JP2004236096A - Repeater and communication control method - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To make IP communication between a non-IPv6 node to be stored in a domestic network and another node on the Internet possible. <P>SOLUTION: IPv6 addresses are individually allocated to each of non-IPv6 equipment not by mapping to a single IP address in the conventional manner and communication with the Internet (IPv6) side is repeated by using the IPv6 addresses. Furthermore, the repeater alternately processes IP processing such as parameter, key replacement of IPSEC by using the IPv6 addresses allocated here. <P>COPYRIGHT: (C)2004,JPO&NCIPI

Description

[0001]
TECHNICAL FIELD OF THE INVENTION
The present invention relates to a relay device for interconnecting a device network (for example, a local network such as a home network or an intranet) connected locally to the Internet, and relaying communication between the connected device and a communication node of the Internet. And a communication control method.
[0002]
[Prior art]
Home networks are attracting attention as new targets for network technology. Generally, a mode is assumed in which a relay device called a home gateway 101 that manages and controls a group of devices 102 at home is installed, and the Internet outside the home is accessed via this relay device (FIG. 9).
[0003]
In the conventional Internet 100 based on IPv4, the number of global IPv4 addresses that can be assigned to each home is limited. In this case, the home network uses an internally closed address pair called a private address, and only accesses to the outside. In this case, the home gateway 101 performs a function as an address translator (NAT: Network Address Translator) and adds various added values to the home gateway. There are various proposals for 101.
[0004]
However, on the other hand, IPv6 is being studied as a next-generation IP protocol. In IPv6, a much larger number of nodes than in IPv4 can be accommodated by expanding the IP address, which was 32 bits wide in IPv4, to 128 bits wide. For example, it is assumed that an IPv6 global address is assigned to all devices housed in a home and all devices perform IP communication. By adopting IPv6, a unique global address can be assigned to all home devices.
[0005]
Thereby, it is possible to perform communication in which the ends are connected seamlessly without passing through a relay device such as a NAT in the middle of the route, and this is said to be advantageous in various aspects such as security and guarantee of communication quality. . In addition, IPv6 has a function of automatically generating an address from a network ID managed by each router and an ID unique to the device, and has a function of automatic address configuration, which makes it easy to operate a terminal host.
[0006]
On the other hand, as a communication method for controlling household appliances, there are ECHONET for white goods, EMIT proposed by emWARE of the United States used for building equipment, and LON works (trademark) proposed by Echelon of the United States. Various communication systems that do not use IP have been proposed, and it can be said that home communication systems (protocols) are becoming more diversified.
[0007]
In addition, many home devices do not have sufficient resources (CPU performance, memory amount, etc.) for mounting the IPv6 protocol, which hinders the spread of IPv6.
[0008]
[Non-patent document 1]
emWARE site (http://www.emware.com/)
[Non-patent document 2]
Echelon's site (http://www.echelon.com/)
[0009]
[Problems to be solved by the invention]
The present invention has been made in consideration of the above circumstances, and for a device that supports only a non-IPv6 protocol at home, a relay device performs proxy processing of an automatic configuration of an individual IPv6 address based on the device identifier, By converting between a non-IP packet and an IPv6 packet based on information (table) storing the generated correspondence between the IPv6 address and the device identifier, it is easy for the non-IP device to communicate with an IP node such as the Internet. The present invention also provides a relay apparatus and a communication control method that enable a home gateway to perform various IPv6 services (for example, security processing) on behalf of a non-IPv6 device by allocating individual IPv6 addresses to non-IPv6 devices. And
[0010]
[Means for Solving the Problems]
The relay device of the present invention includes a first interface connected to a wide area network and capable of communicating with an IPv6 protocol, and a second interface connected to a local network and capable of communicating with a predetermined protocol. A relay device for relaying communication between a communication device connected to a local network and another communication device connected to a wide area network, wherein the communication device connected to the local network cannot perform communication according to the IPv6 protocol. In this case, based on the device identification information of the communication device, an automatic generation means for automatically generating an IPv6 address corresponding to the communication device, and an IPv6 address corresponding to the communication device generated by the automatic generation device are connected to the first interface. To the communication device generated by the automatic generating means. A storage unit that stores the IPv6 address and the device identification information of the communication device in association with each other, and transmits a non-IPv6 packet transmitted from the communication device to a sixth interface based on the IPv6 address and the communication identification information stored in the storage unit. And a function of converting the non-IPv6 packet into an IPv6 packet, transferring the packet to a desired destination via the first interface, and transmitting the IPv6 packet transmitted from the wide area network to the communication device through the first interface. And a transfer unit having a function of converting the IPv6 packet into a non-IPv6 packet, and transferring the packet to a communication device via the second interface.
[0011]
Further, the relay device of the present invention is characterized in that, when a plurality of communication devices are connected to the local network, the storage unit stores a plurality of communication devices in association with each IPv6 address and corresponding device identification information.
Further, the relay device of the present invention is characterized in that the predetermined protocol is an echo net protocol.
[0012]
Further, the relay device of the present invention is characterized in that the predetermined protocol is an IPv4 protocol.
[0013]
Further, the relay apparatus of the present invention further includes proxy processing means for proxy processing of an IP protocol processing required for an automatically generated IPv6 address for the communication device connected to the second interface in place of the communication device. It is characterized by the following.
Further, the relay device of the present invention includes a process of exchanging an IP security key required for an automatically generated IPv6 address for a communication device connected to the second interface, a process of exchanging security parameters, a process of setting security parameters, A proxy processing means for performing proxy processing of at least one of the IPSEC processing of the packets to be communicated is further provided.
[0014]
Further, the relay device of the present invention registers a service attribute to be provided based on an automatically generated IPv6 address as a proxy process for a communication device connected to the second interface, and sets the communication device as a search target of a service discovery protocol. Is added.
[0015]
Further, the communication control method of the present invention includes a first interface connected to a wide area network and capable of communicating with an IPv6 protocol, and a second interface connected to a local network and capable of communicating with a predetermined protocol. A communication control method of a relay device that relays communication between a communication device connected to a local network and another communication device connected to a wide area network, wherein the communication device connected to the local network includes If communication using the IPv6 protocol is not possible, an IPv6 address corresponding to the communication device is automatically generated based on the device identification information of the communication device, and the generated IPv6 address corresponding to the generated communication device is assigned to the first interface. An IPv6 address corresponding to the generated communication device and device identification information of the communication device. Receiving the non-IPv6 packet transmitted from the communication device via the sixth interface based on the stored IPv6 address and the communication identification information, converting the non-IPv6 packet into an IPv6 packet, The first IPv6 packet is transferred to a desired destination via the first interface, the IPv6 packet transmitted from the wide area network to the communication device is received via the first interface, and the IPv6 packet is converted into a non-IPv6 packet. Transfer to the communication device via the interface of (1).
[0016]
Further, the communication control method according to the present invention is characterized in that, when a plurality of communication devices are connected to the local network, a plurality of communication devices are stored in association with each IPv6 address and the corresponding device identification information.
[0017]
Further, the communication control method according to the present invention is characterized in that the predetermined protocol is an echo net protocol.
[0018]
Further, the communication control method according to the present invention is characterized in that the predetermined protocol is an IPv4 protocol.
[0019]
Further, the communication control method according to the present invention is characterized in that an IP protocol process required for an automatically generated IPv6 address for a communication device connected to the second interface is performed on behalf of the communication device.
[0020]
Further, in the communication control method according to the present invention, an IP security key exchange process, a security parameter exchange process, and a security parameter setting process required for an automatically generated IPv6 address for a communication device connected to the second interface are provided. In addition, at least one of the IPSEC processes of a packet to be communicated is performed as a proxy process.
[0021]
Further, in the communication control method of the present invention, as a proxy process for a communication device connected to the second interface, a service attribute to be provided is registered based on an automatically generated IPv6 address, and communication is performed with a search target of a service discovery protocol. It is characterized by adding equipment.
[0022]
BEST MODE FOR CARRYING OUT THE INVENTION
Hereinafter, embodiments of the invention will be described with reference to the drawings.
[0023]
FIG. 1 shows a typical configuration of a home network according to the present invention. Here, a home network such as a home is assumed as the local network. Here, the home gateway 1 is connected to the external Internet 2 by IPv6, and the home network includes terminals 21 to 2n that support IPv6 and terminals 31 to 3n that do not support IPv6. In the case of a terminal that supports IPv6, the home gateway 1 as a relay device operates as a mere media converter, negotiates with a router (not shown) on the ISP3 side, acquires a network prefix, and uses this to automatically configure an IPv6 address. (Defined in IETF RFC2461 or the like) to obtain an IPv6 address.
[0024]
On the other hand, in the present invention, when the home gateway 1 recognizes the respective device identifiers, for example, the MAC addresses, the terminals 31 to 3n that do not support IPv6 are used to operate the address automatic configuration, and the respective terminals 31 to 31n are operated. 3n is automatically configured and associated with the upstream interface of home gateway 1. In general, in IPv6, associating a plurality of IP addresses with one interface is usually performed, so this is not a special operation.
[0025]
Here, it is assumed that global IPv6 addresses for the terminals 31 to 3n have been generated. In addition, addresses having another scope called a link local address or a site local address can be generated, but they are not considered in the present invention.
[0026]
FIG. 2 is a diagram showing an internal configuration of the home gateway 1. As described above, the IPv6 address automatic generation unit 10 performs automatic IPv6 address configuration using a network prefix obtained by negotiation with a router (not shown) on the ISP 3 side, and generates an IPv6 address. Also, the terminals 31 to 3n that do not support IPv6 recognize the Mac address and the like, and automatically configure the IPv6 addresses corresponding to the terminals 31 to 3n.
[0027]
The IPv6 address assigning unit 11 associates the IPv6 addresses corresponding to the terminals 31 to 3n with the first interface 14, which is an interface on the Internet side.
[0028]
The storage unit 13 stores a correspondence (table) between IPv6 addresses corresponding to the terminals 31 to 3n and device identifiers (for example, Mac addresses) of the terminals.
[0029]
The transfer unit 14 refers to this correspondence relationship, and relays the transmission and reception communication between the communication node on the Internet side and the terminals 31 to 3n on the home network side. The control unit 12 controls these operations comprehensively.
[0030]
As a result, the home gateway 1 has a correspondence table between the device identifiers (MAC addresses) of the non-IPv6 terminals and the IPv6 addresses as shown in FIG. Using this table, the home gateway 1 executes packet conversion when a non-IPv6 terminal communicates with a device on the Internet side.
[0031]
Hereinafter, a packet processing method in the case where a non-IPv6 terminal communicates with an Internet-side IP terminal using this will be described. Here, there is a problem of how to represent the address of the IP terminal in the non-IPv6 protocol. Regarding this problem, the protocol is extended in each non-IPv6 protocol (eg, Echonet, EMIT, etc.). It is assumed that it is possible to express that the user wants to transmit a packet to an IP terminal outside the home network.
[0032]
One method is to encapsulate a non-IPv6 protocol packet with an IPv6 packet and send it to an IPv6 terminal via an IPv6 tunnel. FIG. 4 shows an example in which a packet is transmitted from the non-IPv6 terminal 00-bc-de-01-82-99 shown in the table of FIG. 3 to the IPv6 terminal ff02 :: 1. Here, the IPv6 address ff04: 0 :: 02bc: def: fe01: 8299 given to the non-IPv6 terminal becomes the source address of the IPv6 tunnel, and transmits the non-IPv6 packet to the Internet. This processing can be easily realized as an extension of the processing in an IPv4 / v6 mixed environment generally called a v4 over v6 tunnel.
[0033]
Conversely, when an IPv6 encapsulated packet is received from the Internet side, if a match is made with reference to the table of FIG. 3, an internal non-IPv6 packet may be taken out and transferred to the corresponding device using the non-IPv6 protocol. .
[0034]
As another method, there is a method of converting a packet into a predetermined IPv6 packet format corresponding to a non-IPv6 protocol and transferring the packet. For example, consider the case of an echo net status acquisition request packet 51 and a response packet 52 to it as shown in FIG.
[0035]
This is a packet format for inquiring about status information of a specific device on the home network (for example, a set temperature of a refrigerator) and responding to the inquiry. In the world of IPv6, if it is determined in advance that it is represented by a protocol called SNMP used for network management, when a corresponding SNMP 53 packet of IPv6 is received, it is converted into a corresponding echonet packet, and conversely, A process of converting the response packet of the net into an SNMP54 packet of IPv6 and responding to the Internet is performed.
[0036]
The above sequence is shown in FIG. When the external IPv6 node 61 issues SNMP (trap, status_req), the home gateway 1 converts this into an Echo_State_retrieve command and transfers it to the internal Echonet node 62. The internal Echonet node 62 issues an Echo_State_reply in response to this, and the home gateway 1 transfers this to the external IPv6 node 61 as SNMP (rep, status_replay). In addition, as a packet conversion rule, a method using HTTP, SOAP or XMP as an extension thereof, or the like may be used.
[0037]
In the transfer method by the packet conversion, the home gateway 1 needs to know the details of each non-IPv6 protocol. In particular, when two or more conversion methods are supported, it is necessary to analyze the details of the internal protocol. Processing time issues can occur.
[0038]
On the other hand, when the non-IPv6 packet is encapsulated and transmitted as it is, it is necessary for the destination IPv6 node to interpret all the non-IPv6 protocols. Therefore, in general, it is appropriate to appropriately switch and use the two methods in consideration of the processing capability of the destination IPv6 node and the complexity of the non-IPv6 protocol.
[0039]
A processing example of IP security (IPSEC) will be described as an example in which a non-IPv6 node is treated as an IP node by assigning an individual IPv6 address to a non-IPv6 packet and processing as described above.
[0040]
As shown in FIG. 7, when communication from a non-IPv6 node starts, IPSEC processing is started at the gateway, and an IPSEC method corresponding to the communication node 5 of the other party is set according to a preset policy for this node. Then, a key exchange protocol (generally, the Internet uses a method called IKE) required for the IPSEC is activated to exchange keys with the communication node 5 of the other party.
When these operations are completed, the exchange of the packets that have undergone the necessary IPSEC processing is started. Of course, it cannot be assumed that the non-IPv6 node itself has a function such as packet encryption. Therefore, the IPSEC process itself is performed by the gateway, and the packet going out of the home network is encrypted (using the tunnel mode of IPSEC). That said, at least the ability to encrypt packets going out of the house can provide sufficient utility.
[0041]
Further, by individually assigning an address to each non-IPv6 node, security parameters (SA: security association) can be independently set for each node, and flexible security processing can be performed. Are the advantages of the IPv6 processing according to the present invention.
[0042]
Conversely, if only one IP address is given to a non-IPv6 node, all non-IPv6 node-originated packets are encrypted with exactly the same encryption method and only for a specific destination. Can not.
[0043]
Another great advantage is that the gateway can perform all the preprocessing of IPSEC such as IKE. This is because public key cryptography is generally used for mutual authentication such as IKE. This is a process involving multiplication and division of multibyte integers, and it takes a huge amount of processing time with a low-cost CPU. It is difficult to perform processing at the system node.
[0044]
For this reason, it has been extremely difficult to support IPSEC in nodes such as general home appliances (a research on a lightweight key exchange method has been conducted as a solution to this problem). By performing the IKE processing on behalf of a gateway having high CPU performance, IPSEC can be applied with the conventional method.
[0045]
As another example of processing according to IPv6, an example is shown in which a service discovery protocol (SLP) is used to advertise a service provided by a non-IPv6 node to the IPv6 side (FIG. 8).
[0046]
Assuming that a service attribute value is determined, and a corresponding non-IPv6 node is connected, the home gateway 1 registers a service with the service agent 82 and the directory agent 81 based on the corresponding IPv6 address. . Thus, a node having a required service attribute can be searched without depending on a corresponding protocol.
[0047]
Although Echonet has been described as an example of the non-IPv6 protocol in the above, the present invention is applicable to a system that handles other non-IPv6 protocols. Note that each of the above functions can be implemented as software. Further, the present embodiment is a computer-readable computer that stores a program for causing a computer to execute a predetermined unit (or for causing the computer to function as a predetermined unit, or for causing the computer to realize a predetermined function). It can also be implemented as a recording medium.
[0048]
The present invention is not limited to the above-described embodiment, and can be implemented with various modifications within the technical scope thereof.
[0049]
【The invention's effect】
According to the present invention, a legacy non-IPv6 device that cannot support the IPv6 stack can be uniformly accessed to the Internet, and a relay device performs various processing on behalf of various IP services using individually assigned IPv6 addresses. Thus, it is possible to efficiently manage and control a home network in which IPv6 devices and non-IPv6 devices coexist without changing the non-IPv6 devices.
[Brief description of the drawings]
FIG. 1 is a diagram showing a typical configuration of a home network according to the present invention. FIG. 2 is a configuration diagram of a home gateway according to the present invention. FIG. 3 is a correspondence between a device identifier (MAC address) of a non-IPv6 terminal and an IPv6 address. FIG. 4 shows an example of a transfer sequence by IPv6 tunneling. FIG. 5 shows a packet example in an echo net and an IP packet corresponding thereto. FIG. 6 shows an example of a transfer sequence by packet conversion. FIG. 7 is a diagram showing a sequence of an IPSEC proxy process according to the present invention. FIG. 8 is a diagram showing a sequence of an SLP proxy process according to the present invention. FIG. 9 is a typical network configuration example of a conventional home network. Diagrams [Description of symbols]
DESCRIPTION OF SYMBOLS 1 ... Home gateway 2 ... Internet 21-2n ... Terminals which support IPv6 31-3n ... Terminals which do not support IPv6 10 ... IPv6 address automatic generation part 11 ... IPv6 address allocation part 12 control unit 13 storage unit 14 transfer unit

Claims (14)

A first interface connected to a wide area network and capable of communicating with an IPv6 protocol, and a second interface connected to a local network and capable of communicating with a predetermined protocol; Communication device, and a relay device for relaying communication between other communication devices connected to the wide area network,
Automatic generation means for automatically generating an IPv6 address corresponding to the communication device based on device identification information of the communication device when the communication device connected to the local network cannot perform communication according to the IPv6 protocol;
Assigning means for assigning an IPv6 address corresponding to the communication device generated by the automatic generating means to the first interface;
Storage means for storing an IPv6 address corresponding to the communication device generated by the automatic generation means and device identification information of the communication device in association with each other;
Receiving the non-IPv6 packet transmitted from the communication device via the sixth interface based on the IPv6 address and the communication identification information stored in the storage unit, converting the non-IPv6 packet into an IPv6 packet, A function of transferring the packet to a desired destination via the first interface; receiving an IPv6 packet transmitted from the wide area network to the communication device via the first interface; and transmitting the IPv6 packet to a non-IPv6 A transfer unit having a function of converting the packet into a packet and transferring the packet to the communication device via the second interface. 2. The relay device according to claim 1, wherein when a plurality of the communication devices are connected to the local network, the storage unit stores a plurality of the communication devices in association with respective IPv6 addresses and corresponding device identification information. . The relay device according to claim 1, wherein the predetermined protocol is an echonet protocol. The relay device according to claim 1, wherein the predetermined protocol is an IPv4 protocol. A proxy processing means for performing proxy processing on behalf of the communication device for IP protocol processing required for an automatically generated IPv6 address for the communication device connected to the second interface, further comprising: Item 2. The relay device according to item 1. IP security key exchange processing, security parameter exchange processing, security parameter setting processing, and IPSEC of a packet for communication with a communication device connected to the second interface, which is required for an automatically generated IPv6 address. 6. The relay device according to claim 1, further comprising a proxy processing unit that performs proxy processing for at least one of the processes. As a proxy process for a communication device connected to the second interface, a service attribute to be provided is registered based on the automatically generated IPv6 address, and the communication device is added to a search target of a service discovery protocol. The relay device according to claim 1, wherein the relay device comprises: A first interface connected to a wide area network and capable of communicating with an IPv6 protocol, and a second interface connected to a local network and capable of communicating with a predetermined protocol and connected to the local network; Communication device, a communication control method of a relay device that relays communication between other communication devices connected to the wide area network,
When the communication device connected to the local network cannot perform communication according to the IPv6 protocol, an IPv6 address corresponding to the communication device is automatically generated based on device identification information of the communication device,
Assigning the generated IPv6 address corresponding to the communication device to the first interface;
Storing the generated IPv6 address corresponding to the communication device and device identification information of the communication device in association with each other;
A non-IPv6 packet transmitted from the communication device is received via the sixth interface based on the stored IPv6 address and communication identification information, and the non-IPv6 packet is converted into an IPv6 packet, and the first Transferring the IPv6 packet transmitted from the wide area network side to the communication device via the first interface, converting the IPv6 packet into a non-IPv6 packet, A communication control method, wherein the data is transferred to the communication device via a second interface. 9. The communication control method according to claim 8, wherein when a plurality of the communication devices are connected to the local network, a plurality of the communication devices are stored in association with each IPv6 address and corresponding device identification information. 10. The communication control method according to claim 8, wherein the predetermined protocol is an echonet protocol. 10. The communication control method according to claim 8, wherein the predetermined protocol is an IPv4 protocol. 9. The communication control according to claim 8, wherein an IP protocol process required for an automatically generated IPv6 address for a communication device connected to the second interface is performed on behalf of the communication device. Method. IP security key exchange processing, security parameter exchange processing, security parameter setting processing, and IPSEC of a packet for communication with a communication device connected to the second interface, which is required for an automatically generated IPv6 address. 13. The communication control method according to claim 8, wherein at least one of the processes is performed as a proxy process. As a proxy process for a communication device connected to the second interface, a service attribute to be provided is registered based on the automatically generated IPv6 address, and the communication device is added to a search target of a service discovery protocol. 13. The communication control method according to claim 8, wherein:

Images