JP6666863B2 - System, method and program for forming virtual closed network - Google Patents

Description

  The present invention relates to a system for forming a virtual closed network for each group to which a terminal belongs on a network accommodating the terminal.

  At present, various standardization organizations are discussing the Internet of Things (IoT) in which various terminals are connected to a network. In the IoT network, since various terminals are connected, the frequency of communication and the fluctuation of the bandwidth for each terminal type are large, and the behavior of each terminal (burst traffic transmission, occupation of a wide band by a monitoring camera, etc.) However, there is a concern that the use of other normal services will be hindered. Also, since many terminals having the same specifications are distributed and arranged, an attack with security vulnerabilities of those terminals has a great effect on the entire network.

  In order to solve these problems, it is general to construct a closed network such as a VPN (Virtual Private Network) for each IoT service and prevent mutual interference between services.

Makoto Yoshida, et al., "Operation Management Technology of Wireless Network Supporting IoT", IEICE General Conference 2016, BP-5-4 Jungo Tsubakihara, "Technical Issues of IoT Solution Introduction", IEICE General Conference 2016, BP-5-6

  However, the closed network using the VPN technology has the following problems (see Non-Patent Documents 1 and 2).

  1. The terminal needs additional functions.

  In order to allow various terminals to easily connect to the network, it is desirable that the terminals have only the minimum necessary functions for connecting to the network and can be connected to the IoT network. However, in the case of VPN, it is necessary to provide a function for tunnel control, which deviates from the IoT philosophy that any terminal can freely connect to the network.

  Further, since the IoT terminal is constantly connected to the network, it is desirable that the required machine resources are small and the power consumption is small from the viewpoint of cost reduction of service provision. However, implementation of VPN technology such as IPSec is expensive, and power consumption and machine resources are large.

  2. The network side also needs to add a function for tunnel control.

  In addition, as a problem unique to the IoT, there is a problem as described below.

  Dealing with periodic burst traffic: In machine terminals such as IoT, network connections are often concentrated at specific timings (eg, 0 minutes per hour, 0 seconds per minute). Congestion of servers and communication paths is likely to occur for such periodic burst traffic.

  In the IoT network, since the number of terminals is enormous and scattered over a wide area, it is difficult for a maintenance person to maintain all the terminals on site.

  Based on the above discussion, the following requirements were set.

  Requirement 1: prevention of mutual interference of traffic for each service. Various terminals with different communication frequencies and bandwidth fluctuations can be accommodated in the same network, and mutual interference between services can be prevented.

  Requirement 2: No additional implementation on the terminal is required. It is not necessary for the terminal to implement a unique additional function for realizing the requirement 1 (only the minimum necessary function for connecting to the network is required).

  Requirement 3: No additional implementation on the network is required. It is not necessary for the network to implement additional functions specific to fulfill requirement 1.

  Requirement 4: Suppression of burst traffic. The ability to suppress traffic congestion due to periodic burst traffic.

  Requirement 5: Simplify terminal maintenance and operation. The maintenance operation when the terminal stops operating normally is reduced.

  The present invention has been made in view of the above circumstances, and an object of the present invention is to provide a virtual closed area network forming system and method that satisfies the above requirements and is suitable for IoT.

In order to achieve the above object, the present invention is a virtual closed network forming system for forming a virtual closed network for each group to which the terminal belongs on a network accommodating one or more terminals , A name resolution server for each group provided correspondingly and providing a name resolution service to terminals belonging to its own group, an L3 (Layer 3) address to be paid out to the terminal, and a name resolution server for the group to which the terminal belongs. A configuration information distribution server that holds configuration information including an L3 address for each terminal and distributes the configuration information of the terminal to a terminal to be connected to a network, and a relay that relays traffic between the terminal and the network and performs packet filtering And the relay device are arranged on the network side, and the relay device has a set of a destination and a source L3 address, And L3 address configuration information distribution server distributes terminal dynamically filtered to name resolution server for group of the said terminal passes only traffic is a set of the L3 address in response to the terminal and name resolution The setting is performed.

  According to the present invention, since the traffic of the terminal flowing into the network is only addressed to the L3 address to which the name resolution service managed for each group to which the terminal belongs, the mutual interference of traffic between the groups can be reduced. Can be prevented. In addition, a general terminal that performs a terminal configuration using a configuration information distribution service can be used as it is. In addition, since traffic and the like can be controlled collectively on the network side by managing various data in the name resolution server and the configuration information distribution server, maintenance and operation of terminals can be simplified.

Network diagram explaining the world view of the present invention FIG. 2 is a diagram illustrating a virtual closed network forming system according to the present embodiment. Configuration diagram of DNS process Configuration diagram of gateway Diagram explaining distinction of traffic groups by limiting response domains Diagram for explaining the relationship between DNS query concentration and TTL FIG. 4 is a diagram for explaining a TTL adjustment method.

  First, the world view aimed at by the present invention will be described with reference to the network diagram of FIG. The present invention aims to realize a network in which various IoT terminals can coexist without interfering with each other for each service.

  In the present invention, the IoT terminals 10 are first classified into traffic groups. In the network 200, a virtual CPE 100 in which some functions of CPE (Customer Premises Equipment) are virtualized is arranged. The virtual CPE 100 forms a virtual closed network 300 for each group. The virtual CPE 100 can form a plurality of virtual closed networks 300. In FIG. 1, each virtual CPE 100 forms one virtual closed area network 300. In the virtual closed area network 300, individual traffic is independent for each group and does not mix. The virtual CPE 100 provides some functions of the CPE to the IoT terminals 10 belonging to one or more groups corresponding to the virtual CPE 100. The network 200 only needs to perform normal packet transfer. The IoT terminal 10 itself does not know which traffic group it belongs to, that is, performs traffic control on the network 200 side.

  Here, it should be noted that FIG. 1 is a conceptual diagram. Therefore, the form of the network 200 does not matter. That is, the network 200 may be formed by one or more physical networks, may be formed by one or more virtual networks, or may be a combination of one or more physical networks and virtual networks. Good. Further, the physical network may be a fixed network, a mobile network, or a combination thereof. Also, the form of the access line for accommodating the IoT terminal 10 does not matter.

  Next, a virtual closed network forming system according to the present embodiment will be described with reference to FIG. As shown in FIG. 2, the virtual CPE 100 includes a DHCP (Dynamic Host Configuration Protocol) process 110 for providing a configuration information distribution service, and one for providing a name resolution service to the IoT terminals 10 formed for each group and belonging to the group. It comprises a DNS (Domain Name System) process 120 and a gateway 130 that relays traffic between the IoT terminal 10 and the network 200.

  As shown in FIG. 2, the DHCP process 110 holds, for each IoT terminal 10, configuration information 111 including an L3 address assigned to the IoT terminal 10 and an L3 address of a DNS server for a group to which the IoT terminal belongs. In this embodiment, an IPv6 address is used as an example of the L3 address. Further, as information for identifying the IoT terminal 10, a MAC (Media Access Control) address which is an L2 address of the IoT terminal 10 is used.

  When the IoT terminal 10 tries to connect to the network 200, the DHCP process 110 identifies the IoT terminal 10 in response to a request from the IoT terminal 10, and stores the configuration information held for the IoT terminal 10. Responds 111. The IoT terminal 10 sets its own L3 address and a DNS server used for name resolution based on the received configuration information 111.

  FIG. 3 shows a configuration diagram of the DNS process 120. As shown in FIG. 3, the DNS process 120 includes a name resolution processing unit 121, a zone file 122, and a TTL (Time To Live) adjustment unit 123.

  The name resolution processing unit 121 performs name resolution processing on the name resolution request (DNS query) from the IoT terminal 10 by referring to the zone file 122, and responds to the IoT terminal 10 to the request source. The zone file 122 has zone information about one or more groups to which the virtual CPE 100 corresponds. This zone information includes TTL. The response to the IoT terminal 10 includes TTL. The TTL adjustment unit 123 will be described later.

  FIG. 4 shows a configuration diagram of the gateway 130. As shown in FIG. 4, the gateway 130 includes a packet relay unit 131 that relays a packet between the IoT terminal 10 and the network 200. The packet relay unit 131 includes a filtering processing unit 132 and a filter setting unit 134. The filtering processing unit 132 holds the passing traffic information 133 dynamically set by the filtering processing unit 132, passes only the traffic that matches the passing traffic information 133, and discards other traffic. The filter setting unit 134 dynamically sets the passing traffic information 133 based on the configuration information 111 distributed by the DHCP process 110 and response information of the DNS process 120 responding to the IoT terminal 10. As shown in FIG. 4, the passing traffic information 133 includes a set of a destination L3 address and a transmission source L3 address.

  The gateway 130 includes a discarded traffic aggregating unit 135 as shown in FIG. The discarded traffic aggregation unit 135 aggregates various types of information on traffic discarded by the filtering processing unit 132 and notifies a predetermined terminal management site.

  The virtual closed network forming system according to the present embodiment has the following points as shown in FIG.

Point 1: Dynamic traffic filter setting at the gateway Point 2: Collection of discard track related information at the gateway Point 3: Differentiation of traffic groups by limiting response domains Point 4: Avoidance of query concentration due to TTL change in name resolution response Points 5: Improvement of maintenance operability by virtualizing CPE Each of the above points will be described in detail below.

[Point 1: Dynamic traffic filter setting at the gateway]
First, as shown in FIG. 2, the L2 address of the IoT terminal 10 and a table of a traffic group to which the IoT terminal 10 connects are stored in the DHCP process 110 in advance, and a DHCP request from the IoT terminal 10 is The L3 address of the IoT terminal and the L3 address of the DNS process 120 are answered (step (1)). When the IoT terminal 10 transmits a DNS query to the DNS process 120 related to the DHCP response (step (2)), the DNS process 120 responds (step S (3)). The IoT terminal 10 performs user communication using the L3 address related to the DNS response as the destination address and the L3 address related to the DHCP response as the source address.

  The point 1 is that the gateway 130 sets a packet filter based on the information of the steps (1) and (3), and permits only the corresponding communication.

  In this way, at point 1, by setting a dynamic traffic filter in the gateway 130 of the virtual CPE 100 and allocating the traffic to individual traffic groups, it is possible to prevent mutual interference of traffic for each service (for each group). . In addition, since the availability of connection to the traffic group is centrally managed by the gateway 130, each IoT terminal 10 or the network 200 does not need to have a unique function. As described above, the above requirements 1, 2, and 3 are solved.

[Point 2: Collection of discarded truck related information at the gateway]
Next, point 2 will be described. The point 2 is that the gateway 130 collects the discarded traffic data, reports the collected data from the virtual CPE 100 to a predetermined terminal management site, and uses the data for the maintenance operation of the IoT terminal 10. The data aggregation may be for data useful for terminal maintenance such as communication data (terminal L3 address, communication contents), for example. These data can be used for big data analysis as so-called big data. Further, the contents of the maintenance management include, for example, a remote recovery operation, a field exchange (if necessary), a statistical analysis (such as an analysis of a security attack), and the like. Further, by detecting the IoT terminal 10 that is performing an unauthorized operation, it is possible to analyze the tendency of the unauthorized terminal. Thus, the above requirement 5 is solved by the point 2.

[Point 3: Differentiating traffic groups by limiting response domains]
Next, point 3 will be described with reference to FIG. Unlike the operation of the human machine terminal, the IoT terminal 10 is assumed to have a limited range of query domains for name resolution. For this reason, in this system, the lower-level proxy allows a plurality of DNS processes that respond only to a specific domain to be set (DNS process 1 and DNS process 2 in FIG. 5). A predetermined IPv6 address, which is an L3 address, is assigned to each DNS process 120. Each IoT terminal 10 is notified of the L3 address of the DNS process 120 suitable for the use of each IoT terminal 10 in a DHCP response, and sends a name resolution request to the L3 address.

  In this way, at point 3, by providing the DNS process 120 suitable for each service, it is possible to limit the communication partners to which the individual terminal can connect. As described above, the above requirements 1, 2, and 3 can be solved.

[Point 4: Avoiding Query Concentration by Changing TTL in Name Resolution Response]
Next, the point 4 will be described with reference to FIGS. FIG. 6 is a diagram for explaining the relationship between the DNS query of the IoT terminal and TTL, and FIG. 7 is a diagram for explaining a TTL adjustment method. In FIG. 6, the horizontal axis represents time, and the vertical axis represents query volume. As shown in FIG. 6, the IoT terminal 10 often sends a DNS query repeatedly at regular intervals.

  In such a case, in order to avoid concentration of DNS queries at regular intervals, the TTL adjustment unit 123 of the DNS process 120 records a query transition in units of domains, and stores a cache holding time (TTL) of the domain and a periodic query. Determine the magnitude relationship of the intervals. By changing the TTL as shown in FIG. 7 according to the magnitude relationship, avoidance of query concentration and reduction of the total number of queries are realized.

  In FIG. 7, the horizontal axis represents time, and an arrow extending upward from the horizontal axis indicates the timing at which the IoT terminal 10 performs name resolution. A rectangle on the horizontal axis indicates a cache holding period set by the TTL in the IoT terminal 10. The triangle below the horizontal axis indicates the timing at which a DNS query is transmitted to the DNS process 120 for name resolution.

  FIG. 7A shows the case of TTL> periodic query interval. In this case, in the “normal time”, the DNS query of each IoT terminal 10 is periodically transmitted, whereby the traffic is concentrated. Therefore, the TTL adjusting unit 123 intentionally subtracts or adds TTL. The TTL adjustment unit 123 optimally changes the addition / subtraction width by repeatedly learning addition / subtraction and changes in query variance. According to this subtraction processing, as shown in FIG. 7A, in normal times, each IoT terminal 10 transmits a DNS query at the same timing, but this timing is shifted, so that traffic concentration can be avoided. On the other hand, according to the addition processing, as shown in FIG. 7A, the total number of DNS queries can be reduced.

  FIG. 7B shows a case where TTL <the regular query interval. In this case, in the "normal time", the DNS query is sent out each time the name resolution is performed in each IoT terminal 10, and the total number of queries increases. Therefore, the TTL adjustment unit 123 intentionally adds (extends) the TTL. The TTL adjustment unit 123 optimally changes the extension width by repeatedly learning the changes of the extension and the query decrease. According to this addition processing, as shown in FIG. 7B, the total number of DNS queries can be reduced.

  As described above, at the point 4, by changing the TTL, it is possible to reduce the burst traffic for the periodic query request and improve the tolerance. As described above, the above requirement 4 is solved.

[Point 5: Improvement of maintenance and operability by virtualizing CPE]
Next, the point 5 will be described with reference to FIG. The CPE in this system requires the configuration information 111 as shown in FIG. 2, and the maintenance and management of these are required. In the present system, since the management is performed collectively on the network 200 side, that is, in the virtual CPE 100, the maintenance and operability is improved and the management authority is stricter (to prevent a malicious user from performing any operation). Thus, the above requirement 5 is solved by the point 5.

  Although the embodiment of the present invention has been described in detail, the present invention is not limited to this. For example, in the above-described embodiment, the configuration information distribution service is exemplified by DHCP, and the name resolution service is exemplified by DNS. However, the present invention can be implemented with other protocols. Further, in the above-described embodiment, the IPv6 is used as the L3 address and the MAC address is used as the L2 address. However, the present invention can be applied to addresses related to other protocols. Further, although the embodiment has been described with respect to the IoT terminal, the present invention can be implemented with other terminals.

10 IoT terminal 100 Virtual CPE
110 DHCP process 111 Configuration information 120 DNS process 121 Name resolution processing unit 122 Zone file 123 TTL adjustment unit 123
130 gateway 131 131 packet relay unit 132 filtering processing unit 133 passing traffic information 134 filter setting unit 135 discard traffic aggregating unit 200 network

Claims (7)

A virtual closed network forming system for forming a virtual closed network for each group to which the terminal belongs on a network accommodating one or more terminals,
A name resolution server for each group provided for each group and providing a name resolution service to a terminal belonging to the own group; an L3 address to be paid out to the terminal; and a name resolution server for the group to which the terminal belongs. A configuration information distribution server that holds configuration information including an L3 address for each terminal and distributes the configuration information of the terminal to a terminal to be connected to a network, and a relay that relays traffic between the terminal and the network and performs packet filtering And a device, disposed on the network side,
The relay device is configured such that the set of the destination and source L3 addresses is the L3 address of the terminal distributed by the configuration information distribution server , and the name resolution server for the group to which the terminal belongs is the name resolution server that has responded to the terminal after resolving the name. A virtual closed network forming system, wherein a filtering setting is dynamically made so as to pass only a traffic paired with an address. The virtual closed network forming system according to claim 1, wherein the relay device includes a discarded traffic collection unit that aggregates information on discarded traffic. The virtual closed network forming system according to claim 1, wherein the name resolution server resolves only a predetermined domain name corresponding to its own group. 4. The said name resolution server was equipped with the TTL adjustment part which adjusts TTL of the domain which concerns on the said name resolution for every domain based on the interval of the name resolution request from a terminal. The Claims 1 thru | or 3 characterized by the above-mentioned. A virtual closed network forming system according to claim 1. The method according to any one of claims 1 to 4, wherein the name resolution server, the configuration information distribution server, and the relay device are arranged as a virtual CPE virtualized as a process on a device on a network side. Virtual closed network formation system. A method of forming a virtual closed network for forming a virtual closed network for each group to which the terminal belongs on a network accommodating one or more terminals,
A name resolution server for each group provided for each group and providing a name resolution service to a terminal belonging to the own group; an L3 address to be paid out to the terminal; and a name resolution server for the group to which the terminal belongs. A configuration information distribution server that holds configuration information including an L3 address for each terminal and distributes the configuration information of the terminal to a terminal to be connected to a network, and a relay that relays traffic between the terminal and the network and performs packet filtering And a device, disposed on the network side,
A step in which the terminal sets its own L3 address and the L3 address of a name resolution server used by the terminal based on configuration information received from the configuration information distribution server when connecting to the network;
The terminal making a name resolution request to the set name resolution server,
A name resolution server sending a name resolution response to the requesting terminal;
The relay device, destination and source L3 address set includes a L3 address set to the terminal, the traffic only the name resolution server is set of the L3 address in response to the terminal and name resolution Dynamically setting the filtering so as to pass the data.   A program that causes a computer to function as each unit according to claim 1.

Images