60 to the client device 10.
(i) The second communication device 60 transmits data received from the TCP-connected server device 70 to the TLS-connected first communication device 20 (via the first router 30 and the second router 50), and conversely, transmits data received from the first communication device 20 to the server device 70.

(STEP 4) Disconnection In step 4, the following disconnection operation is performed.

When any of the TCP connection between the client device 10 and the first communication device 20, the TLS connection between the first communication device 20 and the second communication device 60, and the TCP connection between the second communication device 60 and the server device 70 is disconnected, communication with the communication device 1 is disconnected.

The first communication device 20 of the present embodiment described above has a first port group P21 (P21a to P21d) capable of establishing a connection (logical communication path) using a first communication standard (TCP), a second port group P22 (P22a to P22d) capable of establishing a connection using a second communication standard (TLS) that is more secure than the first communication standard, and a control unit 210 that performs control to receive first data sent using the first communication standard (TCP) from the first port group P21 and transmit the first data from the second port group P22 using the second communication standard (TLS) after a connection using the first communication standard (TCP) and a connection using the second communication standard (TLS) have been established, and to receive second data sent using the second communication standard (TLS) from the second port group P22 and transmit the second data from the first port group P21 using the first communication standard (TCP).

The first communication device 20 has a second port group P22 (P22a to P22d) that supports the highly secure second communication standard (TLS), so sufficient information security can be ensured even when the second port group P22 (P22a to P22d) is connected to the Internet 40.

In addition, because the first port group P21 (P21a to P21d) of the first communication device 20 supports the first communication standard (TCP), the first communication device 20 can easily connect to a client device 10 or the like in the first network 41, which is less secure than the second communication standard (TLS).

The first communication device 20 described above can realize suitable communication that simultaneously achieves highly secure communication using the second port group P22 (P22a to P22d) and easy connectivity to the first network 41 using the first port group P21 (P21a to P21d).

The second communication device 60 of the present embodiment described above has a first port group P61 (P61a to P61d) capable of establishing a connection (logical communication path) using a first communication standard (TCP), a second port group P62 (P62a to P62d) capable of establishing a connection using a second communication standard (TLS) that is more secure than the first communication standard, and a control unit 610 that performs control to receive first data sent using the first communication standard (TCP) from the first port group P61 and transmit the first data from the second port group P62 using the second communication standard (TLS) after a connection using the first communication standard (TCP) and a connection using the second communication standard (TLS) have been established, and to receive second data sent using the second communication standard (TLS) from the second port group P62 and transmit the second data from the first port group P61 using the first communication standard (TCP).

The second communication device 60 has a second port group P62 (P62a to P62d) that supports the highly secure second communication standard (TLS), so sufficient information security can be ensured even when the second port group P62 (P62a to P62d) is connected to the Internet 40.

In addition, because the first port group P61 (P61a to P61d) of the second communication device 60 supports the first communication standard (TCP), the second communication device 60 can easily connect to a server device 70 or the like in the second network 42, which is less secure than the second communication standard (TLS).

The second communication device 60 described above can realize suitable communication that simultaneously achieves highly secure communication using the second port group P62 (P62a to P62d) and easy connectivity to the second network 42 using the first port group P61 (P61a to P61d).

In the communication device 1 of the present embodiment described above, the first communication device 20 and the second communication device 60 are directly exposed to the Internet 40, but the client device 10 and the server device 70 are not directly exposed to the Internet 40. This makes it possible to avoid direct attacks on the client device 10 and the server device 70, improving the security of communications.

The TLS mutual authentication of this embodiment is more secure than login/password authentication because it is a communication in which electronic certificates held by both the first communication device 20 and the second communication device 60 are exchanged. Therefore, by using the communication device 1 of this embodiment, it is possible to reject spoofed connections by external attackers while allowing connections from authenticated parties (the first communication device 20 and the second communication device 60), improving the security of communications.

In the communication device 1 of this embodiment, TLS encryption is performed between the first communication device 20 and the second communication device 60, so the risk of eavesdropping and tampering can be reduced.

In the communication device 1 of the present embodiment described above, the security of communication is ensured by the first communication device 20 and the second communication device 60, so there is no need to make any changes to the lines or devices on the client side of the first communication device 20 or on the server side of the second communication device 60. This eliminates the need to make system changes to encrypt lines or devices.

In this embodiment, by using client devices 11 to 13 or server devices 71 to 73, it is possible to obtain the same effects as those obtained by client device 10 or server device 70.

(Second embodiment (reverse connection mode))

Figure 6 is a diagram for explaining the operation of the communication device 2 of the second embodiment. In the following explanation, the same reference numerals are used for configurations similar to those shown in Figures 1 to 5, and duplicate explanations will be omitted.

The communication device 2 of this embodiment has a client device 10, a first communication device 20, a first router 30, a second router 50, a second communication device 60, and a server device 70, similar to the communication device 1 shown in FIG. 1.

In the communication device 2 of this embodiment, similar to the communication device 1 shown in FIG. 1, the client device 10, the first communication device 20, and the first router 30 are provided in the first network 41, and the second router 50, the second communication device 60, and the server device 70 are provided in the second network 42.

The communication device 2 of this embodiment differs from the communication device 1 shown in FIG. 1 in the method of connection using the first and second communication standards, so this point will be described in detail using FIG. 4 and FIG. 6.

(STEP 1) Setting In step 1, the first communication device 20, the second communication device 60, and the first router 30 perform the following setting operations.

(1) Setting of the first communication device 20 As described above, the first communication device 20 can perform a setting operation in the first mode (standard mode) or the second mode (reverse connection mode) to establish a connection. When performing a setting operation in the reverse connection mode, the user transmits information to the first communication device 20 indicating that the mode is the reverse connection mode.

When the control unit 210 receives information indicating that the mode is reverse connection mode, it stores the information indicating that the mode is reverse connection mode in the memory 220, and starts the setting operation by referring to the information indicating that the mode is reverse connection mode stored in the memory 220.

Next, the user transmits client information to the first communication device 20 to operate the first communication device 20 in client mode. When the control unit 210 receives the client information, it stores the client information in the memory 220 and performs setting operations by referring to the client information stored in the memory 220.

Next, the user transmits information on the waiting port number 502 (P21a) for the TCP connection to the first communication device 20. When the control unit 210 receives the information on the waiting port number for the TCP connection, it stores the information on the waiting port number 502 (P21a) for the TCP connection in the memory 220, and performs a setting operation based on the information stored in the memory 220.

Next, the user supplies information on the standby port number 802 (P22a) for the TLS connection to the first communication device 20. When the control unit 210 receives the information on the standby port number for the TLS connection, it stores the information on the standby port number 802 (P22a) for the TLS connection in the memory 220, and performs a setting operation based on the information stored in the memory 220.

(2) Setting of the second communication device 60 As described above, the second communication device 60 can perform a setting operation in the first mode (standard mode) or the second mode (reverse connection mode) to establish a connection. When performing a setting operation in the reverse connection mode, the user transmits information to the second communication device 60 indicating that the mode is the reverse connection mode.

When the control unit 610 receives information indicating that the mode is reverse connection mode, it stores the information indicating that the mode is reverse connection mode in the memory 620, and starts the setting operation by referring to the information indicating that the mode is reverse connection mode stored in the memory 620.

Next, the user transmits the server device information to the second communication device 60 in order to operate the second communication device 60 in the server device mode. When the control unit 610 receives the server device information, it stores the server device information in the memory 620 and performs a setting operation based on the server device information stored in the memory 220.

Next, the user supplies information on the destination port number 802 (P22a) of the TLS connection to the second communication device 60. When the control unit 610 receives the information on the destination port number of the TLS connection, it stores the information on the destination port number 802 (P22a) of the TLS connection in the memory 620, and performs a setting operation based on the information stored in the memory 620.

Next, the user supplies information on the IP address or domain name (server2.jp) of the destination of the TLS connection to the second communication device 60. When the control unit 610 receives the information on the IP address or domain name of the destination of the TLS connection, it stores the information on the IP address or domain name (server2.jp) of the destination of the TLS connection in memory 620, and performs a setting operation based on the information stored in memory 620.

Next, the user supplies information on the destination port number 502 (P71a) of the TCP connection to the second communication device 60. When the control unit 610 receives the information on the destination port number of the TCP connection, it stores the information on the destination port number 502 (P71a) of the TCP connection in memory 620 and performs a setting operation based on the information stored in memory 620.

Next, the user supplies the IP address or domain name (192.168.1.200) information of the server device 70 to the second communication device 60. When the control unit 610 receives the IP address or domain name information of the server device 70, it stores the IP address or domain name (192.168.1.200) information of the server device 70 in the memory 620 and performs a setting operation based on the information stored in the memory 620.

(3) Setting of the first router 30 The user transmits information required for setting to the first router 30. As a result, the control unit 310 of the first router 30 (a) opens a reception port and passes the packet to the local address port (P22a) of the first communication device 20, and (b) makes the destination identifiable from outside by a fixed IP address or DDNS.

The communication device 2 of the present embodiment described above does not need to open a port on the router (second router 50) on the server device 70 side, so the server device 70, which is a field device, etc., is less likely to be the target of attacks.

Since the communication device 1 of the first embodiment is in standard mode, for example, a fixed IP address or DDNS contract is required for each server device, and since the communication device 2 of the present embodiment is in reverse connection mode, for example, a fixed IP address and DDNS contract procedures are required for each client device.
For example, if there are four server devices (70 to 73) and one client device (10), four contract procedures, etc. are required in the standard mode, and one contract procedure, etc. is required in the reverse connection mode.

For example, when the field equipment installed in a factory is a server device and the PC monitoring the server device is a client device, the number of server devices will often be greater than the number of client devices, so by selecting the reverse connection mode instead of the standard mode, the number of contract procedures, etc. can be reduced.
It goes without saying that when the number of client devices is greater than the number of server devices, the number of contract procedures can be reduced by selecting the standard mode instead of the reverse connection mode.

(Third embodiment)

Figure 7 is a diagram for explaining a communication device of the third embodiment, and Figure 8 is another diagram for explaining a communication device of the third embodiment. In the following explanation, the same reference numerals are used for configurations similar to those shown in Figures 1 to 6, and duplicate explanations will be omitted.

The communication device 3 shown in Figures 7 and 8 differs from the communication devices shown in Figures 1 to 6 in that it has a client device 11 (see Figure 7) in addition to client device 10, and has a server device 71 (see Figure 8) in addition to server device 70.

In FIG. 7, like client device 10, client device 11 has a control unit 111 that performs various controls, and a first port P11b that can be connected to a first communication second port P21b of the first communication device 20 using a first communication standard.

The control unit 111 can receive data, etc. supplied from the first communication second port P21b of the first communication device 20 at the first port P11b, and transmit data, etc. from the first port P11b to the first communication second port P21b.

The control unit 210 of the first communication device 20 controls the data etc. received from the first port for second communication P22a to be transmitted from the first port for first communication P21a, and the data etc. received from the second port for second communication P22b to be transmitted from the second port for first communication P21b.

The control unit 210 also controls the transmission of data etc. received by the first communication first port P21a from the second communication first port P22a, and the transmission of data etc. received by the first communication second port P21b from the second communication second port P22b.

In addition to the configuration shown in Figures 1 to 6, the first router 30 has a first port P31b and a second port P32b that can be connected to the second communication second port P22b of the first communication device 20 using the second communication standard.

The control unit 310 of the first router 30 controls the reception of data, etc. supplied from the first port for second communication P22a of the first communication device 20 at the first port P31a and transmission of the data, etc. from the second port P32a to the Internet 40, and the reception of data, etc. supplied from the second port for second communication P22b of the first communication device 20 at the first port P31b and transmission of the data, etc. from the second port P32b to the Internet 40.

In addition, the control unit 310 receives data and the like supplied from the Internet 40 at the second port P32a and transmits the data from the first port P31a to the second communication first port P22a,
The control unit 10 performs control so that data etc. supplied from the Internet 40 is received at the second port P32b and transmitted from the first port P31b to the second communication second port P22b.

In FIG. 8, the control unit 510 of the second router 50 controls the receiving of data, etc. supplied from the second port P32a of the first router 30 to the Internet 40 at the first port P51a and transmission from the second port P52a to the first port for second communication P62a of the second communication device 60, and the receiving of data, etc. supplied from the second port P32b of the first router 30 to the Internet 40 at the first port P51b and transmission from the second port P52b to the second port for second communication P62b of the second communication device 60.

The control unit 510 also controls the receiving of data, etc. supplied from the second communication first port P62a of the second communication device 60 at the second port P52a and transmission from the first port P51a (via the Internet 40) to the second port P32a of the first router 30, and the receiving of data, etc. supplied from the second communication second port P62b of the second communication device 60 at the second port P52b and transmission from the first port P51b (via the Internet 40) to the second port P32b of the first router 30.

The control unit 610 of the second communication device 60 controls the transmission of data etc. received from the second communication first port P62a from the first communication first port P61a, and the transmission of data etc. received from the second communication second port P62b from the first communication second port P61b.

The control unit 610 also controls the transmission of data etc. received from the first port for first communication P61a from the first port for second communication P62a, and the transmission of data etc. received from the second port for first communication P61b from the second port for second communication P62b.

Similar to server device 70, server device 71 has a control unit 711 that performs various controls, and a first port P71b that can be connected to the first communication second port P61b of the second communication device 60 using the first communication standard. The first port P71b can receive data, etc. from the first communication second port P61b and transmit data, etc. to the first communication second port P61b.

The communication device 3 of the present embodiment described above has a client device 11 and a server device 71 in addition to a client device 10 and a server device 70, and therefore can perform suitable control using the client devices 10, 11 and the server devices 70, 71.

In this embodiment, the case where two client devices and two server devices 70 are used has been described as an example, but the present invention is not limited to this. For example, one client device and multiple server devices 70 may be used, multiple client devices and one server device 70 may be used, or one client device and one server device 70 may be used.

In addition, in the above embodiment, a case where one first router 30 and one second router 50 are used has been described as an example, but the present invention is not limited to this. It goes without saying that at least one of the first router 30 and the second router 50 may be multiple.

The configurations of the above-mentioned embodiments can be combined with each other. Although various embodiments and variations have been described above, the present invention is not limited to these. For example, combinations of the configurations of the above-mentioned embodiments and other aspects that are conceivable within the scope of the technical concept of the present invention are also included within the scope of the present invention.

The present invention provides a communication device and a communication apparatus that can realize suitable communication control.

1 Communication device 10 Client device 20 First communication device 30 First router 50 Second router 60 Second communication device 70 Server device

Claims (3)

a first port group capable of establishing a connection using a first communication standard;
a second port group capable of establishing a connection using a second communication standard having higher security than the first communication standard;
After the connection using the first communication standard and the connection using the second communication standard are established,
a control unit that performs control to receive first data transmitted using the first communication standard from the first port group and transmit the first data from the second port group using the second communication standard, and to receive second data transmitted using the second communication standard from the second port group and transmit the second data from the first port group using the first communication standard ,
the control unit is capable of performing a control operation in a first mode when a client is provided on the first port group side, and is capable of performing a control operation in a second mode when a server is provided on the first port group side,
When the control unit performs a control operation in the first mode, the control unit receives a connection request from the client through the first port group and transmits the connection request through the second port group;
A communications device that receives the connection request from the second port group and transmits the connection request from the first port group when the control unit performs a control operation in the second mode . 2. A communication device according to claim 1,
The first port group includes:
a first communication first port for receiving the first data and transmitting the second data;
a first communication second port for receiving third data different from the first data and transmitting fourth data different from the second data,
The second port group includes:
a second communication first port for receiving the second data and transmitting the first data;
a second port for second communication for receiving the fourth data and for transmitting the third data. A communication device including the communication device according to claim 1 or 2 ,
a first communication device provided by the client on the side of the first port group, and a second communication device provided by the server on the side of the first port group,
A communication device in which, when the first communication device and the second communication device connect using the second communication standard, each device sends and receives certificates to verify the signature of the other device's certificate, and the connection is established only if both devices are authenticated.