JP5241665B2 - COMMUNICATION DEVICE, COMMUNICATION SYSTEM, AND COMMUNICATION METHOD - Google Patents

Description

  The present invention relates to a communication device, a communication system, and a communication method for performing virtual network communication.

  In recent years, for the purpose of providing various products and improving management efficiency, there have been a series of cases where group companies have been merged by merging large companies or establishing holding companies. When companies are integrated, it is assumed that each company (each company) unifies and manages the corporate information network individually under a new organization. By doing so, sharing of databases managed by each company and cooperation of business services can be realized, and communication lines and network devices can be consolidated to reduce operation costs.

  However, in-house information networks often handle highly confidential information, and it is inappropriate in terms of security that all communication terminals are randomly connected to the information network. Therefore, there is a demand for a network configuration in which only a limited number of terminals that need to be linked logically can be connected to a minimum while physically promoting cost reduction through device aggregation.

  In response to such a request, for example, in the following Patent Document 1, as a “distributed virtual network”, a terminal that is connected to a network by transmitting and receiving packets encapsulating and storing identifiers that uniquely identify communication groups and users A mutual access function based on a logical group structure is realized. Further, in the overlay network described in Patent Document 1 below, virtual management having both fault tolerance and scalability is achieved by distributing database management and routing using a distributed hash table technique represented by Non-Patent Document 1 below. The network communication function is realized.

JP 2007-158594 A “Chord: A Scalable Peer-to-Peer Lookup Service for Internet Applications”, Proc. ACM SIGCOMM, 2001

  However, the overlay network described in Patent Document 1 has a configuration in which a virtual communication interface and a label addition module for a packet are provided inside terminals serving as both ends of communication. In addition, dedicated packet processing software must be running. However, there are cases where the number of participating terminals may reach hundreds of thousands to millions in a large-scale corporate collaboration network, and it is very troublesome to install such software on all terminals. .

  Also, terminals other than personal computers, such as business terminals, may have black boxes inside, and it is impossible to install unique software on such terminals. For this reason, the method described in Patent Document 1 has a problem in that a virtual network communication function using an overlay network cannot be provided when a terminal that is difficult to add software is included.

  The present invention has been made in view of the above, and an object of the present invention is to obtain a communication device, a communication system, and a communication method capable of realizing virtual network communication without adding software to an existing terminal. .

  In order to solve the above-described problems and achieve the object, the present invention provides a terminal, a communication device connected to the terminal and relaying a communication packet of the terminal, connected to the communication device, and an identifier of the terminal. A relay apparatus that transfers a communication packet of the terminal based on a certain terminal identifier and a logical network identifier that identifies the logical network, and the communication apparatus in a communication system configured to communicate with the terminal connected to itself A correspondence holding means for holding a correspondence between a terminal identifier and an address, and a predetermined terminal using a destination terminal identifier which is a terminal identifier of the destination terminal and a logical network identifier of a logical network to be used from the terminal connected to itself. When a communication packet having the destination address as the virtual destination address generated based on the conversion rule is received, the virtual destination address included in the received communication packet and the location A destination terminal identifier and a logical network identifier are obtained based on the conversion rule, and the transmission source address of the received communication packet is a transmission source which is a terminal identifier of the terminal of the communication packet transmission source based on the correspondence Obtaining a terminal identifier, performing an encapsulation process of inserting the obtained destination terminal identifier, the transmission source identifier, and the logical network identifier at a predetermined position of the received communication packet, and performing the encapsulation process on the communication packet Encapsulation processing means for transmitting to a relay device, a destination terminal identifier included in a communication packet received from the relay device and a destination terminal address that is an address of the destination terminal based on the correspondence, and determining the source identifier and A virtual address obtained based on a logical network identifier and the predetermined conversion rule is obtained as a source virtual address, For the communication packet received from the relay device, the destination terminal address is stored in the destination address, the source virtual address is stored in the source address, and the destination terminal identifier, source identifier, and logical network identifier are deleted. And decapsulation processing means for performing the decapsulation process and transmitting the communication packet after the decapsulation process to the terminal connected to itself.

  According to the present invention, when a communication device receives a packet from a terminal to which the communication device is connected, the terminal identifier and logical network identifier obtained based on the virtual IP address and the transmission obtained based on the source IP address The original terminal identifier is inserted between the IP address and the payload and transmitted, and transmitted to the relay device to which it is connected. When the communication device receives a packet from the relay device, On the other hand, the IP address obtained based on the destination terminal identifier included in the packet is set as the destination IP address, and the virtual IP address obtained based on the logical network identifier and the source terminal identifier is set as the source IP address, and is included in the packet. Since each identifier is deleted and sent to the terminal connected to it, the virtual network is not added to the existing terminal. It is possible to realize the network communication, an effect that.

FIG. 1 is a diagram illustrating a configuration example of a communication system according to the first embodiment. FIG. 2 is a diagram illustrating a functional configuration example of the gateway device according to the first embodiment. FIG. 3 is a diagram illustrating an example of a format of an encapsulated packet generated by the gateway device. FIG. 4 is a diagram illustrating an IP address system of a terminal using a virtual network. FIG. 5 is a diagram illustrating a position example of a conversion table of terminal identifiers and IP addresses held by the encapsulation processing unit. FIG. 6 is a diagram illustrating an example of a network connection configuration. FIG. 7 is a diagram illustrating an example of packet encapsulation processing by the gateway device on the transmission side. FIG. 8 is a diagram illustrating a packet decapsulation process performed by the gateway device on the receiving side. FIG. 9 is a diagram illustrating a configuration example of the gateway device according to the second embodiment. FIG. 10 is a diagram illustrating an example of a management table for identifying and managing authenticated terminals held by the pseudo DHCP server unit. FIG. 11 is a diagram illustrating an example of a procedure of a participation process of the gateway device according to the second embodiment. FIG. 12 is a diagram illustrating an example of the procedure of the leaving process according to the second embodiment. FIG. 13 is a diagram illustrating a configuration example of the gateway device according to the third embodiment. FIG. 14 is a diagram illustrating an example of a procedure for name resolution processing using the pseudo DNS server unit.

  Embodiments of a communication device, a communication system, and a communication method according to the present invention will be described below in detail with reference to the drawings. Note that the present invention is not limited to the embodiments.

Embodiment 1 FIG.
FIG. 1 is a diagram showing a configuration example of a first embodiment of a communication system according to the present invention. As illustrated in FIG. 1, the communication system according to the present embodiment includes gateway devices 1-1 to 1-4, terminals 2-1 to 2-4, and relay devices 3-1 to 3-6. Is done. In the present embodiment, gateway devices 1-1 to 1-4 will be described as examples of communication devices according to the present invention.

  The relay apparatuses 3-1 to 3-6 constitute a network that can communicate with each other by IP (Internet Protocol). Gateway apparatuses 1-1 to 1-3 are connected to the relay apparatus 3-1, and the relay apparatus 3 is connected. The gateway device 1-4 is connected to -5. In addition, terminals 2-1 and 2-2 are connected to the gateway apparatus 1-3, and terminals 2-3 and 2-4 are connected to the gateway apparatus 1-4. The configuration of FIG. 1 is an example, and the number of relay apparatuses 3-1 to 3-6 configuring the IP network is not limited to this, and any number is possible. Further, the number of gateway devices 1-1 to 1-4 connected to one relay device is not limited to this, and may be any number of zero or more. Further, the number of terminals connected to one gateway device is not limited to this and may be any number of zero or more.

  When the gateway devices 1-1 to 1-4 have the same configuration and are generalized without specifying which of the gateway devices 1-1 to 1-4, the gateway device 1 It describes as. Similarly, when it is not specified which of the terminals 2-1 to 2-4, it is represented as the terminal 2.

  FIG. 2 is a diagram illustrating a functional configuration example of the gateway device 1 according to the present embodiment. As shown in FIG. 2, the gateway device 1 includes a network interface unit 11 connected to the relay devices 3-1 to 3-6 and a network interface unit connected to the terminals 2-1 to 2-4 connected to the gateway device 1 12, the virtual network control unit 13 that transmits and receives control messages to and from the relay devices 3-1 to 3-6 to which it is connected, and the packets received from the terminals 2-1 to 2-4 that are connected to itself And an encapsulation processing unit 14 that sends out to the side of the relay devices 3-1 to 3-6 connected.

  FIG. 3 is a diagram illustrating an example of a format of an encapsulated packet generated by the gateway device 1. The encapsulation processing unit 14 encapsulates the packets received from the terminals 2-1 to 2-4 connected to itself into the format shown in FIG. Send. As shown in FIG. 3, the encapsulated packet according to the present embodiment includes a source IP address, a destination IP address, a source terminal identifier, a destination terminal identifier, a logical network identifier, and a payload. A normal IP packet has a format in which a payload follows an IP header, but an encapsulated packet according to the present embodiment includes a source terminal identifier that is an identifier of a source terminal and an identifier that indicates a destination terminal. A certain destination terminal identifier and a logical network identifier which is an identifier indicating a logical communication group to be used are inserted.

  FIG. 4 is a diagram showing an IP address (virtual IP address) system of the terminal 2 using the virtual network. In the virtual IP address, the upper 32 bits of the IPv6 address having a total length of 128 bits are set to a virtual network prefix common to all terminals (2001: 1 :: / 32 in the figure), and the first half of the lower 96 bits is set to 32 bits. The logical network identifier and the terminal identifier are mapped to the latter 64 bits. However, the host IP address assigned to the physical network interface of the terminal 2 uses a group identifier portion padded with zeros.

  For example, the host IP address of the terminal 2 whose terminal identifier is 513 (401 in hexadecimal notation) is 2001: 1 :: 401, but from the other terminal 2 in the logical group 80 (50 in hexadecimal notation). The destination address when transmitting a packet to the terminal 2 is 2001: 1: 0: 50 :: 401. If the address of the network to which the terminal 2 belongs is 2001 :: / 64, the terminal 2 regards the IP address specifying the logical network identifier as the address of another network. Further, by specifying the gateway device as the default gateway of the terminal 2, the gateway device 1 can automatically receive the virtual network communication packet transmitted from the terminal 2.

  FIG. 5 is a diagram illustrating a position example of a conversion table of terminal identifiers and IP addresses held by the encapsulation processing unit 14 of each gateway device 1. An identifier (source terminal identifier or destination terminal identifier) assigned to a terminal is associated with an IP address used by the terminal. For example, the top entry in FIG. 5 indicates that the IP address of the terminal having the identifier of 0x101 is 2001: 1: 1: 0: 5. Since this conversion table has different keys when searching using the conversion table on the transmission side and the reception side, it is necessary to have a structure capable of searching both the IP address from the terminal identifier and the terminal identifier from the IP address. Each gateway device 1 need only have entries for the terminals 2 connected to itself, and does not manage the number of terminals 2 connected to other gateway devices 1.

  FIG. 6 is a diagram illustrating an example of a network connection configuration. The terminal 2-1 is assumed to be connected to the gateway device 1-1, and the terminal 2-2 is assumed to be connected to the gateway device 2-2. In this case, the terminal 2-1 is a transmission source and the terminal 2-2 is a destination. The terminal 2-1 and the gateway device 1-1 belong to the transmission side network 4-1, and the terminal 2-2 and the gateway device 1-2 belong to the reception side network 4-2. The gateway device 1-1 is connected to the relay device 3-1, and the gateway device 1-2 is connected to the relay device 3-4. The relay apparatuses 3-1 to 3-6 constitute a network capable of mutual communication by IP as in FIG.

  The IP address of the terminal 2-1 on the transmission side is set to 2001 :: 1: 0: 1001, the IP address of the gateway apparatus 1-1 is set to 2001: 1: 1: 1: 1, and the IP address of the terminal 2-2 on the reception side Is set to 2001 :: 5: 0: 205, and the IP address of the gateway apparatus 1-2 is set to 2001 :: 5: 0: 102.

  FIG. 7 is a diagram illustrating an example of packet encapsulation processing by the gateway device 1-1 on the transmission side. FIG. 7 is based on the configuration of FIG. The application of the terminal 2-1 on the transmission side that desires communication uses the terminal's own IP address (2001 :: 1: 0: 1001) as the source IP address, and the opposite terminal (destination terminal 2- 2) A packet having the destination IP address as the virtual IP address (2001: 1: 0: 50 :: 402) is generated and sent to the network. Any name resolution method may be used. For example, a separately provided DNS (Domain Name System) server performs name resolution processing, and the terminal 2-1 determines the destination user name and the name resolution method. The group name is notified, the DNS server is inquired, and the DNS server returns the corresponding virtual IP address. In this case, the DNS server acquires the correspondence between the user name and the terminal identifier and the correspondence between the group name and the terminal identifier, for example, by inquiring the relay devices 3-1 to 3-6 described later.

  When the network interface unit 12 of the gateway device 1-1 receives the packet transmitted from the terminal 2-1, the packet is transferred to the encapsulation processing unit 14. The encapsulation processing unit 14 obtains a transmission source terminal identifier, a destination terminal identifier, and a logical network identifier based on the transmission source IP address and the virtual IP address included in the packet, and inserts each of these obtained identifiers into the packet. Specifically, the encapsulation processing unit 14 obtains a terminal identifier corresponding to the transmission source IP address included in the packet as the transmission source terminal identifier based on the held terminal identifier and IP address conversion table. . As described above, the virtual IP address stores the logical network identifier in the first 32 bits and the terminal identifier in the second 64 bits of the lower 96 bits after the virtual network prefix as illustrated in FIG. ing. Therefore, the encapsulation processing unit 14 obtains the logical network identifier stored in the virtual IP address, and obtains the terminal identifier stored in the virtual IP address as the destination terminal identifier.

  The encapsulation processing unit 14 also assigns the IP address assigned to the network interface unit 11 of its own device (gateway device 1-1) (2001 :: 1: 1: 1) for the IP header portion. And the destination IP address is rewritten to the IP address of the relay device 3-1 connected to the network interface unit 11.

  The encapsulation processing unit 14 transmits the packet (encapsulated packet) after the above processing is performed to the relay device 3-1 via the network interface unit 11. In the packet processing between the relay apparatuses 3-1 to 3-6, the part of each identifier shown in FIG. 3 does not change.

  The packet transmitted to the relay device 3-1 is transferred to the relay device 3-4 via the network configured by the relay devices 3-1 to 3-6, and the relay device 3-4 connects to the gateway device 1 to be connected. -2 Transfer the received packet to -2. The transfer between the relay apparatuses 3-1 to 3-6 will be described later.

  FIG. 8 is a diagram illustrating a packet decapsulation process performed by the gateway device 1-2 on the reception side. In the gateway device 1-2, the network interface unit 11 receives the packet transferred from the relay device 3-4, and transfers the received packet to the encapsulation processing unit 14. The encapsulation processing unit 14 generates a virtual IP address based on the source terminal identifier and the logical network identifier included in the transferred packet, and also converts the destination terminal identifier included in the transferred packet Convert to IP address based on table. Then, the encapsulation processing unit 14 rewrites the transferred packet with the generated virtual IP address, rewrites the destination IP address with the converted IP address, and transmits each identifier (source terminal identifier, destination). An IP packet from which the terminal identifier and logical network identifier) are deleted is generated. The encapsulation processing unit 14 transmits the generated IP packet to the terminal 2-2 via the network interface unit 12.

  Next, transfer between the relay apparatuses 3-1 to 3-6 will be described. The relay apparatuses 3-1 to 3-6 have a function of interpreting the identifier part of the encapsulated packet shown in FIG. 3 as well as the transfer based on the normal IP address. The received packet is transferred. Specifically, the relay devices 3-1 to 3-6 manage information on terminals that perform virtual network communication (permit virtual network communication) as a database. The contents included in the database include, for example, a MAC (Media Access Control) address, a terminal identifier, a corresponding logical network identifier, availability of virtual network communication, an address of a gateway device to which the terminal is connected, and the like for each terminal. To do. The database also includes correspondence between user names and terminal identifiers, correspondence between group names and logical network identifiers, and the like. Here, the terminal 2 and the user are assumed to correspond uniquely.

  The database may be such that all the relay apparatuses 3-1 to 3-6 hold the same database, or the database is divided into a distributed database, and the relay apparatuses 3-1 to 3-6 are connected to each other. Each distributed database in charge may be managed in a distributed manner. When managing the database in a distributed manner, the relay apparatuses 3-1 to 3-6, when there is no information corresponding to the destination terminal identifier in the distributed database held by the relay apparatuses 3-1 to 3-6, Contact to get information. There are no particular restrictions on the database distribution management method, and any method such as a method using a distributed hash table technique may be used.

  In the present embodiment, in the gateway device 1, the encapsulation processing unit 14 performs both the encapsulation processing on the transmission side and the decapsulation processing on the reception side, but the encapsulation processing unit and the decapsulation are performed. You may make it comprise separately to a process part. In this case, a conversion table (corresponding) holding unit, which is a storage unit that holds the conversion table (corresponding) between the terminal identifier and the IP address, is separately provided, and the conversion table holding unit is converted by the encapsulation processing unit and the decapsulation processing unit. The above processing may be performed with reference to the conversion table of the table holding unit.

  As described above, in this embodiment, the terminal 2 stores the destination IP address of the packet to be transmitted, the virtual IP address generated based on the destination terminal identifier and the logical network identifier, and the gateway device 1 When the packet is received from the terminal 2 to which the terminal is connected, the terminal identifier and logical network identifier obtained based on the virtual IP address, and the source terminal identifier obtained based on the source IP address, the IP address and the payload Between the relay devices 3-1 to 3-6 to which it is connected. When the gateway apparatus 1 receives a packet from the relay apparatuses 3-1 to 3-6, the IP address obtained based on the destination terminal identifier included in the packet is set as the destination IP address for the packet. The virtual IP address obtained based on the logical network identifier and the source terminal identifier is set as the source IP address, and each identifier included in the packet is deleted and transmitted to the terminal 2 connected to itself. Therefore, virtual network communication can be realized without adding software to an existing terminal.

Embodiment 2. FIG.
FIG. 9 is a diagram showing a configuration example of the second embodiment of the gateway device 1a according to the present invention. As illustrated in FIG. 9, the gateway device 1a according to the present embodiment adds a pseudo DHCP server unit 15 for providing a DHCP (Dynamic Host Configuration Protocol) interface for the terminal 2 to the gateway device 1 according to the first embodiment. Except for this, it is the same as the gateway device 1 of the first embodiment. The configuration of the communication system of the present embodiment is the same as that of the first embodiment except that the gateway device 1 is replaced with the gateway device 1a. Components having the same functions as those of the first embodiment are denoted by the same reference numerals as those of the first embodiment, and description thereof is omitted.

  In the prior art, in order to limit network resources to authorized terminals, a terminal that performs virtual network communication is registered in advance in the database of the relay device, and authentication processing is performed when the terminal starts communication. Communication is permitted when it is determined that the terminal is authorized by the authentication process. On the other hand, since authentication processing involves message exchange with the control device (relay device), a terminal not equipped with dedicated software cannot perform authentication processing alone. Therefore, in the present embodiment, by adding the pseudo DHCP server unit 15 to the gateway device 1a, the IP address assignment to the terminal 2 is automated and the authentication process of the terminal 2 is realized.

  FIG. 10 is a diagram showing an example of a management table for identifying and managing authenticated terminals held by the pseudo DHCP server unit 15. In general, a control apparatus that performs authentication processing manages terminal account information using a MAC address. In the present embodiment, the relay apparatuses 3-1 to 3-6 perform authentication processing, and the relay apparatuses 3-1 to 3-6 manage the account information of the terminal 2 using MAC addresses. Therefore, the gateway device 1a also manages whether or not the terminal 2 connected to itself is authenticated by using the MAC address. As shown in FIG. 10, the pseudo DHCP server unit 15 holds a correspondence between the MAC address of the authenticated terminal 2 connected to the own apparatus and the terminal identifier as a management table.

  When the gateway device 1a receives a packet, the gateway device 1a refers to the management table described above. When the MAC address included in the packet is a MAC address having an entry in the management table, the gateway device 1a performs packet processing as an authenticated terminal. Each entry in the management table has an expiration date synchronized with the lease period of the IP address distributed by DHCP. The terminal that continues to use the IP address after the lease period expires retransmits DHCPREQUEST. Therefore, if there is no DHCPREQUEST retransmission before the expiration date expires, it is determined that the terminal 2 whose expiration date has expired has left, and the entry for that terminal 2 is deleted.

  FIG. 11 is a diagram illustrating an example of a procedure of a participation process (terminal authentication process) of the gateway device 1a according to the present embodiment. Note that the pseudo DHCP server unit 15 performs the processing of the gateway device 1a among the following participation processing. The terminal 2 set to use the gateway device 1a as a DHCP server broadcasts a DHCPDISCOVER message, which is a message for finding a DHCP server in order to acquire an IP address used by the terminal 2 when connected to the network (step S11). The gateway device 1a starts the participation process of the terminal 2 with the reception of the DHCPDISCOVER message from the terminal 2 as a trigger.

  In the gateway device 1a, since the relay devices 3-1 to 3-6 are managed in the database using the MAC address as a key as described above, the authentication information of the terminal 2 is managed by the relay device 3 (relay device 3- 1 to 3-6), an authentication information search request for requesting a database search is transmitted using the DHCPDISCOVER message source MAC address as a key (step S12).

  The relay device 3 that has received the database search request searches the database held by itself based on the key (MAC address) included in the authentication information search request, and if there is a corresponding entry, it is registered as that entry. An authentication information search response including the existing authentication information is returned (step S13). On the other hand, the relay device 3 responds to the authentication information search request when the search fails (when the database held by itself is searched based on the key included in the authentication information search request and there is no corresponding entry). do not do. When there is no response, the gateway device 1a does not perform the subsequent processing, so the terminal 2 cannot acquire an IP address and cannot communicate.

  The authentication information included as the authentication information search response includes a terminal identifier corresponding to the terminal 2 and a group identifier to which the user of the terminal 2 can participate. The gateway device 1a generates an IP address based on the user identifier acquired by the authentication information search response received in step S13, and the DHCPOFFER message including the generated IP address (for notifying IP address candidates). Message) is returned (step S14).

  Upon receiving the DHCPOFFER message, the terminal 2 transmits a DHCPREQUEST message requesting acquisition of the IP address notified by the DHCPOFFER message to the gateway device 1a (step S15). The gateway device 1a searches whether there is an entry corresponding to the terminal 2 in the held management table (table entry search: step S16). If there is an entry as a result of the search, a DHCPACK message notifying that the acquisition of the IP address has been normally completed is returned to the terminal 2 and the process is terminated.

  If there is no entry as a result of the search in step S16, the gateway apparatus 1a transmits a virtual NW participation request message for requesting the terminal 2 to participate in the virtual network (NW) to the relay apparatus 3 connected to itself (step S16). S17). The relay device 3 searches the database, and if the virtual network communication of the terminal 2 is authorized, the relay device 3 returns a virtual NW participation response to the gateway device 1a (step S18).

  When the gateway device 1a receives the virtual NW participation response, the gateway device 1a transmits a participation request message to the group designated by the authentication information to the relay device 3 (step S19). The relay device 3 searches the database, and when the terminal 2 is authorized to communicate with the designated group, returns a group participation response to the gateway device 1a (step S20).

  When receiving the group join response, the gateway device 1a registers the MAC address and the terminal identifier of the terminal 2 in the management table illustrated in FIG. 10 based on the authentication information received in step S13 (table entry setting: step S21). The DHCPACK message is transmitted to the terminal 2 (step S22). By storing the IP address of the gateway device 1a itself in the DHCPACK message, the terminal 2 thereafter communicates with the gateway device 1a as the default gateway.

  When the relay device 3 receives the requests in step S12, step S17, and step S19, and the database is distributedly managed, the relay device 3 may make an inquiry to another relay device 3.

  When the lease period of the IP address assigned to the terminal 2 expires, the DHCPREQUEST message is retransmitted from the terminal 2. If the MAC address of the terminal 2 that has transmitted the message is registered in the management table illustrated in FIG. The gateway device 1a does not transmit a participation request message (virtual NW participation request, group participation request) to the relay device 3 again.

  FIG. 12 is a diagram illustrating an example of the procedure of the separation process according to the present embodiment. In addition to the expiration of the table entry illustrated in FIG. 10 (expiration of the IP address lease period), the terminal 2 leaving process is also executed when a DHCPRELEASE message requesting the release of the IP address is received from the terminal 2. .

  When the gateway apparatus 1a receives the DHCPRELEASE message from the terminal 2 (step S31), the gateway apparatus 1a transmits a virtual NW leave request for requesting the terminal 2 to leave the virtual network to the relay apparatus 3 to which the gateway apparatus 1a is connected (step S31). S32). When the gateway apparatus 1a receives a virtual NW leave response, which is a response to the virtual NW leave request, from the relay apparatus 3 (step S33), the gateway apparatus 1a transmits a group leave request for requesting the terminal 2 to leave the group to the relay apparatus 3. (Step S34). When the gateway device 1a receives a group leave response that is a response to the group leave request from the relay device 3 (step S35), the gateway device 1a deletes the entry of the terminal 2 from the management table (step S36). A DHCPACK message is returned (step S37). The operations of the present embodiment other than those described above are the same as those of the first embodiment.

  As described above, in the present embodiment, when the gateway device 1a includes the pseudo DHCP server unit 15 and receives the DHCPDISCOVER message from the terminal 2, the pseudo DHCP server unit 15 transmits the authentication information for the terminal 2 to the relay device 3. The IP address is issued based on the acquired authentication information, and a request to join the terminal 2 to the virtual network and group is made. Therefore, the same effects as those of the first embodiment can be obtained, and the authentication process of the terminal 2 can be performed without adding software to the existing terminal 2.

Embodiment 3 FIG.
FIG. 13: is a figure which shows the structural example of Embodiment 3 of the gateway apparatus concerning this invention. As shown in FIG. 13, the gateway device 1b of the present embodiment is the same as the gateway device 1a of the second embodiment except that a pseudo DNS server unit 16 is added to the gateway device 1a of the second embodiment. The configuration of the communication system of the present embodiment is the same as that of the first embodiment except that the gateway device 1 is replaced with the gateway device 1b. Components having the same functions as those in the first and second embodiments are denoted by the same reference numerals as those in the first and second embodiments, and description thereof is omitted.

  The pseudo DNS server unit 16 of the present embodiment returns a virtual IP address in response to a name resolution request specifying a user name and a group name from the terminal 2. FIG. 14 is a diagram illustrating an example of a procedure for name resolution processing using the pseudo DNS server unit 16.

  In the virtual network, the domain name has a format including one user name and one group name, such as “(user name). (Group name)”. When the pseudo DNS server unit 16 of the gateway device 1b receives a DNS query that is a name resolution request including the destination user name and group name from the terminal 2 (step S41), the pseudo DNS server unit 16 extracts the user name and group name from the DNS query. Then, it is searched whether there is information in the DNS cache corresponding to the extracted user name and group name (step S42).

  When there is no entry in the DNS cache, the pseudo DNS server unit 16 transmits a search request message for requesting a database search using the extracted user name as a key to the relay device 3 to which the pseudo DNS server unit 16 is connected (step S43). The relay device 3 searches the database using the user name included in the search request message transmitted in step S43 as a key, and returns a database search response message including a terminal identifier corresponding to the user name to the gateway device 1b (step S44). ).

  Further, the pseudo DNS server unit 16 of the gateway device 1b transmits a search request message for requesting a database search using the group name extracted from the DNS query as a key to the relay device 3 to which the gateway device 1b is connected (step S45). The relay device 3 searches the database using the group name included in the search request message transmitted in step S45 as a key, and returns a database search response message including a logical network identifier corresponding to the group name to the gateway device 1b (step). S46).

  Based on the terminal identifier and logical network identifier obtained in steps S44 and S46, a virtual IP address is generated as described in the first embodiment. Then, the correspondence between the user name and group name, the terminal identifier and the logical network identifier, and the generated virtual IP address is held as a DNS cache (step S47), and the DNS response including the generated virtual IP address is returned to the terminal 2 ( Step S48).

  If the information corresponding to the extracted user name and group name is in the DNS cache in step S42, the virtual IP address corresponding to the user name and group name is referred to by referring to the DNS cache without performing steps S43 to S47. DNS response including the virtual IP address is returned to the terminal 2. The operations of the present embodiment other than those described above are the same as those of the second embodiment.

  In this embodiment, the pseudo DNS server unit 16 is added to the gateway device 1a of the second embodiment. However, the pseudo DNS server unit 16 is added to the gateway device 1 of the first embodiment, and this embodiment is performed. You may make it implement the operation | movement described in the form.

  As described above, in the present embodiment, the gateway device 1b includes the pseudo DNS server unit 16, and the pseudo DNS server unit 16 inquires the relay device 3 based on the user name and group name included in the DNS query from the terminal. To obtain a terminal identifier and a logical network identifier. Then, based on the acquired terminal identifier and logical network identifier, a virtual IP address is generated and transmitted to the terminal 2. Therefore, the same effect as in the second embodiment can be obtained without providing a separate DNS server.

  As described above, the communication device, the communication system, and the communication method according to the present invention are useful for a communication system that performs virtual network communication, and are particularly suitable for a communication system including a terminal to which software cannot be added.

1, 1-1 to 1-4, 1a, 1b Gateway device 2-1 to 2-4 Terminal 3-1 to 3-6 Relay device 11, 12 Network interface unit 13 Virtual network control unit 14 Encapsulation processing unit 15 Pseudo DHCP server part 16 Pseudo DNS server part

Claims (8)

A terminal, a communication device connected to the terminal and relaying a communication packet of the terminal, and the terminal connected to the communication device and based on a terminal identifier that is an identifier of the terminal and a logical network identifier that identifies a logical network The communication device in a communication system comprising: a relay device that transfers the communication packet of:
Correspondence holding means for holding a correspondence between a terminal identifier and an address of the terminal connected to itself;
A virtual destination address generated based on a predetermined conversion rule using a destination terminal identifier which is a terminal identifier of the destination terminal and a logical network identifier of a logical network to be used as a destination address from the terminal connected to itself When the received communication packet is received, the destination terminal identifier and the logical network identifier are obtained based on the virtual destination address included in the received communication packet and the predetermined conversion rule, and the source address of the received communication packet And determining the source terminal identifier that is the terminal identifier of the terminal that is the source of the communication packet based on the correspondence and the determined destination terminal identifier, the source identifier, and Encapsulation processing for inserting the logical network identifier is performed, and the encapsulated processing packet is transmitted to the relay device. And processing means,
Based on the correspondence between the destination terminal identifier included in the communication packet received from the relay device and the correspondence, the destination terminal address that is the address of the destination terminal is obtained, and the source identifier, the logical network identifier, and the predetermined conversion rule are obtained. The virtual address obtained based on the above is obtained as a transmission source virtual address, the destination terminal address is stored in the destination address, and the transmission source virtual address is stored in the transmission source address for the communication packet received from the relay device. And decapsulating processing means for deleting a destination terminal identifier, a transmission source identifier and a logical network identifier, performing a decapsulation process, and transmitting a communication packet after the decapsulation process to the terminal connected to itself,
A communication apparatus comprising: The relay device holds authentication information including a physical address and a terminal identifier of the terminal that permits communication using a logical network,
When an address distribution request is received from the terminal connected to itself, an authentication information search request that includes a physical address of a terminal that is the transmission source of the address distribution request and requests a search for the presence or absence of authentication information of the terminal The terminal identifier included in the received authentication information search response is transmitted to the relay device, and when the authentication information search response is received from the relay device, including the terminal identifier of the terminal and notifying that the authentication information of the terminal exists. A pseudo DHCP server means for generating an address based on the address and distributing the generated address to the terminal of the transmission source of the address distribution request;
The communication apparatus according to claim 1, further comprising: The relay device performs a predetermined participation process for causing the terminal to participate in communication using a logical network,
The pseudo DHCP server means transmits to the relay device a participation request requesting that the predetermined participation processing be performed with respect to a terminal that is a transmission source of the address distribution request, and the relay device is normal with respect to the participation request. When the participation response which is a response indicating that the predetermined participation processing has been performed is received, the generated address is distributed to the terminal that is the transmission source of the address distribution request.
The communication device according to claim 2. When the pseudo DHCP server means receives the participation response, the pseudo DHCP server means holds the correspondence between the physical address of the terminal that has transmitted the address distribution request and the terminal identifier as authenticated terminal information, and further receives the address distribution request. Then, when the physical address of the terminal of the address distribution request is not included in the authenticated terminal information, a participation request regarding the terminal is transmitted, and the physical address of the terminal of the source of the address distribution request is If it is included in the authenticated terminal information, distribute the generated address to the source terminal of the address distribution request without transmitting a participation request for the terminal,
The communication apparatus according to claim 3. When a name resolution request including a destination name is received from the terminal connected to itself, a terminal identifier and a logical network identifier are obtained based on the name, and a virtual address is generated based on the terminal identifier and the logical network identifier. Pseudo DNS means for sending the generated virtual address in the name resolution response,
The communication apparatus according to claim 1, further comprising: The name includes a user name of a user who uses the terminal and a group name indicating a logical network to be used.
The relay device holds the correspondence between the user name and the terminal identifier as user name information, and holds the correspondence between the group name and the logical network identifier as group name information.
The pseudo DNS means obtains the user name and group name based on a name included in the received name resolution request, and obtains a terminal identifier corresponding to the user name and a logical network identifier corresponding to the group name, The terminal identifier and logical network identifier are obtained by making an inquiry to the relay device, the correspondence between the obtained terminal identifier and logical network identifier and the name is held as name resolution information, and when a name resolution request is received, the name When the name included in the resolution request exists in the name resolution information, the terminal identifier and the logical network identifier are obtained based on the name resolution information.
The communication apparatus according to claim 5. A communication device according to any one of claims 1 to 6;
A terminal connected to the communication device;
A relay device that connects to the communication device and transfers a communication packet of the terminal based on a terminal identifier that is an identifier of the terminal and a logical network identifier that identifies a logical network;
A communication system comprising: A terminal, a communication device connected to the terminal and relaying a communication packet of the terminal, and the terminal connected to the communication device and based on a terminal identifier that is an identifier of the terminal and a logical network identifier that identifies a logical network A communication method in a communication system comprising a relay device that transfers a communication packet of
A correspondence holding step for holding a correspondence between a terminal identifier and an address of the terminal connected to the communication device;
The terminal uses a destination terminal identifier that is a terminal identifier of the destination terminal and a logical network identifier of a logical network to be used, and a communication packet that uses a virtual destination address generated based on a predetermined conversion rule as a destination address. A terminal transmission step for transmission;
When the communication device receives the communication packet transmitted in the terminal transmission step, the destination terminal identifier and the logical network identifier are determined based on the virtual destination address included in the received communication packet and the predetermined conversion rule. Further, based on the transmission source address of the received communication packet and the correspondence, a transmission source terminal identifier that is a terminal identifier of the transmission source terminal of the communication packet is obtained, and a predetermined position of the received communication packet is obtained. Performing an encapsulation process to insert the obtained destination terminal identifier, the transmission source identifier and the logical network identifier, and transmitting a communication packet after the encapsulation process to the relay device;
The communication device obtains a destination terminal address which is an address of the destination terminal based on the destination terminal identifier included in the communication packet received from the relay device and the correspondence, and the source identifier, the logical network identifier, and the predetermined identifier A virtual address obtained based on the conversion rule of the above is obtained as a source virtual address, and for the communication packet received from the relay device, the destination terminal address is stored in the destination address, and the source in the source address A decapsulation process step of storing a virtual address and deleting a destination terminal identifier, a transmission source identifier, and a logical network identifier, performing a decapsulation process, and transmitting a communication packet after the decapsulation process to the terminal connected to itself;
A communication method comprising:

Images