JP4705656B2 - Address translation device, address translation program - Google Patents

Description

  The present invention relates to an address translation device (hereinafter referred to as “NAT device”) that performs address translation for communication between a first terminal in a private IP address network and a second terminal in a global IP address network.

  Currently, an Internet service provider (hereinafter referred to as “ISP”) assigns one global IP address to one user for each line connection of the user. The global IP address is a fixed-length, finite number system, and is a globally unique IP address used in a global IP address network to which the world is connected. However, due to the exhaustion of global IP addresses, it is becoming difficult for the ISP to assign one global IP address to one user for each line connection.

Therefore, there is a technique called NAT (Network Address Translator) as a technique for efficiently using a global IP address in TCP and UDP. NAT is a technology that performs address conversion for communication between a terminal (for example, a user terminal) in a network having a private IP address and a terminal (for example, a Web server) in a global IP address network. The private IP address refers to an IP address used only in a private IP address network that cannot be connected to the global IP address network. Basically, NAT is a technology that makes a one-to-one correspondence between a private IP address of a terminal in a private IP address network and a global IP address held by the NAT. However, in a broad sense, NAT includes a technology that associates a plurality of private IP addresses with one global IP address by performing port number conversion in TCP and UDP in addition to address conversion. In the present invention, the NAT includes a technique that allows a single global IP address to be shared by a plurality of private IP addresses by changing the port number in addition to the IP address. Details of the NAT technology are described in Non-Patent Document 1, Non-Patent Document 2, and Non-Patent Document 3. Such a technique is sometimes referred to as NAPT (Network Address Port Translation), IP masquerade, or the like.
K. Egevang, “The IP Network Address Translator (NAT)”, RFC1631, May 1994 P. Srisuresh, “IP Network Address Translator (NAT) Terminology and Considerations”, RFC2663, August 1999 P. Srisuresh, “Traditional IP Network Address Translator (Traditional NAT)” RFC3022, January 2001

However, there are several problems when ISP uses NAT technology. For one thing, ISPs are required to identify users of their own services based on requests / commands from other Internet-connected organizations and courts, and to deal with those users. When an existing ISP assigns one global IP address to one user for each line connection of the user, the ISP assigns the time, user ID, and assigned global IP address (hereinafter, these data) for each line connection. Are also recorded as “allocation log A”). In addition, a terminal global IP address, a source port number, and an incoming time (hereinafter referred to as “incoming log”) are recorded for each connection in a terminal that has received an incoming call (for example, “Web server”). Therefore, the user can be specified by examining the allocation log A and the incoming call log. Here, the connection refers to a virtual communication path for exchanging data between terminals, and is established for each file such as an html file or an image file. Therefore, in order to browse one web page, if there are many html files, image files, etc., 100 connections or more may be established. Note that UDP is called connectionless communication, but the connection in the present invention includes communication completed with a single UDP packet, and the source IP address, source port number, destination IP address, destination port number. Communication including a plurality of the same continuous UDP packets is included. FIG. 1 shows a system configuration example of an Internet connection service provided by an existing ISP, FIG. 2 shows a data example of an allocation log A, and FIG. 3 shows a data example of an incoming call log. More specifically, the incoming log is
192.0.2.10 65003 ・ ・ [16 / Apr / 2008: 12: 34: 45 +0900] “GET / HTTP / 1.1” 200 420 “-” ”Mozilla / 4.0 (compatible; MSIE5.5; Windows (registered trademark) 98 ) ”
192.0.2.22 50237 ・ ・ [16 / Apr / 2008: 15: 00: 54 +0900] “GET / HTTP / 1.1” 200 420 “-” ”Mozilla / 4.0 (compatible; MSIE5.5; Windows (registered trademark) 98 ) ”
Is displayed. The first value, for example, “192.0.2.10” represents the source global IP address, and the next value, for example, “65003” represents the source boat number. Note that the protocol type such as TCP or UDP may not be recorded in the incoming call log as in the data example of FIG. 3, but depending on the application type, the function of the destination server, etc. It is clear whether the protocol is used.

  For example, slander, murder notice, etc. are written on an electronic bulletin board on the Web server 650 (a Web page where participants can freely post texts and communicate by continuing to write) to identify the writer. If necessary, the caller global IP address and the call arrival time are checked from the call log stored in the call log storage unit 660, and the call is received from the assignment log A of the assignment log storage unit 630 that records the global IP address assigned by the router 620. By examining the user ID assigned the global IP address at the time, the user can be uniquely identified.

  However, if the conventional NAT technology is used, a plurality of private IP addresses correspond to one global IP address, and therefore it is not possible to specify a user only by examining the allocation log A and the incoming log of the web server. An object of the present invention is to provide an economical NAT device that can identify a user.

  An address translation device that performs address translation during communication between a first terminal in a private IP address network and a second terminal in a global IP address network, and includes a pool storage unit, a packet transfer unit, and a packet translation unit. The pool storage unit stores a pool, which is a combination of a global IP address and a range of port numbers, over the number of private IP addresses and a private IP address corresponding to the pool. The packet transfer unit receives a packet from a terminal in the private IP address network, and transmits the packet after address conversion to the terminal in the global IP address network. The packet conversion unit acquires a private IP address from the packet received via the packet transfer unit, acquires pool information corresponding to the private IP address from the pool storage unit, and further, from the range of pool port numbers The port number is determined, and the private IP address and port number of the received packet are converted into the global IP address and port number of the determined pool.

  The private IP address can be uniquely specified from the incoming call log and the conversion rule, and it is not necessary to store a record of address conversion by NAT.

Prior to the description of the embodiment, a method for identifying a user using existing NAT technology will be analyzed.
As described above, when one global IP address is assigned to one user for each line connection of an existing user, the ISP only has to save only the assignment log A in order to uniquely determine the user. . The incoming log is saved by an administrator such as a Web server.
On the other hand, when the ISP uses NAT technology, in order to identify the user, the time assigned for each line connection, the user ID and the assigned source private IP address (hereinafter referred to as “allocation log B” together with these data) The following data must be saved: FIG. 4 shows an example of data of the allocation log B.

  Each time a connection is established, at least the source private IP address, the converted global IP address, the converted port number, the protocol type, and the connection time (hereinafter referred to as “conversion log”) are stored in the external storage device 900. There is a need to. FIG. 5 shows an example of conversion log data, FIG. 6 shows a system configuration example of an Internet connection service provided by an ISP using a NAT device, and FIG. 7 shows a configuration example of an existing NAT device and external storage device.

  Hereinafter, a case where the existing NAT technology is used will be described. The NAT device 1000 is mainly installed between the private IP address network 600 and the global IP address network 640. The NAT device 1000 does not have to establish a connection but establishes a global IP address corresponding to a private IP address and a TCP, UDP, etc. A port number (hereinafter simply referred to as “port number”) is assigned.

The existing NAT device 1000 includes a packet transfer unit 100, a conversion status holding unit 200, and a packet conversion unit 300. The NAT device 1000 receives a packet from the private IP address network 600 via the packet transfer unit 100, and the packet conversion unit 300 transmits a global IP address and a port for one connection according to a predetermined single rule. Assign a number.
The single rule set in advance is a method that uses the next number of the currently used port number in sequence. New port number = currently used port number + 1
Or a method that uses random numbers when assigning port numbers New port number = radix (49152) + random number (0 to 16383)
Etc. In addition, a single rule that does not use the combination of the global IP address and the port number held in the conversion status holding unit 200 may be used.

  In addition to the conversion log, the conversion status holding unit 200 holds a source port number, a destination global IP address, and a destination port number (hereinafter, these data are collectively referred to as “conversion status data”). FIG. 8 shows an example of conversion status data. The conversion status data is necessary to prevent the NAT device 1000 from assigning the same global IP address and port number combination to different connections. Also, since the NAT device 1000 receives the response packet from the destination and transfers the packet to the source, or converts other packets belonging to the same connection in the same manner, the conversion status is maintained. The unit 200 holds the unit 200 for a certain period (for example, about 2 minutes). For example, since the data from the Web server 650 is transmitted to the converted global IP address and the converted port number, the data is received by the packet transfer unit 100 of the NAT device 1000 and the data of the conversion status holding unit 200 is received. Based on this, the packet conversion unit 300 converts the address into a source private IP address and a source port number, and transmits the packet from the packet transfer unit 100 to the user.

  If the same global IP address and port number are assigned to different connections, it is unclear which connection should be used to transfer the data from the Web server. Control is performed based on the conversion status data so that a combination of an IP address and a port number is not assigned.

  Next, at least the conversion log in the conversion status data is transmitted to the external storage device 900 and stored. This storage is necessary to uniquely identify the user. A specific method will be described later. The packet conversion unit 300 converts the private IP address and port number included in the packet into a port number different from the global IP address, and the packet is transferred via the packet transfer unit 100 to a terminal in the global IP address network 640 (for example, Web Server 650).

  Here, a user identification method in the conventional NAT device will be described. The conventional NAT device 1000 shares one global IP address with a plurality of private IP addresses. Therefore, from the incoming log recorded in the incoming log storage unit 660, the source global IP address, the source port number, and the incoming time are known, but the NAT device 1000 converts the source global IP address and the source port number. It is the global IP address and port number after it has been received, and it cannot be uniquely identified by which private IP address among the sharers of the global IP address. Therefore, as long as the private IP address is not known, the user cannot be identified by examining the allocation log B.

  Here, in order to identify the private IP address from the source global IP address, source port number, and incoming time of the incoming log, the converted global IP address, the converted port number, the source private IP address, the protocol type, and the connection You need to save the time. By examining the conversion log and the allocation log B, the user can be uniquely specified.

  It should be noted that the fact that the private IP address and port number of the transmission source do not remain in the incoming call log, and only the global IP address after conversion and the port number after conversion remain, also has an aspect of enhancing security for the user. In other words, even if an incoming log is used to track and identify user behavior from a terminal in the global IP address network, it is the NAT device's global IP address on the incoming log, and the user can track and identify the behavior. I can be spared. Therefore, in the NAT technology, the idea of saving the conversion log was not originally provided for security. However, since ISPs are required to uniquely identify users, when using NAT technology, the conversion log is saved and the conversion log is saved so that the information is not falsified or leaked. The security of the external storage device 900 must also be ensured.

  In order to save a conversion log not by a small LAN but by an ISP having a large number of global IP addresses, a high-speed and large-capacity external storage device 900 is required, and its security must be strictly managed.

  For example, in order to record the conversion log of the NAT device, the source private IP address (32 bits), the converted global IP address (32 bits), the converted port number (16 bits), the protocol type (8 bits), the connection Time (64 bits) requires a storage capacity of 152 bits (19 bytes) in total for each connection established. If there are 10 html files, image files, etc. in one web page, it is necessary to store a total of (19 * 10) = 190 bytes every time one page is accessed.

  Assuming that one user accesses once a minute, that is, 60 accesses per hour and uses it for about 3 hours per day, he accesses (60 * 3) times per day, and about sixty months (60 * 3) * 180) Access about once. Here, the reason for setting the period to 6 months is that the ISP is required to store data for specifying the user for 6 months or more. As a result, (190 * 60 * 3 * 180) bytes per user = about 6 megabytes, for example, an ISP with 5 million users must save about 30 terabytes of data.

  Now, an embodiment of the present invention will be described.

  The NAT device 2000 that performs address conversion during communication between the first terminal in the private IP address network and the second terminal in the global IP address network includes a packet transfer unit 100, a conversion status holding unit 200, and a packet conversion unit 300. A pool storage unit 400 is included. FIG. 9 shows a system configuration example of the Internet connection service of the first embodiment, and FIG. 10 shows a functional configuration example of the NAT device of the first embodiment.

  The pool storage unit 400 stores a pool, which is a combination of a global IP address and a range of port numbers, in excess of the number of private IP addresses and a private IP address corresponding to the pool. By specifying the pool, it is sufficient to take a measure that allows the private IP address to be specified. A combination of a private IP address and a pool is called a conversion rule. FIG. 11 shows an example of data stored in the pool storage unit 400. For example, as shown in FIG. 11A, the port number range may be divided into consecutive port numbers (for example, 2000 numbers) and assigned. The NAT device 2000 described in the first embodiment includes a mechanism that automatically and “statically” determines a pool corresponding to a private IP address when setting a NAT device. “Static” means that the correspondence between the private IP address and the pool does not change depending on the user's line connection or the like, is determined when the NAT device is set, stored in the pool storage unit 400, and then manually changed, etc. This means that the correspondence between the private IP address and the pool does not change.

  A mechanism for automatically determining a pool as “static” when setting a NAT device will be described. A range of port numbers that can be used in advance (for example, 16384 ports from 49152 to 65535), the number of port numbers assigned for each private IP address (for example, 2000 ports), and a range of available global IP addresses (for example, , 192.0.2.1 to 192.0.2.16).

The range of port numbers that can be used is divided by the number of port numbers assigned for each private IP address, and the number of private IP addresses sharing one global IP address is calculated.
Number of shared private IP addresses = 16384 ÷ 2000 = 8.192
Therefore, one global IP address is shared by eight private IP addresses. Multiply the number of global IP addresses that can be used and the number of private IP addresses that can be shared to determine the number and range of private IP addresses to be assigned to users.
Number of global IP addresses (16) * Number of private IP addresses that can be shared (8) = 128 (pieces)
Therefore, the range and number of private IP addresses (for example, 128 from 10.0.0.1 to 10.0.0.128) are obtained.
Each private IP address (for example, “10.0.0.1”) is automatically assigned a pool (for example, “Global IP address 192.0.2.1 and port number range 49152 to 51151”) and converted. Create a rule.

  The range of port numbers may be one or more. However, as described above, the conversion status holding unit 200 holds the conversion status data for a certain period. Even for the same private IP address, the same combination of global IP address and port number cannot be assigned when different connections are established. If the same combination of global IP address and port number is assigned to the same private IP address when different connections are established, the data from the Web server may be transferred to any combination of private IP address and port number Therefore, control is performed based on the conversion status data so that the same combination of global IP address and port number is not assigned for a certain period. Therefore, the port number range is desirably about 100 or more and 2000 or less in order to establish a connection appropriately. For example, if the port number range is two, the number of connections that the user can establish simultaneously is two, and the third and subsequent connections are established until the conversion status data is deleted from the conversion status holding unit 200. Can not.

  Here, the number of connections that can be established in parallel at one time varies depending on the settings of the web browser or the like, but is generally about 2 to 16. If the number of connections that can be established in parallel at a time is four and there are 100 files on one Web page, the connection is established four by four and the connection is established 25 times. The conversion status holding unit 200 creates conversion status data every time a connection is established, and holds it for a certain period.

FIG. 12 shows the flow of packet conversion. The packet conversion unit 300 receives a packet from a terminal in the private IP address network via the packet transfer unit 100 (S101). An inquiry is made as to whether there is an entry corresponding to the received packet in the conversion status holding unit 200 (S102). If there is an entry, similarly, the private IP address is converted into a global IP address, and the port number is converted (S107). If there is no entry, it is determined that the connection is a new connection, the private IP address is acquired from the received packet, and the pool storage unit 400 is inquired (S103). If there is a private IP address in the pool storage unit 400 (S104), a pool corresponding to the private IP address is acquired (S105). If a packet from a private IP address that is not stored in the pool storage unit is received, the corresponding pool cannot be acquired, and the packet is discarded (S110). Further, the packet conversion unit 300 assigns a port number according to a predetermined single rule from the range of port numbers (S106). In addition, in the case of FIG. 11A, the predetermined single rule is a method in which the next next number that is currently used is sequentially used. New port number = currently used port number + 1
Or a method that uses random numbers when assigning port numbers New port number = radix (top of pool port number) + random number (0-1999)
Etc.

  Further, the packet conversion unit 300 checks whether the combination of the created global IP address and new port number and the combination of the global IP address and port number held in the conversion status holding unit 200 are the same. If both combinations are the same as a result of the inspection, port numbers are assigned again according to a predetermined single rule, and the process is repeated until different combinations are obtained (S107).

  When the converted global IP address and the converted port number are determined, the source private IP address and the source port number of the received packet are converted into the determined global IP address and port number (S108). Then, the packet is transmitted to the terminal in the global IP address network via the packet transfer unit 100 (S109).

  By converting the address in this way, the user can be uniquely identified by examining the incoming log, the conversion rule, and the allocation log B, and the ISP does not need to store the conversion log in the external storage device 900. This is because the source global IP address and the source port number are known from the incoming log of the incoming log storage unit 660, so that the private IP address can be specified from the corresponding conversion rule. The user can be uniquely determined from the private IP address, the allocation log B, and the incoming time.

[Modification 1]
Only the parts different from the first embodiment will be described below.
A mechanism for automatically determining a pool corresponding to a private IP address one-to-one “statically” when setting a NAT device may be determined as follows. As shown in FIG. 11B, the range of port numbers may be divided by the last digit value. In this case, a range of port numbers that can be used in advance (for example, 16384 numbers from 49152 to 65535) and a range of available global IP addresses (for example, 192.0.2.1 to 192.0.2.16). Up to 16). The range of port numbers that can be used in advance is divided into a range of 10 port numbers by the last digit value, so one global IP address is shared by 10 private IP addresses. As a result, the number and range of private IP addresses to be assigned to the user are obtained.
Number of global IP addresses (16) * Number of private IP addresses that can be shared (10) = 160 (pieces)
Therefore, a range of private IP addresses (for example, 160 addresses from 10.0.0.1 to 10.0.0.160) is obtained. Each private IP address (for example, “10.0.0.1”) has a pool (for example, “global IP address 192.0.2.1” and the port number range that can be used is the value with the last digit 0 ]) Automatically and create conversion rules.

In this case, when the packet conversion unit 300 assigns a port number according to a predetermined single rule from the range of port numbers (S106), the predetermined single rule is as follows. Can be considered.
A method that sequentially uses a number obtained by adding 10 to the currently used port number. New port number = currently used port number + 10
Or, when assigning a port number, a random number is used and multiplied by 10. New boat number = 49160 + the last digit value + random number (0-1636) * 10
Etc.

[Modification 2]
Only the parts different from the first embodiment will be described below.
A mechanism for automatically determining a pool as “static” when setting a NAT device will be described. In the first embodiment, a range of port numbers that can be used in advance (for example, 16384 ports from 49152 to 65535), a range of port numbers assigned for each private IP address (for example, 2000 ports), and a global IP that can be used. An address range (for example, 16 addresses from 192.0.2.1 to 192.0.2.16) is specified. In the second modification, a range of port numbers allocated for each private IP address (for example, 2000) Instead of designating in advance, the number of private IP addresses sharing one global IP address (for example, 16) is designated in advance.

The range of port numbers that can be used is divided by the number of shared private IP addresses, and the range of port numbers assigned for each private IP address is calculated.
Port number range = 16384/16 = 1024
Multiply the number of global IP addresses that can be used and the number of private IP addresses that can be shared to determine the number and range of private IP addresses to be assigned to users.
Number of global IP addresses (16) * Number of private IP addresses that can be shared (16) = 256 (pieces)
Thereafter, a range of private IP addresses (for example, 256 including 10.0.0.1 to 10.0.0.25 and 10.0.1.1) is automatically determined.

  Each private IP address (for example, “10.0.0.1”) is automatically assigned and converted to a pool (for example, “Global IP address 192.0.2.1 and port number range 49152 to 49175”). Create a rule.

  The mechanism for automatically determining the pool of the first embodiment as “static” when setting the NAT device is adopted when the range of port numbers to be assigned (the number of established connections) is determined, and the mechanism of the second modification is one It may be adopted when the number of private IP addresses sharing a global IP address is determined.

[Modification 3]
Only the parts different from the first embodiment will be described below.
The NAT device 2000 includes a mechanism for manually determining a pool corresponding to a private IP address instead of a mechanism for automatically and statically determining a pool corresponding to a private IP address when the NAT device is set.
Even if you manually assign a large range of port numbers (for example, 2000) to a specific private IP address and assign a small range of port numbers (for example, 100) to the remaining pools, As long as it corresponds.

  In the case of the first embodiment and the first and second modifications, a mechanism for determining a pool corresponding to a private IP address on a one-to-one basis is provided. It only needs to be identified. Therefore, a plurality of pools may be assigned to one-to-many, that is, one private IP address. The conversion rule is stored in the pool storage unit 400. Even in this case, the user can be uniquely identified by examining the incoming call log, the conversion rule, and the allocation log B.

  Only the parts different from the first embodiment will be described below. FIG. 13 shows a system configuration example of the Internet connection service of the second embodiment, and FIG. 14 shows a functional configuration example of the NAT device of the second embodiment. The NAT device 3000 has an address assignment unit 500. The NAT device 3000 also has a function of assigning a private IP address to a user.

  FIG. 15 shows a method for assigning private IP addresses. The address assignment unit 500 assigns a private IP address to the terminal as the terminal in the private IP address network 600 is connected, further determines the correspondence between the private IP address and the pool, and stores it in the pool storage unit. Specifically, when the user line is connected, the address assignment unit 500 refers to the pool storage unit 400 and assigns an unused private IP address to the user (S112). The IP address assignment unit 500 assigns a pool corresponding to the private IP address at the same time as the assignment of the private IP address, and stores it in the pool storage unit 400 (S113). An example of pool data stored in the pool storage unit 400 is shown in FIG. The NAT device 3000 records the allocation log B and the allocated pool in the allocation log storage unit 630 (S114). FIG. 17 shows an example of data recorded in the allocation log storage unit.

  The address translation device 3000 includes a mechanism that automatically determines the correspondence between the private IP address and the pool “dynamically” for each line connection. “Dynamic” means that the correspondence between the private IP address and the pool changes depending on the line connection of the user.

  Explain the mechanism to automatically determine the pool as "dynamic". A range of port numbers that can be used in advance (for example, 16384 ports from 49152 to 65535), the number of port numbers assigned for each private IP address (for example, 2000 ports), and a range of available global IP addresses (for example, , 192.0.2.1 to 192.0.2.16).

The range of port numbers that can be used is divided by the number of port numbers assigned for each private IP address, and the number of private IP addresses sharing one global IP address is calculated.
Number of shared private IP addresses = 16384 ÷ 2000 = 8.192
Multiply the number of available global IP addresses by the number of private IP addresses that can be shared to determine the number of private IP addresses to be assigned to users.
Number of global IP addresses (16) * Number of private IP addresses that can be shared (8) = 128 (pieces)
Therefore, 128 private IP addresses can be handled. 128 pools are created and stored in the pool storage unit 400.

  The address allocation unit 500 allocates a private IP address (for example, “10.0.0.1”) when the user connects to the line (S112), and a pool (for example, “global IP address 192. 0.2.1 and port number range 49152 to 51151 ") are automatically assigned, a conversion rule is created, and stored in the pool storage unit 400 (S113). At the same time, the address device conversion apparatus stores the allocation log B and the conversion rule in the allocation log storage unit 630 (S114). When the line is disconnected, the pool storage unit 400 deletes the disconnected private IP address from the pool storage unit 400 to make it “free”.

  In the case of the second embodiment, the user can be uniquely identified from the allocation log B, the conversion rule, and the incoming call log stored in the allocation log storage unit 630 without checking the pool in the pool storage unit 400. Even if the pool is changed, the storage unit 630 stores the allocation log B and the conversion rule when the line is connected. Since the log recorded in the storage unit 630 is not for each connection establishment but for each line connection, it is not necessary to store the conversion log in the external storage device 900 as in the first embodiment.

[Modification]
Only the parts different from the second embodiment will be described below. The address translation device according to the modification uses a management server or the like to authenticate a user and assign an IP address when the user line is connected. FIG. 18 shows a system configuration example of the modified Internet connection service, FIG. 19 shows a functional configuration example of the NAT device of the modified example, and FIG. 20 shows a private IP address assignment method. When the user line is connected, the NAT device 3000 requests the management server 700 to authenticate the user ID and password (S111). When authentication is permitted, a private IP address is assigned as in the second embodiment.

In the modified example, the conversion rule is created and stored in the pool storage unit 400 (S113). At the same time, the allocation log B and the conversion rule are stored in the allocation log storage unit 630. The management server 700 is notified of the private IP address assigned to the user using the RADIUS (Remote Authentication Dial In User Service) protocol (see RFC 2865 and RFC 2866) or the like (S115). In the management server 700, an allocation log B and conversion rules are stored.
In the first and second embodiments, the case where the ISP uses the address translation device has been described, but the case where the address translation device is used in a small-scale LAN or the like is also included.

  In the above description, the address translation device may be mounted on a router, a gateway, or the like. The address translation device may function by a computer. In that case, a program for causing the computer to execute each process is installed from a recording medium such as a CD-ROM, a magnetic disk, or a semiconductor storage device, or downloaded through a communication line, and the program is executed by the computer. Just do it.

It is a block diagram which shows the system structural example of the internet connection service which the existing ISP provides. It is a figure which shows the example of data of the allocation log A. It is a figure which shows the example of data of an incoming call log. 6 is a diagram illustrating an example of data in an allocation log B. FIG. It is a figure which shows the example of data of a conversion log. It is a block diagram which shows the system structural example of the internet connection service which the existing ISP provides using a NAT apparatus. It is a block diagram which shows the structural example of the existing NAT apparatus and an external storage device. It is a figure which shows the data example of conversion status data. 1 is a configuration diagram illustrating a system configuration example of an Internet connection service of Embodiment 1. FIG. 1 is a configuration diagram illustrating a functional configuration example of a NAT device according to Embodiment 1. FIG. 4 is a diagram illustrating an example of data stored in a pool storage unit 400. FIG. It is a flowchart which shows the flow of packet conversion. It is a block diagram which shows the system structural example of the internet connection service of Example 2. FIG. 6 is a configuration diagram illustrating a functional configuration example of a NAT device according to Embodiment 2. FIG. It is a flowchart which shows the allocation method of a private IP address. 4 is a diagram illustrating an example of pool data stored in a pool storage unit 400. FIG. It is a figure which shows the example of data memorize | stored in the allocation log memory | storage part of Example 2. FIG. FIG. 10 is a configuration diagram illustrating a system configuration example of an Internet connection service according to a modification of the second embodiment. FIG. 10 is a configuration diagram illustrating a functional configuration example of a NAT device according to a modification of the second embodiment. 10 is a flowchart illustrating a method for assigning a private IP address according to a modification of the second embodiment.

Explanation of symbols

1000, 2000, 3000 NAT device 100 packet transfer unit 200 conversion status holding unit 300 packet conversion unit 400 pool storage unit 500 address allocation unit

Claims (5)

An address translation device that performs address translation during communication between a first terminal in a private IP address network and a second terminal in a global IP address network,
A pool that is a combination of a range of global IP addresses and port numbers, and more than the number of private IP addresses; a pool storage unit that stores private IP addresses corresponding to the pools;
A packet transfer unit that receives a packet from the first terminal and transmits the address-converted packet to the second terminal;
The private IP address is acquired from the packet received via the packet transfer unit, the pool information corresponding to the private IP address is acquired from the pool storage unit, and further, from the range of port numbers of the pool A packet conversion unit that determines a port number and converts the private IP address and port number of the received packet into the determined global IP address and port number of the pool ;
The port number range includes a plurality of port numbers,
Determining the correspondence between the private IP address and the pool at the time of setting the address translation device, and storing it in the pool storage unit;
An address translator characterized by the above . An address translation device that performs address translation during communication between a first terminal in a private IP address network and a second terminal in a global IP address network,
A pool that is a combination of a range of global IP addresses and port numbers, and more than the number of private IP addresses; a pool storage unit that stores private IP addresses corresponding to the pools;
A packet transfer unit that receives a packet from the first terminal and transmits the address-converted packet to the second terminal;
The private IP address is acquired from the packet received via the packet transfer unit, the pool information corresponding to the private IP address is acquired from the pool storage unit, and further, from the range of port numbers of the pool A packet conversion unit that determines a port number and converts the private IP address and port number of the received packet into the determined global IP address and port number of the pool;
As the first terminal in the private IP address network is connected to the line, a private IP address is dynamically assigned to the first terminal, and a correspondence between the private IP address and the pool is determined, and a pool storage unit An address assignment unit for storing
An allocation log storage unit for storing the correspondence between the IP address determined by the address allocation unit and the pool regardless of the line connection;
The port number range includes a plurality of port numbers.
An address translation device characterized by that . The address translation device according to claim 1 or 2 , wherein
The pool storage unit stores a plurality of pools for one private IP address,
An address translator characterized by the above. The address translation device according to any one of claims 1 to 3 ,
Having a conversion status holding unit that holds a protocol type, a source private IP address, a source port number and a converted global IP address, a converted port number, a destination global address, a destination port number, and a connection time;
An address translator characterized by the above. Program for causing a computer to function as an address conversion device as claimed in any one of claims 1 to 4.

Images