JP2009200729A - Name resolution controller, and name resolution control method - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To provide a name resolution controller for screening a name resolution request transmitted from a user terminal and providing a highly safe name resolution service. <P>SOLUTION: The name resolution controller is connected through a network with an information terminal for which a domain name and an address are the identifier of the present terminal. A first domain name and an address corresponding to the first domain name are stored beforehand, control information indicating whether or not to transmit a name resolution result corresponding to a name resolution request for which the first domain name is a name resolution object and the second domain name is a transmission origin is stored corresponding to the first domain name and the second domain name, and the name resolution request for which the first domain name is the name resolution object and the second domain name is the transmission origin is received. When the control information corresponding to the first domain name and the second domain name indicates that name resolution is to be permitted, the address corresponding to the first domain name is read, and a name resolution result is answered. <P>COPYRIGHT: (C)2009,JPO&INPIT

Description

  The present invention relates to a name resolution control apparatus and a name resolution control method that respond to a name resolution request transmitted from an information terminal.

Conventionally, in a network in which communication is performed by specifying a communication terminal by an IP (Internet Protocol) address, a character string that is easy to understand for human beings is used as a domain name, and such a domain name and an IP address are associated with each other. A DNS (Domain Name System) that enables information communication with other communication terminals as a destination is used. In DNS, a name resolution device is installed on a network, and a communication terminal uses a name resolution service provided by such a name resolution device to acquire an IP address corresponding to a domain name, and to the acquired IP address. Communication in the IP network is performed by transmitting information to the network.
By the way, in order to ensure the security of network communication in the Internet or the like, a technique is used in which authentication is performed using a public key infrastructure or an electronic certificate, and communication is permitted only when the authentication is successful. For example, Patent Literature 1 or Patent Literature 2 proposes a technique for restricting access on a network by performing such authentication and providing a name resolution service only to a communication terminal that has been successfully authenticated. .
JP 2004-15530 A JP 2004-159159 A

However, the technique described in Patent Document 1 described above sets access restrictions in advance by a service provider and restricts access to all users. That is, it is not possible to set access restrictions by users or to restrict access on a user basis.
In addition, the technique described in Patent Document 2 described above performs access restriction using a certificate, but can only perform access restriction defined at the time of certificate issuance, and allows flexible access in units of users. There are no restrictions.

  Here, a DNS server that provides a name resolution service in DNS generally has a mechanism for responding equally to name resolution results regardless of the source of the name resolution request. . Resolving names from a domain name to an address of a server that is presumed to be widely disclosed on the network is often a countermeasure for such a server assuming access from an unspecified number of people. Although there is no problem, in name resolution from a domain name to an address of a general user communication terminal, there is a high risk of becoming a target of DoS attack, entry, and takeover.

  In particular, in P2P (Peer to Peer) type communication, which has been increasingly used in recent years, name resolution may be performed between the user terminal and the user terminal, not between the user terminal and the server. In addition, in the conventional IPv4 network, because there is a limit to the addresses that can be set in the communication terminal, a different address space can be set for the global address and the local address, or an address in the address space within a limited range can be set. The limited address is effectively used by reusing it with a terminal within a certain range. For this reason, the address of the user terminal is hidden from the outside, or the address of the user terminal cannot be recognized from the outside. In addition, the IPv6 network that has been widely used in recent years has a wide address space, and it is possible to assign a unique global address to all communication terminals, which can improve the convenience of communication. A certain domain name is defined for a communication terminal connected to such an IPv6 network. As described above, in a name resolution service performed in a network environment in which the necessity of name resolution between user terminals is increasing, a name resolution result is responded to each name resolution request made from each user terminal. It is desirable to screen whether or not. Also, it is desirable that such screening settings can be flexibly set and changed from the user terminal in order to meet the needs of individual user terminals.

  The present invention has been made in view of such a situation. For example, a name resolution request transmitted from a user terminal that identifies a communication terminal by performing name resolution by DNS is screened, and a highly secure name resolution service is provided. A name resolution control device is provided.

  In order to solve the above-described problem, the present invention provides a name resolution control apparatus connected via a network to an information terminal having a domain name and an address corresponding to the domain name as an identifier of the terminal. Name information storage means for storing in advance a domain name of 1 and an address corresponding to the first domain name, and a name resolution request for the name resolution target of the first domain name, and corresponding to the first domain name The first domain name is set as the name resolution target in association with the name resolution unit that reads the address to be read from the name information storage unit and responds as the name resolution result, the first domain name, and the second domain name. , An access for storing access information including control information indicating whether or not to transmit a name resolution result including an address corresponding to a name resolution request originating from the second domain name When the information storage means and the name resolution means receive a name resolution request with the first domain name as the name resolution target and the second domain name as the source, the access information storage means sends the first domain name and Access information control means for reading the access information associated with the second domain name and operating the name resolution means when the control information included in the access information indicates that name resolution is permitted. It is characterized by that.

  Further, according to the present invention, the above-described name resolution control apparatus includes an access including a second domain name associated with the first domain name and control information from an information terminal having the first domain name as an identifier. Access information receiving means for receiving information, and access information registering means for storing the access information received by the control information receiving means in the access information storage means.

  In the present invention, the above-described name resolution control device includes a name information receiving unit that receives, from an information terminal, name information of a domain name that is an identifier of the information terminal and an address associated with the domain name, Name information registration means for storing name information received by the information receiving means in the name information storage means, and the name resolution means based on the name information stored in the name information storage means by the name information registration means And responding with a name resolution result.

  The present invention further includes log storage means for storing either or both of the access information received by the access information receiving means and the name information received by the name information receiving means of the name resolution control apparatus described above. It is characterized by.

  Further, according to the present invention, the access information control means of the name resolution control apparatus described above stores the domain name that is the identifier of the information terminal and the address assigned in advance to the domain name, and the name resolution received by the name resolution means It is further characterized in that it is determined whether or not an address corresponding to a source domain name of access information received by the request or access information receiving means is an address previously assigned to the domain name.

  The present invention also provides a name resolution control method for a name resolution control apparatus connected via a network to an information terminal having a domain name and an address corresponding to the domain name as an identifier of the own terminal. Means for storing in advance a first domain name and an address corresponding to the first domain name; and an access information storage means in association with the first domain name and the second domain name; Stores access information including control information indicating whether or not to transmit a name resolution result including an address corresponding to a name resolution request with the first domain name as the name resolution target and the second domain name as the source. A step of receiving a name resolution request with the first domain name as the name resolution target and the second domain name as the source; When the access information in which the first domain name and the second domain name are associated is read from the access information storage unit and the control information included in the access information indicates that name resolution is permitted, The name resolution means comprises a step of reading an address corresponding to the first domain name from the name information storage means and responding as a name resolution result.

  As described above, according to the present invention, the first domain name from the information terminal corresponding to the second domain name is associated with the first domain name and the second domain name. The access information including control information indicating whether or not to send the name resolution result is stored in the target name resolution request, and the name resolution result is returned based on such access information. The solution control device can set a predetermined domain name as a name resolution target and respond only to a name resolution request from a predetermined source, thereby screening the name resolution request. In addition, according to such a name resolution control device, for example, whether or not to transmit a name resolution result is selected in response to a name resolution request transmitted by a name resolution function generally provided in a conventional information terminal. It is possible to perform screening, and it is considered possible to construct a system for efficiently screening name resolution requests without adding new functions to widely used information terminals.

  Further, according to the present invention, the control information indicating whether to respond to the second domain name and the name resolution request received from the second domain name from the information terminal having the first domain name as an identifier. Since the name resolution result is returned based on the received access information, the information terminal responds to the name resolution request for the first domain name of its own terminal as the name resolution target. The second domain name of the source of the name resolution request that is permitted to respond can be determined in advance, and thus the name resolution request can be screened based on the access information received from the information terminal.

  In addition, according to the present invention, the name information associated with the domain name and address of the information terminal is received from the information terminal, and the name resolution result is returned based on the received name information. Allows the information terminal to control the association between the domain name and address of its own terminal, and when the information terminal changes the address corresponding to its own domain name, By transmitting the name information of the domain name and address to the name resolution control device, the name resolution control device can respond with a name resolution result reflecting the name information after the change of the information terminal.

Hereinafter, an embodiment of the present invention will be described with reference to the drawings.
<First Embodiment>
FIG. 1 is a block diagram showing a configuration of a name resolution system using a name resolution control apparatus according to the present embodiment.
The name resolution system using the name resolution control device according to the present embodiment includes a name resolution device 10, an information registration receiving device 20, a network termination device 30-1, a network termination device 30-2, and a network termination device 30-. 3,... A plurality of network termination devices with network termination device 30-N (hereinafter referred to as network termination device 30 when there is no need to identify individual network termination devices), and each network termination device 30, a user terminal 50-1, a user terminal 50-2, a user terminal 50-3,..., A user terminal 50 -N (hereinafter, it is particularly necessary to identify individual user terminals) In the case where there is not, it is referred to as a user terminal 50), a maintenance terminal device 60, a management network 70, and a service network 80. In the present embodiment, the name resolution control device is configured by the name resolution device 10 and the information registration reception device 20.

The name resolution device 10 transmits a name resolution result in response to the name resolution request received from the user terminal 50, and the access information control unit 12, the access information storage unit 13, the name information storage unit 14, and the name resolution acceptance Unit 15 and a line identification information storage unit 16.
The name information storage unit 14 stores name information in which a domain name and an address are associated with each other. (A) of FIG. 2 is a figure which shows the example of data of the name solution information which the name information storage part 14 memorize | stores. For example, the name information storage unit 14 has a name in which the domain name “alice.game01.ps3” and the IPv6 address “1111 :: 1” are associated with each other in the first line of FIG. It is shown to store information. In this embodiment, an example in which an IPv6 address is stored will be described. However, an IPv4 address may be stored.

  The access information storage unit 13 includes a domain name, an access control list (hereinafter also referred to as an ACL) indicating a list of domain names requesting a name resolution request for the domain name, and a domain name indicated in the access control list. Control information indicating whether or not a response of a name resolution result is permitted for a name resolution request as a request source is stored. FIG. 2B shows a data example of access information stored in the access information storage unit 13. As the control information in this embodiment, for example, information indicating “allow” indicating that the response of the name resolution result is permitted or “deny” indicating that the response of the name resolution result is not permitted is stored. Note that “allow” and “deny” are examples, and the control information may be information indicating whether or not a response of the name resolution result is permitted.

  The access control list stores a domain name (FQDN (Fully Qualified Domain Name)) requesting a name resolution request for determining whether or not a response of the name resolution result is permitted. In the access control list, one domain name may be designated per line. For example, a plurality of domain names may be stored in one line using a semicolon (;) as a concatenation character. Also good. FIG. 2D shows an example of a domain name (FQDN) described in this embodiment. In the FQDN shown in (d) of FIG. 2, the part indicated by x is an arbitrary label group of the application. An application that manages an IPv6 address may arbitrarily set a label at this location. For example, it is possible to arbitrarily define information such as device information, application information, group information, and user ID, and perform screening using these information. Also, for example, in the present embodiment, the character string “alice” set as the lowermost (leftmost) label among the labels indicated by x in FIG. 2D identifies the user. However, such a user ID may also be set arbitrarily.

In the FQDN shown in (d) of FIG. 2, the part indicated by y is a line identifier label for identifying a communication line. In the FQDN shown in (d) of FIG. 2, the part indicated by z is a label indicating the type of service. Here, as shown in FIG. 2B, “*” or the like may be used as a wild card for each layer in the domain name of the access control list. That is, among the domains having a hierarchical structure, all domain names are included for domains in a specific hierarchy designated with “*”. For example, in the example of the 4th and 5th lines in FIG. 2B, the name resolution request having “alice.pc” as the domain name to be resolved is “.pc”. In the case of “”, the response of the name resolution result is permitted, but in the case of “carol.pc”, the response of the name resolution result is not permitted.
Note that the domain name included in the access control list is not limited to the above-described configuration. For example, a terminal information identifier is applied to y shown in FIG. A network terminating device identifier may be applied. As described above, the configuration of the domain name included in the access control list may be arbitrarily set according to the network configuration or the like.

  Returning to FIG. 1, the access information control unit 12 receives information transmitted from the network terminating device 30 via the information registration accepting device 20 and the management network 70 and stores the information in each unit included in the name resolution device 10. Further, the access information control unit 12 refers to the access information stored in the access information storage unit 13 and determines whether or not to permit transmission of the name resolution result for the name resolution request received by the name resolution accepting unit 15. To do.

The name resolution accepting unit 15 receives a name resolution request transmitted from the user terminal 50 via the service network 80. Upon receiving the name resolution request transmitted from the user terminal 50, the name resolution accepting unit 15 transfers the received name resolution request to the access information control unit 12, and the access information control unit 12 permits the response of the name resolution result. If it is determined, the name information stored in the name information storage unit 14 is read, and the name resolution result is transmitted to the user terminal 50.
The line identification information storage unit 16 stores line information for identifying a communication line used by each network termination device 30 and an address allocated in advance to the network termination device 30 in association with each other. FIG. 2C shows an example of data stored in the line identification information storage unit 16. When the domain name included in the access control list includes a network termination device identifier for identifying the network termination device, if the corresponding address can be identified by the network termination device identifier, (c) of FIG. It is good also as not storing the information shown in.

The information registration accepting device 20 accepts an information registration request for access information and name information transmitted from the network terminating device 30, and includes a name information control accepting unit 21, a log collection accepting unit 22, and a work log storage unit 23. I have.
The name information control accepting unit 21 receives the information registration request transmitted from the network terminating device 30 and transfers it to the access information control unit 12 of the name resolution device 10 via the management network 70.

  The work log storage unit 23 stores the information registration request received by the name information control receiving unit 21 as a log. FIG. 2C is a diagram illustrating an example of work log data stored in the work log storage unit 23. The work log storage unit 23 stores information on time, line information, operation content, identifier, control information, ACL, and address.

The time is information indicating the time when the access information and the name information transmitted from the user terminal 50 or the network terminating device 30 are received.
The line information is line information for identifying the transmission source of the received information registration request.
The operation content is the content of the received information registration request. The operation content indicates, for example, “name registration”, “change”, “AC change”, “delete”, and the like. Here, “name registration” means that the user terminal 50 associates the domain name and address of its own terminal with the name information, the access control list of the domain name corresponding to the other user terminal 50, and other users. This indicates that a request for registration of information indicating whether or not to permit the provision of name information is made when name resolution from the domain name corresponding to the terminal 50 is performed. “Change” indicates that the user terminal 50 has requested to change the address corresponding to the domain name of the terminal itself. “AC change” indicates that an ACL change request has been made in the previous name registration. “Delete” indicates that a name registration deletion request made previously has been made.
The domain name is the domain name of the transmission source of the information registration request. Control indicates the control information changed by the information registration request. ACL indicates an access control list changed by the information registration request. The address indicates an address corresponding to the domain name.

In response to the log acquisition request transmitted from the maintenance terminal device 60, the log collection reception unit 22 reads the log stored in the work log storage unit 23 and transmits it to the maintenance terminal device 60.
The management network 70 is a communication network that connects the name resolution device 10, the information registration receiving device 20, and the maintenance terminal device 60. In order to ensure safety, the management network 70 is preferably a network that is logically or physically separated from the service network 80 described later.

  The maintenance terminal device 60 is a terminal used by an administrator who manages the name resolution system using the name resolution control device according to the present embodiment, and includes a log acquisition unit 61. The log acquisition unit 61 makes a log information acquisition request to the information registration reception device 20 via the management network 70, and receives log information returned from the log collection reception unit 22 of the information registration reception device 20.

  The service network 80 is a communication network that connects the name resolution device 10, the information registration reception device 20, and the network termination device 30. The service network 80 is not limited as long as it can perform information communication. In the present embodiment, the service network 80 will be described assuming the so-called Internet.

  The user terminal 50 is an information terminal used by a user, and can connect to the service network 80 via the network termination device 30 and perform information communication with other information devices. Specifically, the user terminal 50 includes an input unit, an output unit, a control unit, a calculation unit, and a storage unit such as a PC (Personal Computer), a PDA (Personal Digital Assistant), a mobile phone terminal, and a computer game machine. Computer equipment is applied. Here, a display part, an audio | voice output part, etc. are assumed as an output part. The user terminal 50 may be a home appliance that performs communication via a network.

The user terminal 50 includes an application 51. The application 51 is a software program that makes a connection request to another user terminal 50 via the service network 80. For example, a web browser for browsing a website, mail software for sending and receiving e-mail, game software for playing a game by communicating with other user terminals 50 via a network, and the like are applied to the application 51. The Also, the application 51 sends an information registration request such as name information in which the domain name and address of its own terminal are associated with each other and access information via the network terminating device 30 in response to an input of an information registration request from the user. It transmits to the information registration reception apparatus 20.
In the description of this embodiment, the user of the user terminal 50-1 is Alice, the user of the user terminal 50-2 is Bob, and the user of the user terminal 50-3 is Carol.

  The network termination device 30 is a device that relays connection from the user terminal 50 to the service network 80, and includes a name control unit 31 and a name resolution unit 32. The name control unit 31 adds arbitrary line information to the information registration request transmitted from the user terminal 50 and forwards the information to the information registration receiving apparatus 20. The name resolution unit 32 transmits a name resolution request to the name resolution device 10 in response to the name resolution request from the application 50. In FIG. 1, a user terminal 50-1 is connected corresponding to the network termination device 30-1, and the other network termination device 30-2, network termination device 30-3,... Network termination device 30- N is also connected to the user terminal 50-2, the user terminal 50-3,..., The user terminal 50-N in a one-to-one relationship. You may make it connect.

  Next, an operation example in which the name resolution control device according to the present invention provides a name resolution service to the user terminal 50 and the network termination device 30 will be described.

<Name registration>
FIG. 3 is a sequence diagram illustrating an example in which the user terminal 50-1 registers name information in the name resolution device 10, and a diagram illustrating an example of data handled in each step.
First, the user terminal 50-1 responds to the name resolution result in response to the name resolution request from the domain name “bob” and the domain name “dave” with “alice”, which is an arbitrary domain name of the terminal itself, as the name resolution target. Is generated and transmitted to the network terminating device 30-1 (step S10). FIG. 3A shows an example of access information data generated by the user terminal 50-1.

  When the network termination device 30-1 receives the access information transmitted from the user terminal 50-1, the network termination device 30-1 adds the line information stored in the storage area of the own device and transfers it to the information registration receiving device 20 (step S20). . (B) of FIG. 3 is a figure which shows the example of data of the access information which the network termination apparatus 30-1 added line information. Here, the identification information of the communication line to which the network terminating device 30-1 is connected is “1234567”.

  When receiving the access information transmitted from the network terminating device 30-1, the name information control receiving unit 21 of the information registration receiving device 20 transfers the access information to the name resolution device 10 via the management network 70 (step S30). At this time, the name information control accepting unit 21 stores the access information received from the network terminating device 30-1 in the work log storage unit 23. Here, an example of log data stored in the work log storage unit 23 is shown in FIG.

  When the access information control unit 12 of the name resolution device 10 receives the access information transmitted from the information registration receiving device 20, the access information control unit 12 reads an address corresponding to the line information included in the access information from the line identification information storage unit 16. The access information control unit 12 determines whether the address read from the line identification information storage unit 16 matches the address included in the access information received from the network terminating device 30-1. If the access information control unit 12 determines that they do not match, the access information control unit 12 determines that the access is unauthorized and ends the process. On the other hand, when the access information control unit 12 determines that the address read from the line identification information storage unit 16 matches the address included in the access information received from the network terminating device 30-1, the access information storage unit 13 stores the access information. Remember. FIG. 3D is an example of access information data stored in the access information storage unit 13. Further, the access information control unit 12 causes the name information storage unit 14 to store the domain name and address included in the access information received from the information registration receiving device 20 as name information. FIG. 3E is a data example of name information stored in the name information storage unit 14.

<Name resolution (permission)>
Next, referring to FIG. 4, a sequence diagram illustrating an example in which the user terminal 50-2 transmits a name resolution request to the name resolution device 10, and a diagram illustrating an example of data handled in each step thereof. .
First, the user terminal 50-2 transmits a name resolution request whose name resolution target is “alice” to the network terminating device 30-2 (step S110). FIG. 4A is a diagram illustrating a data example of a name resolution request transmitted by the user terminal 50-2. Then, the network terminating device 30-2 adds the line information stored in the own device to the name resolution information received from the user terminal 50-2, and transmits it to the name resolution device 10 (step S120). FIG. 4B is a data example of a name resolution request transmitted from the network terminating device 30-2 to the name resolution device 10. Here, the line information of the communication line to which the network terminating device 30-2 is connected is “234567”.

  When the name resolution accepting unit 15 of the name resolution device 10 receives the name resolution information received from the network terminating device 30-2, the access information control unit 12 determines whether to transmit the name resolution result for the name resolution. Perform screening process. In the screening process, the access information control unit 12 accesses, from the access information storage unit 13, access information in which “alice”, which is the name resolution target domain name, is associated with the domain name “bob”, which is the name resolution request source. Is read. Here, the access information storage unit 13 stores the access information as shown in FIG. 4C in step S40 described above. When the access information control unit 12 refers to the access information storage unit 13 and reads that the control information of the domain name “bob” whose name is the domain name “alice” is “allow”, the name resolution result Is determined to be permitted to be transmitted (step S130).

  When the access information control unit 12 determines that the transmission of the name resolution result is permitted, the name resolution accepting unit 15 reads the address corresponding to the domain name “alice” from the name information storage unit 14 and the network termination device 30- 2 (step S140). (D) of FIG. 4 is a figure which shows the example of data of the name resolution result which the name resolution apparatus 10 transmits to the network termination | terminus apparatus 30-2. When receiving the name resolution result, the network terminating device 30-2 transfers the result to the user terminal 50-2 (step S150).

  Here, the screening process performed by the name resolution device 10 in step S130 will be described in detail with reference to FIG. FIG. 5 is a flowchart showing the screening process performed by the name resolution device 10. First, when the name resolution accepting unit 15 receives the name resolution request (step S131), the access information control unit 12 obtains an address corresponding to the transmission source line information of the received name resolution request from the line identification information storage unit 16. read out. The access information control unit 12 determines whether the address read from the line identification information storage unit 16 matches the address included in the name resolution request received in step S131 (step S132). If the access information control unit 12 determines that they do not match (NO in step S132), the access information control unit 12 determines unauthorized access, does not transmit the name resolution result corresponding to the name resolution request, and ends the process as no response. (Step S135). On the other hand, if the access information control unit 12 determines in step S132 that they match (step S132-YES), the access information control unit 12 reads name information corresponding to the domain name that is the name resolution target from the access information storage unit 13 (step S133).

Based on the access information read from the access information storage unit 13, the access information control unit 12 is permitted to transmit the name resolution result for the domain name to be resolved from the domain name of the name resolution request source. It is determined whether or not there is (step S134). If the access information control unit 12 determines in step S134 that the transmission of the name resolution result is permitted (step S134-YES), the name resolution accepting unit 15 reads the name resolution target domain from the name information storage unit 14. The address corresponding to the name is read and transmitted to the name resolution request source (step S137). On the other hand, if the access information control unit 12 determines in step S134 that transmission of the name resolution result is not permitted (step S134-NO), the name resolution accepting unit 15 does not have a domain name to be resolved. A name resolution result indicating this is transmitted to the transmission source of the name resolution request (step S136). Here, when the access information control unit 12 determines in step S134 that the transmission of the name resolution result is not permitted, the access information control unit 12 may end the process and make no response. . The name resolution result indicating that there is no domain name subject to name resolution is, for example, a name resolution result in which the name result address is NULL data.
In the present embodiment, the name resolution device 10 includes the line identification information storage unit 16, and the access information control unit 12 refers to the information stored in the line identification information storage unit 16 in step S132 described above. Whether or not the request source of the name resolution request is correct is determined. For example, when the address system includes the line identification information in the IPv6 address, the name information storage unit 14 is referred to. Thus, it can be determined whether or not the request source of the name resolution request is correct.

<Name resolution (disallowed)>
Next, referring to FIG. 6, a sequence diagram illustrating an example in which the user terminal 50-3 transmits a name resolution request to the name resolution device 10, and a diagram illustrating an example of data handled in each step. .
First, the user terminal 50-3 transmits a name resolution request whose name resolution target is “alice” to the network terminating device 30-3 (step S210). FIG. 6A is a diagram illustrating a data example of a name resolution request transmitted by the user terminal 50-3. Then, the network terminating device 30-3 adds the line information stored in the own device to the name resolution information received from the user terminal 50-3, and transmits it to the name resolution device 10 (step S220). FIG. 6B is a data example of a name resolution request transmitted from the network termination device 30-2 to the name resolution device 10. Here, the line information of the communication line to which the network terminating device 30-3 is connected is “345678”.

  When the name resolution accepting unit 15 of the name resolution device 10 receives the name resolution information received from the network terminating device 30-3, the access information control unit 12 determines whether to transmit the name resolution result for the name resolution. Perform screening process. In the screening process, the access information control unit 12 accesses, from the access information storage unit 13, access information in which “alice” that is the name name of the name resolution target is associated with the domain name “carol” that is the name resolution request source. Here, as shown in (c) of FIG. 6, there is no access information in which “alice” and “carol” are associated with each other, as shown in FIG. The control unit 12 determines that transmission of the name resolution result is not permitted (step S230).

  If the access information control unit 12 determines that the transmission of the name resolution result is not permitted, the name resolution accepting unit 15 transmits the name resolution result having the address of the name resolution result as NULL data to the network terminating device 30-3. (Step S240). FIG. 6D is a diagram illustrating a data example of a name resolution result transmitted from the name resolution device 10 to the network termination device 30-3. When receiving the name resolution result, the network terminating device 30-3 transfers the result to the user terminal 50-3 (step S250).

<Address change request>
The user terminal 50-1 according to the present embodiment communicates with the network using an IPv6 address for performing communication with the IPv6 network. Here, a communication terminal having an IPv6 address according to IPv6 has a characteristic that the identifier of the interface in the IPv6 address is constant even when connected to the network at a different location. This characteristic is linked to the problem of privacy, and in order to solve this problem, in IPv6, changing the setting of the IPv6 address used by the terminal at a certain period of time is an RFC (Request by RFC) compiled by the Internet Engineering Task Force (IETF). For Comment) 3041. Hereinafter, an example of an operation in which the user terminal 50-1 transmits the changed address to the name resolution device 10 when the address is changed at regular intervals according to RFC3041 will be described.

FIG. 7 is a sequence diagram illustrating an example in which the user terminal 50-1 transmits name information to the name resolution device 10 to make an address change request, and a diagram illustrating an example of data handled in each step.
When the user terminal 50-1 changes the address of its own terminal from “1111: 1” to “1111: 2”, the user terminal 50-1 has the domain name “alice” and the address “1111: 2”. Is generated, and an address change request including the generated name information is transmitted to the network terminating device 30-1 (step S310). (A) of FIG. 7 is a data example of name information included in the address change request transmitted by the user terminal 50-1 in step S310.

  When receiving the address change request transmitted from the user terminal 50-1, the network terminating device 30-1 adds the line information stored in the storage area of the own device and forwards it to the name resolution device 10 (step S320). . FIG. 7B is a diagram illustrating a data example of access information to which the network termination device 30-1 has added line information.

  When receiving the address change request transmitted from the network terminating device 30-1, the name information control accepting unit 21 of the information registration accepting device 20 transfers the received address change request to the name resolution device 10 via the management network 70. (Step S330). At this time, the name information control accepting unit 21 stores the access information received from the network terminating device 30-1 in the work log storage unit 23. Here, an example of log data stored in the work log storage unit 23 is shown in FIG.

When receiving the address change request transmitted from the information registration accepting device 20, the access information control unit 12 of the name resolution device 10 reads the name information included in the address change request and matches the domain name included in the read name information. The domain name to be read is read from the name information storage unit 14, and the domain name and the address included in the address change request are associated with each other and updated and stored in the name information storage unit 14. FIG. 7D is a data example of name information stored in the name information storage unit 14.
Thus, a terminal connected to an IPv6 network and having an IPv6 address can take an effective security measure against threats such as address leakage by periodically changing the address.

<Change access control list>
FIG. 8 is a sequence diagram illustrating an example in which the user terminal 50-1 makes an access control list change request to the name resolution device 10, and a diagram illustrating an example of data handled in each step.
First, the access information indicating that the user terminal 50-1 does not permit the response of the name resolution result to the name resolution request from the domain name “dave” whose name is the domain name “alice” of the terminal itself. Is transmitted to the network terminating device 30-1 (step S410). FIG. 8A is an example of access information data transmitted by the user terminal 50-1 in step S410.

  When receiving the access information transmitted from the user terminal 50-1, the network terminating device 30-1 adds the line information stored in the storage area of the own device and transfers it to the name resolution device 10 (step S420). (B) of FIG. 8 is a figure which shows the example of data of the access information which the network termination apparatus 30-1 added line information.

  When receiving the access information transmitted from the network terminating device 30-1, the name information control receiving unit 21 of the information registration receiving device 20 transfers the received access information to the name resolution device 10 via the management network 70 ( Step S430). At this time, the name information control accepting unit 21 stores the access information received from the network terminating device 30-1 in the work log storage unit 23. Here, an example of log data stored in the work log storage unit 23 is shown in FIG.

When the access information control unit 12 of the name resolution device 10 receives the access information transmitted from the information registration receiving device 20, the access information control unit 12 updates the access information stored in the access information storage unit 13 based on the received access information. Here, the access information control unit 12 deletes the access information of the ACL “dave” associated with the domain name “alice”. FIG. 8D is a data example of access information stored in the access information storage unit 13.
As described above, a terminal connected to the IPv6 network and having an IPv6 address can take effective security measures against threats such as address leakage by periodically changing the access control list.

<Delete name>
FIG. 9 is a sequence diagram illustrating an example in which the user terminal 50-1 makes a name deletion request to the name resolution device 10, and a diagram illustrating an example of data handled in each step.
First, the user terminal 50-1 transmits a name deletion request for “alice”, which is the domain name of its own terminal, to the network terminating device 30-1 (step S410). (A) of FIG. 9 is a data example of the name deletion request transmitted by the user terminal 50-1 in step S510.

  When receiving the name deletion request transmitted from the user terminal 50-1, the network terminating device 30-1 adds the line information stored in the storage area of the own device and transfers it to the name resolution device 10 (step S520). . FIG. 9B is a diagram illustrating a data example of a name deletion request to which network termination device 30-1 has added line information.

  When receiving the name deletion request transmitted from the network terminating device 30-1, the name information control receiving unit 21 of the information registration receiving device 20 transfers the received access information to the name resolution device 10 via the management network 70. (Step S530). At this time, the name information control accepting unit 21 stores the access information received from the network terminating device 30-1 in the work log storage unit 23. Here, an example of log data stored in the work log storage unit 23 is shown in FIG.

  When the access information control unit 12 of the name resolution device 10 receives the name deletion request transmitted from the information registration receiving device 20, the access information control unit 12 updates the name information stored in the name information storage unit 14 based on the received name deletion request. To do. Here, the access information control unit 12 deletes the name information whose domain name is “alice” from the access information storage unit 13.

  In the present embodiment, the name resolution control device is configured by the name resolution device 10 and the information registration accepting device 20, but each functional unit described in the present embodiment is physically as described above. The administrator of the name resolution control apparatus can be flexibly configured in consideration of the number of users of the system, the operation system of the service, existing hardware resources, and the like.

  In the present embodiment, the name information storage unit 14 included in the name resolution device 10 has been described as storing name resolution information in association with domain names and IPv6 addresses. However, the name information storage unit 14 stores the name resolution information. The name resolution information may store information in which a domain name is associated with IPv4, and the name resolution device 10 may perform name resolution using IPv4.

<Second Embodiment>
An example in which the technology described above is applied to an online network game will be described.
FIG. 10 is a conceptual diagram showing a game system using the name resolution control device 100 in the present embodiment. The game system according to the present embodiment includes a name resolution control device 100, an information registration reception device 200, a game terminal 150-1, a game terminal 150-2, and a game terminal 150-3. These devices and terminals can communicate via a network. In the present embodiment, three user terminals are illustrated and described as an example, but any number of user terminals may be connected to the game system.

  The name resolution control device 100 is a combination of the name resolution device 10 and the information registration receiving device 20 in the first embodiment, and the name resolution device 10 and the information registration in the first embodiment both in configuration and operation. This is the same as the receiving device 20. The presence server 200 includes a presence information storage unit that stores the usage status of the user of each terminal of the game terminal 150. An example of data of presence information provided in the presence server 200 is shown in a. As shown in FIG. 10a, the presence information stores a terminal name, a state, an application name, and other information. The terminal name is terminal identification information. The status is information indicating the status of the corresponding terminal. For example, information such as “Active” indicating that the terminal is connected to the network (online) and “Sleep” indicating that the terminal is not connected to the network are stored in the state. The application name is information indicating an application connected to the network inside the corresponding terminal. In addition, additional information other than those described above is stored.

  The game terminal 150-1 is a game terminal used by Alice, and has a function of playing an online game with other game terminals via a network. The game terminal 150-2 is a game terminal used by Bob, and the game terminal 150-3 is a game terminal used by Carol.

  First, the game terminal 150-1 starts using the game application “XX-GAME” and makes a name resolution request from Bob and Carol to the name resolution control device 100 in order to accept a connection from an acquaintance. Is transmitted (step S610). Furthermore, the game terminal 150-1 registers information indicating online in the presence server 200 in order to recruit participants in the game (step S620).

  Then, the game terminal 150-2 starts using XX-GAME (step S630). Then, the game terminal 150-2 inquires of the presence server 200 about members who can use XX-GAME (step S640). When the game terminal 150-2 detects that Alice is online from the presence information stored in the presence server 200, the game terminal 150-2 makes an Alice name resolution request to the name resolution control device 100 (step S650). Based on the address acquired as the name resolution result, a connection request is made to the game terminal 150-1, and an online game is started.

Further, assuming that the domain name of the own terminal sent from the information terminal is only the information of the own terminal, the network terminating device may add additional information such as line information to the domain name and send it to the network. . An example in which such an embodiment is applied to an online network type game will be described below.
FIG. 11 is a diagram illustrating an example in which the domain name transmitted by the information terminal is registered as presence information in the presence server 200 in the present embodiment.
In the present embodiment, the user alice uses a game terminal 150-1-1 and a PC (personal computer) 150-1-2 as information terminals. The game terminal 150-1-1 includes a game application 151-1-1 having an identifier “game01” and a communication function unit 152 that can communicate with the name resolution control device 100 and the presence server 200 via a network. Yes. Further, the game terminal 150-1-1 and the PC 150-1-2 are connected to the network terminal device 130-1, and the network terminal device 130-1 is connected to the game terminal 150-1-1 and the PC 150-1-2. And relay communication with the network.
Similarly, the game terminal 150-2 used for the user bob includes a game application 151-2 and a communication function unit 152-2, and the network terminal device 130-2 includes a game terminal 1500-2 and a network. Relay communication with

  First, the user alice inputs his / her handle name “alice” in the game to the game terminal 150-1-1 (step S700). Then, the game application 151-1-1 generates a domain name “alice.game01” obtained by adding its own identifier “game01” to the input handle name (step S 701). Then, the communication function unit 152-1-1 adds the identifier “ps3” of the game terminal 150-1-1 to the handle name generated by the game application 151-1-1, and adds the domain name “alice.game01.ps3”. Is generated and transmitted to the network terminating device 130-1 (step S702).

  The network terminating device 130-1 adds predetermined line information, network information, and the like to the domain name transmitted from the game terminal 150-1-1 and adds the domain name “alice.game01.ps3.1345.p2p. xxx.com "is transmitted to the presence server 200 (step S703). The presence server 200 stores the domain name received from the network terminating device 130-1 in association with information (b) whose state is “active”.

  Further, the PC 150-1-2 transmits its host name “hoge” to the network terminating device 130-1 (step S705). The network terminating device 130-1 adds a predetermined line information, network information, etc. to the host name “hoge” of the PC 150-1-2 to generate a domain name “hoge.12345.p2p.xxx.com”. Then, it is transmitted to the presence server 200 (step S706). The presence server 200 stores information (c) in which the state is “active” in association with the domain name received from the network terminating device 130-1. Here, (a) shows presence information stored in the presence server 200.

Next, an example in which the game terminal 150-2 acquires presence information registered in the presence server 200 will be described with reference to FIG.
When the user bob starts a game using the game terminal 150-2 (step S710), the game application 151-2 makes a player search request using “* .game01. *” As search information (step S711). . Then, the communication function unit 152-2 transmits a player request from the game application 151-2 to the network terminating device 130-2 (Step S712). Then, the network terminating device 130-2 transmits a player search request to the presence server 200 (step S713).

  When the presence server 200 receives the player search request transmitted from the network terminating device 130-1, the presence server 200 reads presence information corresponding to the search information “* .game01. *” From the stored presence information (a) (step S1). S714, step S715). Then, the presence server 200 transmits presence information as shown in (b) to the network terminating device 130-2 (step S716). When receiving the presence information transmitted from the presence server 200, the network terminating device 130-2 transfers the received presence information to the game terminal 150-2 (step S717). Then, the game application 151-2 acquires the presence information received by the communication function unit 152-2 (step S718).

Next, an operation example in which the game terminal 150-2 registers access information in the name resolution control apparatus 100 will be described with reference to FIG.
First, the user bob inputs his / her handle name “bob” in the game to the game terminal 150-2 (step S720). Then, the game application 151-2 generates a domain name “bob.game01” obtained by adding its own identifier “game01” to the input handle name (step S721). Then, the communication function unit 152-2 adds the identifier “ps3” of the game terminal 150-2 to the handle name generated by the game application 151-2, generates the domain name “bob.game01.ps3”, and Access information permitting access from alice is transmitted to the network terminating device 130-1 (step S722).

  The network terminating device 130-2 adds predetermined line information, network information, and the like to the domain name transmitted from the game terminal 150-2, so that the domain name “bob.game01.ps3.2234.p2p.xxx. com "is transmitted to the name resolution control apparatus 100 (step S723). When the name resolution control apparatus 100 refers to the information (c) in which the address stored in advance and the FQDN are associated with each other and determines that the received access information is transmission from the correct source, the network termination apparatus 130-2 The access information (d) received from is stored.

Next, an example in which the game terminal 150-1-1 makes a name resolution request with the game terminal 150-2 as a name resolution target will be described with reference to FIG.
First, the user alice inputs his / her handle name “alice” in the game to the game terminal 150-1-1 (step S730). Then, the game application 151-1-1 generates a domain name “alice.game01” obtained by adding its own identifier “game01” to the input handle name (step S 731). Then, the communication function unit 152-1-1 adds the identifier “ps3” of the game terminal 150-1-1 to the handle name generated by the game application 151-1-1, and adds the domain name “alice.game01.ps3”. ”And a name resolution request (b) for“ bob ”as a name resolution target is transmitted to the network terminating device 130-1 based on the presence information acquired from the presence server 200 (step S732).

  The network terminating device 130-1 adds predetermined line information, network information, etc. to the domain name of the game terminal 150-1-1 included in the name resolution request transmitted from the game terminal 150-1-1. The domain name “alice.game01.ps3.1345.p2p.xxx.com” is generated and transmitted to the name resolution control apparatus 100 (step S733). When the name resolution control device 100 refers to the information (c) in which the address stored in advance and the FQDN are associated with each other and determines that the received name resolution request is an inquiry from the correct source, the name resolution control device 130- The access information (d) corresponding to the name resolution request received from 1 is read out. Here, since the name resolution request from the license to bob is permitted, the name resolution control device 100 responds to the network termination device 130-1 with the name resolution result corresponding to the name resolution request.

  As described above, according to the present embodiment, the network terminal adds network information such as line information to the identifier transmitted from the information terminal, so that the information terminal transmits and receives presence information only by the identifier of the own terminal. The access information can be transmitted. In this way, it is possible to perform screening for selecting whether or not to transmit a name resolution result using a name resolution function that is generally provided in an information terminal in a widely used DNS. A system for screening name resolution requests can be constructed.

  In addition, the program for realizing the function of the processing unit in the present invention is recorded on a computer-readable recording medium, and the program recorded on the recording medium is read by the computer system and executed to control name resolution. May be performed. Here, the “computer system” includes an OS and hardware such as peripheral devices. The “computer system” includes a WWW system having a homepage providing environment (or display environment). The “computer-readable recording medium” refers to a storage device such as a flexible medium, a magneto-optical disk, a portable medium such as a ROM and a CD-ROM, and a hard disk incorporated in a computer system. Further, the “computer-readable recording medium” refers to a volatile memory (RAM) in a computer system that becomes a server or a client when a program is transmitted via a network such as the Internet or a communication line such as a telephone line. In addition, those holding programs for a certain period of time are also included.

  The program may be transmitted from a computer system storing the program in a storage device or the like to another computer system via a transmission medium or by a transmission wave in the transmission medium. Here, the “transmission medium” for transmitting the program refers to a medium having a function of transmitting information, such as a network (communication network) such as the Internet or a communication line (communication line) such as a telephone line. The program may be for realizing a part of the functions described above. Furthermore, what can implement | achieve the function mentioned above in combination with the program already recorded on the computer system, and what is called a difference file (difference program) may be sufficient.

It is a figure which shows the structure of the name resolution control system by the 1st Embodiment of this invention. It is a figure which shows the data structure which the name resolution control apparatus by the 1st Embodiment of this invention memorize | stores. It is a sequence diagram which shows the name registration process by the 1st Embodiment of this invention. It is a sequence diagram which shows the name resolution process (permission) by the 1st Embodiment of this invention. It is a flowchart which shows the name resolution process by the 1st Embodiment of this invention. It is a sequence diagram which shows the name resolution process (non-permission) by the 1st Embodiment of this invention. It is a sequence diagram which shows the address change request process by the 1st Embodiment of this invention. It is a sequence diagram which shows the access control list change process by the 1st Embodiment of this invention. It is a sequence diagram which shows the name deletion process by the 1st Embodiment of this invention. It is a figure which shows the operation example of the name resolution control apparatus by the 2nd Embodiment of this invention. It is a figure which shows the operation example of the name resolution control apparatus by the 2nd Embodiment of this invention. It is a figure which shows the operation example of the name resolution control apparatus by the 2nd Embodiment of this invention. It is a figure which shows the operation example of the name resolution control apparatus by the 2nd Embodiment of this invention. It is a figure which shows the operation example of the name resolution control apparatus by the 2nd Embodiment of this invention.

Explanation of symbols

DESCRIPTION OF SYMBOLS 10 Name resolution apparatus 12 Access information control part 13 Access information storage part 14 Name information storage part 15 Name resolution reception part 16 Line identification information storage part 20 Information registration reception apparatus 21 Name information control reception part 22 Log collection reception part 23 Work log storage Unit 30 Network termination device 31 Name control unit 32 Name resolution unit 50 User terminal 51 Application 60 Maintenance terminal device 61 Log acquisition unit 70 Management network 80 Service network 100 Name resolution control device 130 Network termination device 150 Game terminal 151 Game application 152 Communication function 200 Presence server

Claims (6)

A name resolution control device connected via a network to an information terminal having a domain name and an address corresponding to the domain name as an identifier of the own terminal,
Name information storage means for storing in advance a first domain name and an address corresponding to the first domain name;
Name resolution means for receiving a name resolution request for name resolution of the first domain name, reading out the address corresponding to the first domain name from the name information storage means, and responding as a name resolution result; ,
The address corresponding to a name resolution request in which the first domain name is a name resolution target and the second domain name is a source in association with the first domain name and the second domain name Access information storage means for storing access information including control information indicating whether or not to transmit a name resolution result including:
When the name resolution unit receives a name resolution request with the first domain name as a name resolution target and the second domain name as a source, the name resolution unit receives the first domain name from the access information storage unit. Access information control for reading the access information associated with the second domain name and operating the name resolution means when the control information included in the access information indicates that name resolution is permitted Means,
A name resolution control device comprising: Access information receiving means for receiving, from the information terminal having the first domain name as an identifier, the access information including the second domain name associated with the first domain name and the control information When,
Access information registration means for storing the access information received by the control information receiving means in the access information storage means;
The name resolution control device according to claim 1, further comprising: Name information receiving means for receiving, from the information terminal, name information of a domain name that is an identifier of the information terminal and an address associated with the domain name;
Name information registration means for storing the name information received by the name information receiving means in the name information storage means; and
3. The name resolution unit responds to the name resolution result based on the name information stored in the name information storage unit by the name information registration unit. The name resolution control apparatus according to item 1. The log storage means for storing either or both of the access information received by the access information receiving means and the name information received by the name information receiving means is further provided. 4. The name resolution control device according to any one of up to 3. The access information control means stores a domain name that is an identifier of the information terminal and an address pre-assigned to the domain name, and the name resolution request received by the name resolution means or the access information reception means receives 5. The method according to claim 1, further comprising: determining whether an address corresponding to a domain name of a source of the access information to be transmitted is an address allocated in advance to the domain name. The name resolution control apparatus according to item 1. A name resolution control method for a name resolution control apparatus connected via an information terminal having a domain name and an address corresponding to the domain name as an identifier of the own terminal, respectively,
A step in which name information storage means stores in advance a first domain name and an address corresponding to the first domain name;
The access information storage means associates the first domain name and the second domain name with each other, and uses the first domain name as a name resolution target and the second domain name as a source Storing access information including control information indicating whether to transmit a name resolution result including the address corresponding to the request;
A name resolution means for receiving a name resolution request with the first domain name as a name resolution target and the second domain name as a source;
The access information control means reads the access information in which the first domain name and the second domain name are associated from the access information storage means, and the control information included in the access information is a name When indicating that the resolution is permitted, the name resolution means reads the address corresponding to the first domain name from the name information storage means, and responds as a name resolution result;
A name resolution control method comprising:

Images