WO2015068255A1

WO2015068255A1 - Network system, communication control device, and communication method

Info

Publication number: WO2015068255A1
Application number: PCT/JP2013/080211
Authority: WO
Inventors: 雅毅山田; 芽衣高田; 雄次對馬
Original assignee: 株式会社日立製作所
Priority date: 2013-11-08
Filing date: 2013-11-08
Publication date: 2015-05-14
Also published as: JPWO2015068255A1

Abstract

[Problem] To enable the use of a cloud service under a common information platform spanning a plurality of user sites, while ensuring security. [Solution] When a user-side second NAT device (312) of a user-side network (52) receives, from a user device (30), a request packet for an information processing service via the user-side network (52), the transmission source address represented by the private address of the user-side network (52) in the header of the request packet is converted to a transmission source address represented by the private address of a cloud-side network (51) in accordance with preset conversion rules. A user-side VPN device (311) transmits the converted request packet to a cloud-side VPN device (21) by means of VPN communication via the internet (5). The cloud-side VPN device (21) decapsulates received VPN packets to acquire request packets, and transmits the VPN packets to a user device (20) via the cloud-side network (51).

Description

Network system, communication control apparatus, and communication method

The present invention relates to a network system, a communication control device, and a communication method.

In Patent Document 1, an apparatus for routing a packet from a gateway to an endpoint communicates with an addressing element that associates a private address with an endpoint having a public IP address, and the endpoint's A receiver that intercepts a packet that is to be sent to a private address, and a policy that communicates with the receiver and receives the packet and transmits the packet to the endpoint in response to a policy applied to the packet Communicating with an engine, the receiver, the policy engine, and the addressing element, performing network address translation on the packet, and sending the packet to the endpoint is described.

JP 2007-215201 A

The use of cloud computing services (hereinafter referred to as cloud services) is progressing for the purpose of reducing initial introduction costs, realizing cooperation between sites, and realizing fault switching in virtualization. With regard to the use of cloud services, individual user sites that want to use the cloud services under a common information infrastructure across multiple user sites while ensuring security, and want to use information from a bird's-eye view as a whole user site There is a need to provide services for managers by integrating information between them.

As a method for meeting such needs, for example, as shown in FIG. 10, a cloud service provider side network (hereinafter referred to as cloud side NW 51) in the cloud site 2 such as a data center, and the user site 3 are used. It is conceivable that a user side network (hereinafter referred to as a user side NW52) existing in the network is connected by VPN (VPN: [Virtual: Private] Network).

However, in the user side NW 52 in each user site 3, an existing network using a private address is often operated, and if the sites are connected by VPN, the private addresses may be duplicated between the user sites 3. There is sex. In order to avoid duplication, it is conceivable to change the private address system in the user site 3, but changing the private address system has a large effect on the existing system. There is also a risk that the impact will spread beyond the three barriers.

The present invention has been made based on such a background. A network system capable of using a cloud service under a common information infrastructure across a plurality of user sites while ensuring security, and communication. It is an object to provide a control device and a communication method.

One of the present invention that solves the above problems is a server device connected to a provider network that is a communication network of a provider site that provides an information processing service, and a communicable connection to the provider network via the Internet A user device that connects to a user side network that is a communication network of a user site that uses the information processing service, accesses the server device and uses the information processing service, and a provider side that connects to the provider network A VPN apparatus, a user-side VPN apparatus that connects to the user-side network and realizes VPN communication with the providing-side VPN apparatus via the Internet, and a user-side second address translation apparatus that connects to the user-side network; The user-side second address translation device comprises: When receiving a request packet, which is a packet for requesting use of the information processing service, from the user device to the server device via the user-side network, the request packet includes the request packet according to a preset conversion rule. The source address described in the private address of the user side network set in the header used for communication in the user side network is converted into the source address expressed in the private address of the provider side network, and the user The side VPN device transmits a VPN packet encapsulating the converted request packet to the providing side VPN device via the Internet via the VPN communication, and the providing side VPN device transmits the VPN packet. The VPN packet Decapsulates the preparative acquires the request packet, transmitting the request packet acquired, to the server apparatus via the providing-side network.

Other problems and solutions disclosed in the present application will be clarified in the column of the embodiment of the invention and the drawings.

According to the present invention, it is possible to use a cloud service under a common information infrastructure across a plurality of user sites while ensuring security.

1 is a diagram illustrating a schematic configuration of a network system 1. FIG. 6 is a diagram illustrating a flow of a request packet until a request packet transmitted from a user device 30 is received by the server device 20. FIG. FIG. 10 is a diagram for explaining a flow of response packets until a response packet transmitted from the server device 20 is received by the user device 30. 4 is an example of a conversion table 400. It is a figure which shows the main function of the user side GW apparatus 31, and the main information which the user side GW apparatus 31 memorize | stores. It is an example of VPN control information 362. It is an example of VPN destination information 363. It is a flowchart explaining the process which the user side GW apparatus 31 performs when a packet arrives at the input / output port A351. It is a flowchart explaining the process which the user side GW apparatus 31 performs when a packet arrives at the input / output port B352. It is an example of the network system which provides a cloud service.

Hereinafter, examples will be described with reference to the drawings.

FIG. 1 shows a schematic configuration of a network system 1 (information processing system) described as an embodiment. As shown in the figure, the network system 1 is installed in a cloud site 2 (providing site) such as a data center in order to provide a cloud computing service (hereinafter also referred to as “cloud service”) as an information processing service. Device groups (information processing devices, communication network devices, etc.) and device groups (information processing devices, communication network devices, etc.) installed in each of a plurality of user sites 3 using the cloud service via the Internet 5 including. The cloud service is, for example, an ASP service (Application Service Provider Service), SaaS (Software as a Service), PaaS (Platform as a Service), or the like.

The cloud site 2 includes a server device 20 that realizes a cloud service, a cloud side VPN device 21 (providing side VPN device), and a cloud side NAT device 22 (providing side address translation device). The server device 20 is an information processing device (computer) including a central processing unit (CPU, MPU), a storage device (memory (ROM, RAM, etc.), a hard disk drive, an SSD (Solid State Drive), etc.), and a communication device. is there. In the server device 20, for example, an operating system, software that provides a virtualization platform, and various applications (DBMS (Data Base Management System), various Web services, etc.) operate.

The cloud site 2 has a network on the provider side of the cloud service (provider network) (hereinafter also referred to as “cloud side NW 51”), to which the server device 20 and the cloud side VPN device 21 are connected. The cloud-side NW 51 is, for example, a LAN (Local Area Network), a WAN (Wide Area Network), or the like, and can perform communication conforming to TCP / IP.

The server device 20 sends a packet requesting the use of a cloud service (hereinafter also referred to as “request packet”) sent from the user device 30 via a user-side NW 52, the Internet 5, and the cloud-side NW 51, which will be described later. ) Is executed, the cloud service specified in the request packet is executed, a packet including the execution result and processing completion notification (hereinafter also referred to as “response packet”) is generated, and the request packet is generated. To the user device 30 that is the source of the transmission.

The cloud side VPN apparatus 21 realizes VPN communication (VPN: “Virtual” Private ”Network) via the Internet 5. The cloud-side VPN apparatus 21 adds authentication information, encrypts, and encapsulates the packet to be transmitted to the Internet 5 (hereinafter, this series of processing is also referred to as “VPN encapsulation”). The cloud-side VPN apparatus 21 performs decapsulation, decryption, and authentication processing (hereinafter, this series of processing is also referred to as “VPN decapsulation”) for the packet received from the Internet 5.

The cloud side NAT device 22 (NAT: Network Address Translation) is connected to the Internet 5 and connected to the cloud side VPN device 21 so as to be communicable, and functions as a relay device for connecting the cloud side NW 51 and the Internet 5. The cloud-side NAT device 22 performs mutual conversion between a global IP address in the Internet 5 and a private address (also referred to as “local address”) in the cloud-side NW 51 for packets transmitted and received via the Internet 5. That is, the cloud side NAT device 22 converts the global IP address set in the packet received from the Internet 5 into the private address of the cloud side NW 51. In addition, the cloud side NAT device 22 converts the private address of the cloud side NW 51 set in the packet received from the cloud side VPN device 21 into a global IP address.

The cloud-side VPN device 21 and the cloud-side NAT device 22 may be realized as the same hardware. For example, they can be replaced with a gateway device having both functions. In addition, a plurality of cloud side VPN devices 21 and cloud side NAT devices 22 may be provided for the purpose of load distribution and ensuring availability. In the following description, the term “NAT” includes the meaning of so-called “NAPT” (NAPT (Network Address Port Translation)) that converts the port number in addition to the IP address.

The user site 3 has a network on the user side of the cloud service (hereinafter also referred to as “user side NW 52”), and the user device 30 and the gateway device (hereinafter referred to as “user side GW device”) using the cloud service. 31 ”) and the user side first NAT device 32 (user side first address translation device) are connected. The user side NW 52 is, for example, a LAN, a WAN, or the like, and can perform communication complying with TCP / IP.

The user device 30 is an information processing device (computer) including a central processing unit (CPU, MPU), a storage device (memory (ROM, RAM, etc.), hard disk drive, SSD, etc.), and a communication device. In the user device 30, an operating system and an application (a client application for using the cloud service, a Web browser, etc.) operate to provide the user of the user device 30 with a cloud service usage environment. When using the cloud service, the user device 30 transmits a request packet to the user side GW device 31 and receives a response packet from the user side GW device 31.

The user side GW apparatus 31 includes a user side VPN apparatus 311 and a user side second NAT apparatus 312 (user side second address translation apparatus). Note that the user-side VPN device 311 and the user-side second NAT device 312 may be realized as a plurality of independent hardware connected so as to be communicable, or may be realized by common hardware.

The user-side VPN device 311 realizes VPN communication via the cloud-side VPN device 21 and the Internet 5. The user-side VPN device 311 performs VPN encapsulation on the request packet transmitted to the Internet 5 and performs VPN encapsulation release on the response packet received from the Internet 5.

The user-side second NAT device 312 is set in a header used for communication of the user-side NW 52 of a request packet transmitted from the user device 30 to the server device 20 in accordance with a conversion rule that is set and stored in advance. The transmission source address and the transmission destination address expressed by the private address are converted into the transmission source address and the transmission destination address expressed by the private address in the cloud side NW 51. The second NAT device 312 on the user side sets the source address and the destination address described in the private address in the cloud side NW 51, which are set in the header of the response packet sent from the server device 20, in the user side NW 52. It is converted into a source address and a destination address expressed as private addresses.

As described above, in the network system 1 according to the present embodiment, the user-side second NAT device 312 transmits the source address represented by the private address in the cloud-side NW 51 in the request packet transmitted from the user device 30 to the server device 20. Since the destination address is set, the cloud side NW 51 can make the request packet appear to the server device 20 as if it was sent from the information processing apparatus connected to the cloud side NW 51. When there are a plurality of user-side NWs 52, the request packet transmitted from the user device 30 connected to each user-side NW 52 is transmitted with a private address in the cloud-side NW 51 so as not to overlap between the user devices 30 Since the original address is set, different user-side NWs 52 can use a common cloud service. For this reason, for example, it becomes possible to use a cloud service under a common information infrastructure across multiple user sites, and it is intended for managers to integrate information between user sites 3 to use information from a bird's-eye view. It is possible to meet the needs of providing services. In addition, by sharing the information distributed in the plurality of user sites 3, it becomes possible to provide various services based on the aggregated information.

Also, the user-side second NAT device 312 is installed at each user site 3 by a cloud service provider, for example, and the conversion rules are set by the cloud service provider. For this reason, the service operated at the user site 3 can be easily and inexpensively transferred to the cloud service without forcing the user device 30 or the user-side first NAT device 32 to introduce new software or change settings. be able to.

The user-side first NAT device 32 shown in FIG. 1 functions as a relay device that connects the user-side NW 52 and the Internet 5. The user-side first NAT device 32 performs mutual conversion between a global IP address of the Internet 5 and a private address of the user-side NW 52 for a packet transmitted / received via the Internet 5. The user-side first NAT device 32 may exist on the Internet provider side, for example.

In the user-side NW 52, the user-side GW device 31 and the user device 30 have an equal relationship. That is, the user-side first NAT device 32 performs the above-described mutual conversion without distinguishing whether the other party that transmits and receives a packet is the user-side GW device 31 or the user device 30. This means that if there is an existing NAT device that relays between the Internet 5 and the user site 3 at the user site 3, that NAT device can be used as the first NAT device 32 on the user side. If it is not necessary for the user site 3 to provide the function of the user-side first NAT device 32 to other than the cloud service user, the user-side first NAT device 32 is not connected to the user-side NW 52. 32 may be directly connected to the user-side GW apparatus 31.

Next, the flow of packets (request packets and response packets) will be described. In the following description, the source IP address, the destination IP address, the source port number, and the destination port number set in the header of the packet are referred to as “SIP”, “DIP”, “ Also referred to as “Sport” and “Dport”. The contents of the header of the packet described below can be acquired, for example, by connecting a network analyzer (Network Analyzer) to the key points of the cloud side NW 51, the Internet 5, and the user side NW 52 and performing packet analysis. .

In this embodiment, a case where the network address used in the cloud side NW 51, the Internet 5, and the user side NW 52 is IPv4 (Internet Protocol version 4) will be described as an example. However, the communication method (type of communication protocol) is The network system 1 of the present embodiment is not limited to this, but is an IPv6 (Internet Protocol version 6) -compliant address, MAC address (Media Access Control Address), MPLS (Multi-Protocol Label Labeling) label, etc. The present invention can also be applied to cases where other types of address systems are used as network addresses.

First, the flow of a request packet until the request packet transmitted from the user device 30 is received by the server device 20 will be described with reference to FIG. As shown in the figure, in this example, the user apparatus 30 requests that “SIP: 192.168.0.10”, “DIP: 192.168.0.129”, “Sport: 10000”, “Dport: 1500” are set in the header. It is assumed that the packet 101 is transmitted to the second NAT device 312 on the user side. Here, “SIP: 192.168.0.10” is a private address assigned to the user device 30 in the user-side NW 52, and “DIP: 192.168.0.129” is assigned to the user-side second NAT device 312 in the user-side NW 52. Is a private address. In this way, when using the cloud service provided by the server device 20, the user device 30 transmits a request packet in which the private address of the user-side second NAT device 312 is set as a header (S111). When transmitting a packet unrelated to the cloud service to the Internet 5, the user device 30 sets the private address “DIP: 192.168.0.1” of the user-side first NAT device 32 in the header of the packet and sends it to the user NW 52. Send.

“Sport: 10000” set in the header of the request packet is a value arbitrarily selected by the user device 30 (a value other than the well-known port is selected). It is given by the application for using the operating cloud service. “Dport: 1500” is a port number corresponding to the cloud service that the request packet 101 requests to use. As described above, the user device 30 (an application operating on the user device 30) can specify a cloud service to be used from among a plurality of cloud services provided.

Subsequently, according to the conversion rule, the user-side second NAT device 312 converts the combination of the private address and port number in the user-side NW 52 specified in the header of the request packet 101 received from the user device 30 to the private address and port in the cloud-side NW 51. Conversion into a combination of numbers (S112). In this example, according to the conversion rule, the user-side second NAT device 312 sets “SIP: 192.168.0.10” to “SIP: 10.0.0.20”, which is a private address in the cloud-side NW51, and “DIP: 192.168.0.129” to the cloud. The private address of the server device 20 on the side NW 51 is converted to “DIP: 10.0.0.10”, “Sport: 10000” to “Sport: 20000”, and “Dport: 1500” to “Dport: 1024”, respectively. .

Here, “Sport: 20000” set in the header of the request packet 102 is a port number uniquely assigned to the combination of “SIP: 192.168.0.10” and “Sport: 10000” of the packet 101 transmitted by the user device 30. It is. The second NAT device 312 on the user side stores in the conversion table 400 the correspondence between the combination of “SIP: 192.168.0.10” and “Sport: 10000” and “Sport: 20000”. When the user side second NAT device 312 receives the response packet to the request packet, based on the port number “Sport: 20000”, the user side second NAT device 312 receives “SIP: 192.168.0.10” and “Sport” of the user device 30 that transmitted the request packet. : 10000 "is specified, and a response packet is transmitted to the corresponding user device 30.

“Dport: 1024” is a port number corresponding to the cloud service to be used, and is a port number for the server device 20 to identify the cloud service. Thus, “Dport: 1500” designated by the user device 30 is automatically converted into a port number for the server device 20 to identify the cloud service in accordance with the conversion rule. This means that, for example, if the port number system on the server device 20 side is changed, it is only necessary to update the conversion rule, and the cloud service port number system is not affected. Can be changed.

The user-side VPN apparatus 311 VPN-encapsulates the request packet 102 converted by the user-side second NAT apparatus 312 and transmits it to the user-side first NAT apparatus 32 via the user-side NW 52 (S113). As shown in the figure, in this example, the user side VPN apparatus 311 includes “SIP: 192.168.0.130”, “DIP: 210.0.” In the header of the request packet 103 encapsulated in VPN (hereinafter referred to as a VPN header). “0.100”, “Sport: 25000”, and “Dport: 1194” are set.

Here, “SIP: 192.168.0.130” is a private address assigned to the user-side VPN apparatus 311 in the user-side NW 52. “DIP: 210.0.0.100” is a global IP address on the Internet 5 assigned to the cloud side NAT device 22. “Sport: 25000” is a port number arbitrarily given by the user-side VPN apparatus 311. This “Sport: 25000” is used when, for example, a plurality of user-side VPN devices 311 are provided in the same user site 3 for the purpose of load distribution, ensuring availability, and the like. Used as an identifying identifier. “Dport: 1194” is a well-known port assigned to the VPN service.

The first NAT device 32 on the user side transmits the request packet encapsulated in VPN by the user side VPN device 311 to the cloud side NAT device 22 via the Internet 5 (S114). As shown in the figure, in this example, the first NAT device 32 on the user side includes “SIP: 96.50.0.20”, “DIP: 210.0.0.100”, “Sport: 40000” in the header of the request packet 104 transmitted to the Internet 5. "," Dport: 1194 "is set. Here, “SIP: 96.50.0.20” is the global IP address assigned to the first NAT device 32 on the user side on the Internet 5 (if the cloud side VPN device 21 is directly connected to the Internet 5, the cloud side VPN It may be the global IP address of the device 21). In “Sport: 40000”, a value arbitrarily selected by the user-side first NAT device 32 (a value other than the well-known port is selected) is set. The first NAT device 32 on the user side stores the correspondence between the combination of “SIP: 10.0.0.130” and “Sport: 25000” of the request packet 103 and the assigned “Sport: 40000”. For example, the user-side first NAT device 32 uses this correspondence when a response packet to the request packet 104 is received.

When the cloud side NAT device 22 receives the request packet 104 via the Internet 5, the cloud side NAT device 22 converts the global IP address set in the request packet 104 into the private address of the cloud side NW 51, and converts the converted request packet 105 into the cloud It transmits to the cloud side VPN apparatus 21 via the side NW 51 (S115). In this example, the cloud side NAT device 22 sends the global IP address “SIP: 96.50.0.20” set in the header of the request packet 104 received via the Internet 5 to the cloud side NAT device 22 in the cloud side NW 51. It is converted to "SIP: 10.0.0.15" which is the private address that has been set. Also, “DIP: 210.0.0.100” is converted to “DIP: 10.0.0.130” set in the cloud side VPN device 21 in the cloud side NW 51.

When the cloud side VPN device 21 receives the request packet 105 from the cloud side NAT device 22, the cloud side VPN device 21 performs VPN decapsulation on the request packet 105, and transmits the request packet 106 after the VPN encapsulation is released to the server device 20 via the cloud side NW 51. (S116). As shown in the figure, “SIP: 10.0.0.20”, “SIP: 10.0.0.10”, “Sport: 20000” in the header of the request packet 106 transmitted from the cloud side VPN device 21 to the server device 20, and “Dport: 1024” is the same as the header of the request packet 102 generated by the user-side second NAT device 312 previously.

Subsequently, the flow until the user device 30 receives the response packet transmitted from the server device 20 together with FIG. 3 will be described. As shown in FIG. 2, when the server apparatus 20 executes the cloud service for the request packet 106 shown in FIG. 2, a response packet in which the header transmission / reception relationship of the request packet 106 is inverted as its response packet That is, the response packet 201 in which “SIP: 10.0.0.10”, “DIP: 10.0.0.20”, “Sport: 1024”, and “Dport: 20000” are set in its header is transmitted to the cloud side VPN apparatus 21 (S211). ). Note that the server device 20 uses, for example, the physical address (for example, MAC address) set in the request packet 106 in the L2 layer (the data link layer (second layer) of the OSI (Open Systems Interconnection) reference model) on the cloud side. By inquiring at least one of the NW 51, the Internet 5, and the user-side NW 52, the user site 3 (user-side NW 52) where the user-side second NAT device 312 serving as the destination of the response packet 201 exists is specified. Further, for example, when the cloud side VPN device 21 or the cloud side NAT device 22 stores the routing information, the server device 20 uses the cloud side VPN in the L3 layer (network layer (third layer) of the OSI reference model). By inquiring of the device 21, the user site 3 (user side NW 52) where the user side second NAT device 312 serving as the destination of the response packet exists is specified.

Upon receiving the response packet 201, the cloud side VPN device 21 VPN-encapsulates the response packet 201, and transmits the response packet 202 after the VPN encapsulation to the cloud side NAT device 22 (S212). As shown in the figure, in this example, “SIP: 10.0.0.130”, “DIP: 10.0.0.15”, “Sport: 1194”, and “Dport: 30000” are set in the VPN header. Here, “SIP: 10.0.0.130” is a private address assigned to the cloud side VPN device 21 in the cloud side NW 51, and “DIP: 10.0.0.15” is assigned to the cloud side NAT device 22 in the cloud side NW 51. Private address. “Sport: 1194” is a well-known port assigned to the VPN service. “Dport: 30000” is a port number arbitrarily given by the cloud side VPN apparatus 21. This port number is, for example, an identifier that identifies each cloud-side VPN device 21 when a plurality of cloud-side VPN devices 21 are provided in the same cloud site 2 for the purpose of load distribution, ensuring availability, etc. Used as

The cloud side NAT device 22 transmits the response packet 202 encapsulated by the cloud side VPN device 21 to the user side first NAT device 32 via the Internet 5 (S213). As shown in the figure, in this example, the cloud side NAT device 22 includes “SIP: 210.0.0.100”, “DIP: 96.50.0.20”, “Sport: 1194” in the header of the response packet 203 transmitted to the Internet 5. "," Dport: 40000 "is set. Here, “SIP: 210.0.0.100” is a global IP address assigned to the cloud side NAT device 22 on the Internet 5. “DIP: 96.50.0.20” is a global IP address assigned to the first NAT device 32 on the user side on the Internet 5. “Sport: 1194” is a well-known port assigned to the VPN service. “Dport: 40000” is a value set by the first NAT device 32 on the user side when the request packet 104 is transmitted.

When the user side first NAT device 32 receives the response packet 203 via the Internet 5, the user side first NAT device 32 converts the global IP address set in the response packet 203 into the private address of the user side NW 52, and converts the converted response packet 204 into It transmits to the user side VPN apparatus 311 via the user side NW52 (S214). In this example, the first NAT device 32 on the user side sets “SIP: 192.168.0.1”, “DIP: 10.0.0.130”, “Sport: 1194”, “Dport: 25000” in the header of the response packet 204. Yes. Here, “SIP: 192.168.0.1” is a private address assigned to the user-side first NAT device 32 in the user-side NW 52. “DIP: 10.0.0.130” is a private address assigned to the user-side VPN apparatus 311 in the user-side NW 52. “Sport: 1194” is a well-known port assigned to the VPN service. “Dport: 25000” is set based on the content stored in the first NAT device 32 at the time of transmission of the request packet 104. As described above, the user-side first NAT device 32 stores the correspondence between the combination of “SIP: 10.0.0.130” and “Sport: 25000” of the request packet 103 and “Sport: 40000” assigned to the request packet 104. The first NAT device 32 on the user side obtains a combination of “SIP: 10.0.0.130” and “Sport: 25000” based on “Dport: 40000” of the response packet 203.

The user-side VPN apparatus 311 cancels the VPN encapsulation of the response packet 204 received by the user-side first NAT apparatus 32, and transmits the response packet 205 after the VPN encapsulation cancellation to the user-side second NAT apparatus 312 (S215).

Upon receiving the response packet 205, the user-side second NAT device 312 receives the combination of “SIP: 192.168.0.10” and “Sport: 10000” stored when converting the request packet 101 into the request packet 102, and “Sport: 20000”. 2 and the conversion rule, the reverse conversion to S112 in FIG. 2 is performed to convert the header of the response packet 205, and the converted response packet 206 is transmitted to the user apparatus 30 (S216). As shown in the figure, the second NAT device 312 on the user side sends a response packet 206 in which “SIP: 192.168.0.129”, “DIP: 192.168.0.10”, “Dport: 1500”, and “Sport: 10000” are set in the header. This is generated and transmitted to the user device 30.

FIG. 4 is an example of the conversion table 400 stored in the user-side GW apparatus 31. Note that the above-described conversion rule includes an algorithm or a table set so as to generate the result of the conversion table 400. The user-side second NAT device 312 (user-side GW device 31) cloud the combination of the private address and port number in the user-side NW 52 specified in the header of the new request packet received from the user device 30 according to the conversion rule. When converted into a combination of a private address and a port number in the side NW 51, the result is stored in the conversion table 400.

Each record of the conversion table 400 includes a user-side IP address 411 that is a private address in the user-side NW 52 of the user device 30 that has transmitted the received request packet, and a cloud-side IP address that is a private address used by the cloud-side NW 51 for the request packet. 412 includes a user-side port number 413 that is a port number set in the received request packet, and a cloud-side port number 414 that is a port number used by the cloud-side NW 51 for the request packet. The cloud-side port number 414 corresponds to the type of cloud service, and different user-side port numbers 413 are associated with different cloud-side port numbers 414.

The conversion rule is set to give a unique cloud-side IP address 412 for each user device 30. Thereby, the uniqueness (uniqueness) of the request packet is ensured in the cloud side NW 51, and the user devices 30 belonging to different user side NWs 52 can simultaneously access the same cloud service. The conversion rule may be set so that the same cloud-side IP address 412 is associated with different user-side IP addresses 411 (in the conversion table 400 of FIG. 4, a plurality of user-side IP addresses 411 “192.168. 0.10 ”and“ 192.168.0.11 ”are converted to the same cloud-side IP address 412“ 10.0.0.20 ”).

FIG. 5 shows main functions of the user-side GW apparatus 31 and main information (data, table) stored in the user-side GW apparatus 31. In the figure, the two devices of the user-side VPN device 311 and the user-side second NAT device 312 provided in the user-side GW device 31 are not distinguished. The information (conversion rules 361 (corresponding to the conversion rules described above), VPN control information 362, and VPN destination information 363. These are also collectively referred to as packet control information hereinafter) shown in FIG. And at least one of the user-side second NAT devices 312 is stored.

The user side GW apparatus 31 provides an interface for maintaining packet control information. The packet control information can be set, for example, via a user interface (for example, an input device (keyboard, mouse, etc.), a display device (liquid crystal monitor, etc.)) provided in the user side GW device 31. The packet control information is transmitted to the user-side NW 52 by sending an update instruction (for example, an information update packet described later) from the information processing device (maintenance terminal or the like) connected to the cloud-side NW 51 to the user-side GW device 31, for example. This can be set by transmitting an update instruction (for example, an information update packet to be described later) from the information processing apparatus (management terminal or the like) to be connected to the user side GW apparatus 31. The information processing apparatus (such as a maintenance terminal) connected to the user side GW apparatus 31, the cloud side NW 51, and the information processing apparatus (such as a management terminal) connected to the user side NW 52 have, for example, a screen for accepting setting of packet control information. While displaying on a display device (liquid crystal display or the like), the setting contents of packet control information and an update instruction are accepted.

As shown in the figure, the user-side GW apparatus 31 includes an input / output port A351 and an input / output port B352. These are all communication ports provided in the user-side GW device 31 (for example, communication ports provided in a NIC (Network Interface Card)). A packet transmitted from the user device 30 arrives at the input / output port A351, and a packet addressed to the user device 30 is transmitted. A packet transmitted from the server device 20 arrives at the input / output port B352, and a packet addressed to the server device 20 is transmitted. The private address (for example, “192.168.0.129” in FIG. 2 or FIG. 3) of the user-side second NAT device 312 is given to the input / output port A351. Further, the private address (for example, “192.168.0.130” in FIG. 2 or FIG. 3) of the user-side VPN device 311 is given to the input / output port B352. In this embodiment, the case where the user-side GW apparatus 312 is connected to the user-side NW 52 through two communication ports will be described. However, the user-side GW apparatus 312 is connected to the user-side NW 52 and only one communication port. Even when connected with 3 or more communication ports, it is equivalent to the function described in the present embodiment in the user side GW device 31 by appropriately converting the network address and port number. It can have the function of.

The packet determination unit 353 shown in the figure is whether the packet arriving at the input / output port A351 is a request packet or a packet for updating packet control information (hereinafter referred to as an information update packet). Determine. When the packet received at the input / output port A 351 is a request packet, the packet determination unit 353 transmits the request packet to the NAT conversion unit 354. When the packet is an information update packet, the packet determination unit 353 sends the request packet to the information update processing unit 356 shown in FIG. The information update packet is transmitted. The packet determination unit 353 determines whether the packet received at the input / output port B 352 is a response packet or an information update packet. If it is a response packet, the packet determination unit 353 transmits the response packet to the NAT conversion unit 354 shown in the figure. If it is an information update packet, the packet determination unit 353 transmits the information update packet to the information update processing unit 356. The transmission of the information update packet from the cloud site 2 to the user side GW apparatus 31 may be performed by the above-described VPN communication or may be performed using another authentication method. Alternatively, a dedicated physical line connecting the cloud site 2 and the user site 3 may be prepared so that the information update packet may be transmitted from the cloud site 2 to the user side GW device 31.

Upon receiving the information update packet from the packet determination unit 353, the information update processing unit 356 updates the packet control information (at least one of the conversion rule 361, the VPN control information 362, and the VPN destination information 363) according to the content. . The information update packet received at the input / output port A351 is, for example, transmitted from an information processing apparatus (maintenance terminal or the like) connected to the user side NW52, and the information update packet received at the input / output port B352 is The information is transmitted from the information processing apparatus (management terminal or the like) of the cloud site 2 via the Internet 5.

The NAT conversion unit 354 sets the combination of the private address and port number in the user-side NW 52 that is set in the request packet sent from the packet determination unit 353 according to the conversion rule 361, and the private address and port number in the cloud-side NW 51. Convert to a combination of In addition, the NAT conversion unit 354 converts the combination of the private address and port number in the cloud side NW 51 set in the response packet sent from the server device 20 according to the conversion rule 361 into the private address and port number in the user side NW 52. Convert to a combination. As described above, the NAT conversion unit 354 records the conversion content (result) in the conversion table 400. The NAT conversion unit 354 transmits the converted request packet to the VPN processing unit 355, and transmits the converted response packet to the input / output port A351.

The VPN processing unit 355 searches the VPN control information 362 using “SIP” before conversion by the NAT conversion unit 354, which is set in the header of the request packet received from the NAT conversion unit 354, as a key. The control method (priority 612, VPN method 613) is acquired. Note that the “SIP” of the request packet before conversion is notified from the NAT conversion unit 354 to the VPN processing unit 355 at any time, for example. Further, the VPN processing unit 355 searches for the cloud site side port number 711 of the VPN destination information 363 using “Sport” set in the header of the request packet converted by the NAT conversion unit 354 as a key, and thereby the cloud site side The global IP address 712 is acquired. The VPN processing unit 355 encapsulates the request packet in accordance with the acquired control method, sets the acquired global IP address in the header “DIP” of the VPN-encapsulated request packet, and sets it from the input / output port B352. Send. On the other hand, the VPN processing unit 355 cancels the VPN encapsulation of the response packet received at the input / output port B 352 and transmits the response packet after the VPN encapsulation cancellation to the packet determination unit 353.

FIG. 6 shows an example of the VPN control information 362 stored in the user side GW apparatus 31. As shown in the figure, the VPN control information 362 is composed of a plurality of records including items of the user side IP address 611, the priority 612, and the VPN method 613. The priority 612 and the VPN method 613 are merely examples of parameters for controlling QoS (Quality of Service) at the time of VPN encapsulation, and the types of parameters for determining the control method of VPN encapsulation are limited to this. Absent.

FIG. 7 shows an example of the VPN destination information 363 stored in the user-side GW apparatus 31. As shown in the figure, the VPN destination information 363 includes a plurality of records including items of a cloud site side port number 711 and a cloud site side global IP address 712. In the cloud site side port number 711, a port number used by the server device 20 to identify the cloud service is set. The global IP address of the cloud-side NAT device 22 (when the cloud-side VPN device 21 is connected to the Internet 5, the global IP address of the cloud-side VPN device 21) is set in the cloud site-side global IP address 712. The The plurality of cloud site-side global IP addresses 712 exist because, for example, a plurality of cloud sites 2 and cloud-side NAT devices 22 are provided for the purpose of load distribution and ensuring availability. Further, there may be a case where a plurality of global IP addresses are virtually assigned to the cloud side VPN apparatus 21 or a case where a plurality of VLANs are constructed. The cloud site-side global IP address 712 may change dynamically.

Next, processing of the user side GW apparatus 31 will be described. FIG. 8 is a flowchart for explaining processing performed by the user side GW apparatus 31 when a packet arrives at the input / output port A351 of the user side GW apparatus 31.

When a packet arrives at the input / output port A351 (S811: Y), the packet determination unit 353 determines whether the received packet is an information update packet or a request packet (S812). When the incoming packet is an information update packet (S812: information update packet), the packet determination unit 353 transmits the information update packet to the information update processing unit 356 (S813). When the incoming packet is a request packet (S812: request packet), the packet determination unit 353 transmits the request packet to the NAT conversion unit 354 (S821).

When the information update processing unit 356 receives the information update packet from the packet determination unit 353, the packet update information (at least one of the conversion rule 361, the VPN control information 362, and the VPN destination information 363) according to the content of the information update packet. Is updated (S814). Thereafter, the process returns to S811.

When receiving the request packet from the packet determination unit 353, the NAT conversion unit 354 uses “SIP” and “Sport” set in the request packet in the cloud side NW 51 in accordance with the conversion rule 361. The request packet after conversion is transmitted to the VPN processing unit 355 (S822).

When the VPN processing unit 355 receives the request packet from the NAT conversion unit 354, the VPN processing unit 355 searches the VPN control information 362 using “SIP” of the request packet before conversion in S823 as a key, and performs control for the request packet at the time of VPN encapsulation. A method is acquired (S823).

The VPN processing unit 355 searches the VPN destination information 363 using the “Sport” of the converted request packet in S823 as a key, and the global IP address on the cloud site 2 side that is the destination of the request packet, that is, the cloud side NAT device 22 (if the cloud side VPN device 21 is directly connected to the Internet 5, the global IP address of the cloud side VPN device 21) is acquired (S824).

Subsequently, the VPN processing unit 355 VPN-encapsulates the request packet based on the control method acquired in S823, and transmits the request packet after VPN encapsulation from the input / output port B352 to the global IP address acquired in S824. (S825). Thereafter, the process returns to S811.

When the packet arrives at the input / output port A351 of the user side GW apparatus 31, the user side GW apparatus 31 operates as described above.

FIG. 9 is a flowchart for explaining processing performed by the user-side GW apparatus 31 when a packet arrives at the input / output port B352 of the user-side GW apparatus 31.

When a packet arrives at the input / output port B 352 (S911), the VPN processing unit 355 first decapsulates the received packet, and transmits the packet after the decapsulation of the VPN to the packet determination unit 353 (S912).

When the packet determination unit 353 receives the packet after the VPN decapsulation, the packet determination unit 353 determines whether the packet is an information update packet or a response packet (S913). When the incoming packet is an information update packet (S913: information update packet), the packet determination unit 353 transmits the information update packet to the information update processing unit 356 (S914). If the incoming packet is a response packet (S913: response packet), the packet determination unit 353 transmits the response packet to the NAT conversion unit 354 (S921).

When the information update processing unit 356 receives the information update packet from the packet determination unit 353, the packet update information (at least one of the conversion rule 361, the VPN control information 362, and the VPN destination information 363) according to the content of the information update packet. Is updated (S915). Thereafter, the process returns to S911.

When the NAT conversion unit 354 receives the response packet from the packet determination unit 353, the NAT conversion unit 354 searches the conversion table 400 using “DIP” and “Dport” set therein as a key, and the cloud side NW 51 set in the response packet. "DIP" and "Dport" are converted into "DIP" and "Dport" of the user-side NW 52 (S922). Then, the NAT conversion unit 354 transmits the converted response packet to the corresponding user device 30 from the input / output port A351 (S923). Thereafter, the process returns to S911.

When the packet arrives at the input / output port B352 of the user side GW apparatus 31, the user side GW apparatus 31 operates as described above.

By the way, the present invention is not limited to the embodiments described above, and includes various modifications. For example, the above-described embodiments have been described in detail for easy understanding of the present invention, and are not necessarily limited to those having all the configurations described. Further, a part of the configuration of one embodiment can be replaced with the configuration of another embodiment, and the configuration of another embodiment can be added to the configuration of one embodiment. In addition, it is possible to add, delete, and replace other configurations for a part of the configuration of each embodiment.

In addition, each of the above-described configurations, functions, processing units, processing means, and the like may be realized by hardware by designing a part or all of them with, for example, an integrated circuit. In addition, each of the above-described configurations, functions, and the like may be realized by software by interpreting and executing a program that realizes each function by a central processing unit (processor). Information such as programs, tables, and files for realizing each function can be stored in a recording device such as a memory, a hard disk, and an SSD, or a recording medium such as an IC card, an SD card, and a DVD.

Further, the control lines and information lines indicate what is considered necessary for the explanation, and do not necessarily indicate all the control lines and information lines of the product to which the present invention is applied.

In addition, the names of network devices such as “NAT device”, “gateway device (GW device)”, and “VPN device” in the above description are merely for convenience, and these devices are devices specialized for each function. It can also be configured, or can be configured as a device having a plurality of functions. In addition, an equivalent function may be incorporated in a router device, a switch device, an information processing device, or the like.

1 network system, 2 cloud site, 3 user site, 5 internet, 20 server device, 21 cloud side VPN device, 22 cloud side NAT device, 30 user device, 31 user side GW device, 311 user side VPN device, 312 user side 2nd NAT device, 351 input / output port A, 352 input / output port B, 353 packet judgment unit, 354 NAT conversion unit, 355 VPN processing unit, 356 information update processing unit, 361 conversion rule, 362 VPN control information, 363 VPN destination information , 32 User side first NAT device, 51 Cloud side NW, 52 User side NW, 400 Conversion table

Claims

A server device connected to a provider network that is a communication network of a provider site that provides an information processing service;
Connect to the user side network, which is a communication network of a user site that uses the information processing service, that is communicably connected to the provider side network via the Internet, and uses the information processing service by accessing the server device A user device;
A providing-side VPN device connected to the providing-side network;
A user-side VPN device that connects to the user-side network and realizes VPN communication with the providing-side VPN device via the Internet;
A user-side second address translation device connected to the user-side network;
With
The user-side second address translation device is preset when a request packet, which is a packet requesting the server device to use the information processing service, is received from the user device via the user-side network. According to the conversion rule, the source address indicated by the private address of the user side network, which is set in the header used for communication of the user side network of the request packet, is indicated by the private address of the providing side network. To the source address
The user-side VPN device transmits a VPN packet, which is a packet encapsulating the converted request packet, to the providing-side VPN device via the Internet by the VPN communication,
Upon receiving the VPN packet, the providing-side VPN device releases the encapsulation of the VPN packet, acquires the request packet, and transmits the acquired request packet to the server device via the providing-side network. Network system.
The network system according to claim 1,
There are a plurality of user side networks,
Including the user device, the user-side VPN device, and the user-side second address translation device connected to each of the user-side networks;
The translation rules of each of the user side second address translation devices are expressed by the user side second address translation device connected to each of the user side networks as a private address of the user side network in the header of the request packet. A network system configured to convert the transmitted source address into a private address of the provider network that is unique among the user networks.
The network system according to claim 1 or 2,
When the user-side second address translation device receives the request packet, the server device specifies the destination port number set in the header of the request packet according to a preset translation rule. A network system that converts the port number used for identification into the port number on the providing site.
The network system according to claim 3,
The user-side VPN device stores a correspondence between a port number used by the server device for identifying the information processing service and a global address of the providing-side VPN device, and corresponds to the converted port number of the request packet. A network system for transmitting the VPN packet by the VPN communication with the global address as a destination.
The network system according to claim 1 or 2,
The user-side VPN device stores a correspondence between a private address of the user-side network and a control method of the VPN communication, and the transmission source represented by a private address of the user-side network before the conversion of the request packet A network system for performing the VPN communication according to the control method corresponding to an address.
The network system according to claim 1,
A packet that is interposed between the user side network and the Internet and is transmitted and received between the user side network and the Internet performs mutual conversion between a private address of the user side network and a global address of the Internet. A user-side first address translation device;
The network system in which the user side VPN device performs the VPN communication with the providing side VPN device via the user side first address translation device.
The network system according to claim 1 or 2,
The server device sets a response packet set in the header using a transmission source address expressed as a private address of the providing side network set in the header of the received request packet in the providing side network. To the providing VPN device via
The providing side VPN apparatus transmits a VPN packet that is a packet encapsulating the response packet to the user side VPN apparatus by VPN communication,
When receiving the VPN packet, the user side VPN device releases the encapsulation and acquires the response packet, and transmits the acquired response packet to the user side second address translation device,
The second address translation device on the user side refers to the translation rule, and sets the destination address represented by the private address of the provider network, which is set in the header of the response packet, as the private address of the user network. A network system for converting to a destination address represented by an address and transmitting the converted response packet to the user device via the user-side network.
The network system according to claim 1,
The user-side second address translation device is sent in response to an update instruction received via a user interface, or sent from an information processing device connected to the providing-side network or an information processing device connected to the user-side network. A network system that updates the conversion rule in response to an update instruction.
The network system according to claim 8, wherein
The second address conversion device on the user side, the information processing device connected to the network on the provider side, or the information processing device connected to the network on the user side displays the screen for accepting the setting of the conversion rule on the display device while performing the conversion A network system that accepts rule settings.
The network system according to claim 1 or 2,
The information processing service is a cloud service.
The network system according to claim 1 or 2,
The user side second address translation device is a NAT device or a NAPT device.
A communication control device functioning as the user-side second address translation device in the network system according to claim 1,
When receiving a request packet, which is a packet for requesting use of the information processing service, from the user device to the server device via the user-side network, the request packet includes the request packet according to a preset conversion rule. A communication control device for converting a source address expressed by a private address of the user side network, which is set in a header used for communication of the user side network, into a source address expressed by a private address of the provider side network .
A communication control device comprising the user-side second address translation device and the user-side VPN device in the network system according to claim 1,
When receiving a request packet, which is a packet for requesting use of the information processing service, from the user device to the server device via the user-side network, the request packet includes the request packet according to a preset conversion rule. A source address represented by a private address of the user side network set in a header used for communication of the user side network is converted into a source address represented by a private address of the provider side network;
A communication control device that transmits a VPN packet, which is a packet obtained by encapsulating the converted request packet, to the providing VPN device via the Internet by the VPN communication.
The communication control device according to claim 12 or 13,
There are a plurality of user side networks,
Including the user device, the user-side VPN device, and the user-side second address translation device connected to each of the user-side networks;
The translation rules of each of the user side second address translation devices are expressed by the user side second address translation device connected to each of the user side networks as a private address of the user side network in the header of the request packet. A communication control device configured to convert the transmitted source address into a private address of the provider network that is unique between the user networks.
A server device connected to a provider network that is a communication network of a provider site that provides an information processing service;
Connect to the user side network, which is a communication network of a user site that uses the information processing service, that is communicably connected to the provider side network via the Internet, and uses the information processing service by accessing the server device A user device;
A providing-side VPN device connected to the providing-side network;
A user-side VPN device that connects to the user-side network and realizes VPN communication with the providing-side VPN device via the Internet;
A user-side second address translation device connected to the user-side network;
A communication method in a network system configured to include:
When the user-side second address translation device receives a request packet, which is a packet requesting the server device to use the information processing service, from the user device via the user-side network, a preset value is set. According to the conversion rule, the source address indicated by the private address of the user side network, which is set in the header used for communication of the user side network of the request packet, is indicated by the private address of the providing side network. To the source address
The user side VPN device sends a VPN packet that is a packet encapsulating the converted request packet to the providing side VPN device via the Internet by the VPN communication,
When the providing VPN device receives the VPN packet, it decapsulates the VPN packet to acquire the request packet, and transmits the acquired request packet to the server device via the providing network. Communication method.