JP5437518B2 - Virtual network system, configuration change method, tunnel termination device, tunnel connection device, and program - Google Patents

Description

  The present invention relates to a virtual network such as an overlay network, and more particularly to a technique for dynamically changing the configuration of a virtual network.

  In recent years, various overlay network technologies utilizing tunneling technology have been used. An overlay network is another network virtually constructed on a certain network, and in this specification, this is also called a virtual network.

  As one of conventional techniques for setting an overlay network, there is a technique disclosed in Patent Document 1. In the technology disclosed in Patent Document 1, the VPN control device provides information necessary for VPN setting to the terminal device, so that the terminal device automatically performs VPN setting with the VPN aggregation device and performs VPN communication. It is possible to do.

JP 2010-200032 A WO2009 / 093308 JP 2007-142648 A

  In the prior art as shown in Patent Document 1, in order to change the configuration of the virtual network, the setting is changed by logging in to the terminal device from the outside, or the control device is periodically accessed from the terminal device side. A method of acquiring setting information is used.

  However, the former method of logging in from the outside has a problem that access is not possible when a terminal device is installed under NAT or the like. Further, in the latter method of accessing the control device from the terminal device side, the load on the control device increases when the access time interval is short, and conversely, the configuration is not immediately reflected when the access time interval is long. There were problems such as. For this reason, in the prior art, it has been difficult to issue a configuration change instruction to a connection device or the like installed under NAT or the like at an arbitrary timing.

  The present invention has been made in view of the above points, and provides a technique for transmitting a configuration change instruction to each device at an arbitrary timing and changing the configuration of a virtual network on demand. Objective.

  In order to solve the above-described problems, the present invention provides a virtual network system that includes a tunnel connection device and a tunnel termination device, and forms a virtual network by a tunnel set between the tunnel connection device and the tunnel termination device. The tunnel connection device includes means for accessing a predetermined control device, obtaining setting information from the predetermined control device, and connecting to the tunnel termination device based on the setting information, A means for receiving a virtual network configuration change instruction from the predetermined control device, and one or a plurality of tunnel connection devices designated by the virtual network configuration change instruction, connected to the tunnel termination device Means for selecting a tunnel connection device and transmitting a setting change instruction to the tunnel connection device; Configured as a virtual network system comprising: a.

  In the virtual network system, the setting change instruction may include information indicating a tunnel termination device as a connection destination corresponding to the changed virtual network and a protocol type corresponding to the changed virtual network.

  Then, the tunnel connection device that has received the setting change instruction connects to the connection destination tunnel termination device, and establishes a communication layer tunnel corresponding to the protocol type with the tunnel termination device. Also good.

  In the virtual network system, the setting change instruction may be a command for accessing the predetermined control device and instructing to acquire setting information from the predetermined control device.

  At this time, the tunnel connection device that has received the setting change instruction obtains the changed setting information from the predetermined control device, connects to the tunnel destination device of the connection destination specified by the setting information, and A communication layer tunnel corresponding to the protocol type specified by the setting information may be established with the terminating device. In addition, the tunnel termination device may transmit the setting change instruction to the selected tunnel connection device via a tunnel.

  Further, the present invention is configured as a configuration change method in the virtual network system that includes a tunnel connection device and a tunnel termination device, and configures a virtual network by a tunnel set between the tunnel connection device and the tunnel termination device. You can also

  The present invention also provides the tunnel termination device in a virtual network system that includes a tunnel connection device and a tunnel termination device, and forms a virtual network by a tunnel set between the tunnel connection device and the tunnel termination device. The tunnel connection device accesses a predetermined control device, acquires setting information from the predetermined control device, is connected to the tunnel termination device based on the setting information, and from the predetermined control device, A means for receiving a virtual network configuration change instruction; and selecting the tunnel connection device connected to the tunnel termination device from one or a plurality of tunnel connection devices specified by the virtual network configuration change instruction; Means for transmitting a setting change instruction to the tunnel connection device. It may be configured as a tunnel termination device according to symptoms.

  Further, the present invention is the tunnel connection device in a virtual network system including a tunnel connection device and a tunnel termination device, and forming a virtual network by a tunnel set between the tunnel connection device and the tunnel termination device. , Accessing a predetermined control device to obtain setting information from the predetermined control device, and receiving means for connecting to the tunnel terminating device based on the setting information and a virtual network configuration change instruction from the predetermined control device A tunnel connection device comprising: means for receiving a setting change instruction from the tunnel termination device; and means for performing connection corresponding to the virtual network after the change based on the setting change instruction. May be.

  Furthermore, the present invention may be configured as a program for causing a computer to function as each means of the tunnel termination device, or configured as a program for causing a computer to function as each means of the tunnel connection device. Also good.

  According to the present invention, a configuration change instruction can be transmitted to each device at an arbitrary timing, and the configuration of the virtual network can be changed on demand.

1 is an overall configuration diagram of a virtual network system according to an embodiment of the present invention. 2 is a functional configuration diagram of a virtual network control device 10. FIG. 3 is a functional configuration diagram of a tunnel connection device 20. FIG. FIG. 6 is a diagram showing another form of the tunnel connection device 20. 3 is a functional configuration diagram of a tunnel termination device 30. FIG. It is a sequence diagram for demonstrating the example of a process sequence until a virtual network is constructed | assembled. It is a figure which shows the example of the virtual network containing several tunnel connection apparatuses. It is a sequence diagram for demonstrating the process sequence in the case of changing a structure after a virtual network is constructed. It is a figure which shows the example of communication from the user terminal in L2 mode to a server. It is a figure which shows the example of communication from the server in L2 mode to a user terminal. It is a figure which shows the example of communication from the user terminal in L3 mode to a server. It is a figure which shows the example of a process which selects the flame | frame addressed to a virtual IP address. It is a figure which shows the example of communication from the server in L3 mode to a user terminal. In L4 mode, it is a figure which shows the structure in case the tunnel connection apparatus 20 functions as a SOCKS client, and the tunnel termination apparatus 30 functions as a SOCKS server. It is a figure which shows a structure in case the tunnel connection apparatus 20 functions as a RSOCKS client, and the tunnel termination | terminus apparatus 30 functions as a RSOCKS server in L4 mode. FIG. 16 is a diagram showing a configuration in a case where the SOCKS configuration (FIG. 14) and the RSOCKS configuration (FIG. 15) are combined in the L4 mode. It is a figure which shows the example of communication in L4 mode.

  Embodiments of the present invention will be described below with reference to the drawings. The embodiment described below is only an example, and the embodiment to which the present invention is applied is not limited to the following embodiment.

(System configuration)
FIG. 1 shows an overall configuration diagram of a virtual network system according to the present embodiment. As shown in FIG. 1, the virtual network system according to the present embodiment is configured by connecting a virtual network control device 10, a tunnel connection device 20, and a tunnel termination device 30 to an IP network 40 (for example, the Internet). . In the example illustrated in FIG. 1, a user terminal 50 (client device) is connected to the tunnel connection device 20. The tunnel termination device 30 is connected to a server, other user terminals, and the like. In FIG. 1, one tunnel termination device 30 and one tunnel connection device 20 are shown as representatives, but a plurality of devices may actually exist. In addition, since a virtual network is configured by constructing a tunnel between the tunnel connection device 20 and the tunnel termination device 30, a system including the tunnel connection device 20 and the tunnel termination device 30 may be referred to as a virtual network system. Good.

  The virtual network control device 10 is a device for instructing the tunnel connection device 20 and the tunnel termination device 30 to construct / change a virtual network. The tunnel connection device 20 is a device that performs a tunnel connection with the tunnel termination device 30. The tunnel termination device 30 is a device that terminates a tunnel with a plurality of tunnel connection devices 20. A virtual network is formed between tunnel connection devices connected to the same tunnel termination device 30. Hereinafter, each device will be described in more detail.

  FIG. 2 shows a functional configuration diagram of the virtual network control device 10. As shown in FIG. 2, the virtual network control device 10 includes a virtual network construction / change instruction receiving unit 11, a configuration information storage unit 12, a device communication unit 13, a location information registration unit 14, a location information storage unit 15, and an instruction notification. Part 16.

  The virtual network construction / change instruction receiving unit 11 receives, for example, instructions related to virtual network construction or modification from an external device (for example, a web browser terminal, an NW monitoring system, etc.) connected to the virtual network control device 10 through a network. A function of storing virtual network configuration information in the configuration information storage unit 12 based on the instruction is provided. The virtual network configuration information stored in the configuration information storage unit 12 includes, for example, information indicating which tunnel connection device and which tunnel termination device are connected by which protocol type. That is, the configuration information storage unit 12 stores, as configuration information, for example, a table that associates identification information of tunnel connection devices, identification information of tunnel termination devices, and protocol types. It also holds information necessary as setting information for each device to be described later.

  The device communication unit 13 is a functional unit for communicating with the tunnel connection device 20 and the tunnel termination device 30.

  The location information registration unit 14 receives a location registration request including identification information and location information (for example, the current IP address of the tunnel termination device 30) of the tunnel termination device 30 from the tunnel termination device 30, and The position information of the device 30 is stored in the position information storage unit 15. The identification information is information that can identify the tunnel termination device 30 regardless of the position of the tunnel termination device 30.

  The location information storage unit 15 stores (registers) the identification information of each tunnel termination device 30 in advance, and the location information registration unit 14 has already received the identification information received from the tunnel termination device 30 in the location information storage unit 15. After confirming that the information is stored, the position information is stored in the position information storage unit 15 in association with the identification information. The location information registration unit 14 may similarly register location information for the tunnel connection device 20. For example, when the position information of the tunnel termination device 30 is substantially fixed, the system administrator may register the position information of the tunnel termination device 30.

  Based on the configuration information stored in the configuration information storage unit 12, the instruction notification unit 16 sends a tunnel connection request to the tunnel connection device 20 configuring the virtual network related to the configuration information in response to a request from the tunnel connection device 20. This is a functional unit that notifies the setting information for the connection, and transmits setting information such as identification information and protocol type of the tunnel connection device coming to the connection to the tunnel termination device 30 configuring the virtual network related to the configuration information. The instruction notification unit 16 also has a function of transmitting a virtual network configuration change instruction to the tunnel termination device 30.

  In the present embodiment, the function unit that receives an instruction from the outside and the function unit that issues an instruction to the device are provided in the same device, but these may be realized as separate modules (separate devices). .

  The virtual network control apparatus 10 according to the present embodiment can be realized by causing a computer including a CPU, a storage device, and the like to execute a program for realizing the functions of the functional units of the virtual network control apparatus 10. The program may be installed in a computer from a recording medium such as a portable memory, or may be downloaded from a server on the network.

  FIG. 3 shows a functional configuration diagram of the tunnel connection device 20. FIG. 3 shows an example in which the tunnel connection device 20 and the user terminal 50 are separate devices and are connected to the network as an example.

  As illustrated in FIG. 3, the tunnel connection device 20 includes a virtual network control device communication unit 21, a setting unit 23, a data storage unit 24, and a tunnel connection communication unit 25. The tunnel connection communication unit 25 includes a tunnel construction unit 251 and a protocol processing unit 252.

  The virtual network control device communication unit 21 is a functional unit for performing communication with the virtual network control device 10.

  The setting unit 23 transmits a tunnel setting information request to the virtual network control device 10 when the tunnel connection device 20 is activated (when the power of the tunnel connection device 20 is turned on). It is a functional unit that receives the requested tunnel setting information and performs settings for tunnel communication based on the received tunnel setting information. Further, the setting unit 23 may have a function of transmitting a tunnel setting information request to the virtual network control device 10 at a time based on a predetermined rule. For example, the setting unit 23 may include a timer and transmit a tunnel setting information request at a predetermined time interval (for example, at the same time every day), or if there is no update by making an inquiry with the tunnel setting information request The tunnel setting information request may be transmitted by gradually increasing the time interval. The time based on a predetermined rule is not limited to these, and a time based on another rule may be adopted. These rules are set in advance in the tunnel connection device 20.

  The virtual network control device communication unit 21 is preset with address information of the virtual network control device 10. Also, the setting unit 23 receives a setting change instruction from the tunnel termination device 30 via the tunnel (via the protocol processing unit 251) and performs setting according to the setting information included in the setting change instruction, or in accordance with the setting change instruction, the virtual network A function of acquiring setting information from the control device 10 is also provided.

  The tunnel setting information includes position information (address) of the tunnel termination device 30 that is a connection destination of the tunnel, parameter values such as secret information (initial shared key, etc.) necessary for generating the tunnel, and protocol type that constitutes the tunnel (L2, L3, L4, etc. described later). In addition to these, the type of encryption, tunnel QoS information, and the like may be included.

  Further, “perform setting for tunnel connection based on tunnel setting information” means performing setting for realizing a tunnel instructed by the setting information. For example, a tunnel program corresponding to the instructed protocol type (assuming that the program is stored in the data storage unit 24 for each type, corresponding to the protocol processing unit 252) and tunnel connection is started. The destination address and parameter value are stored in the data storage unit 24 so that the tunnel construction unit 251 and the like can refer to them. This is only an example.

  The data storage unit 24 stores a program for each tunnel in association with each protocol type, and stores a tunnel connection destination and parameter values included in the tunnel setting information.

  As described above, in addition to starting a program corresponding to the protocol processing unit 252 as a module for each protocol type (this also corresponds to switching the function according to setting information), it has a function of a plurality of protocol types. A program (protocol processing unit 252) may be activated to switch functions according to setting information. Further, a hardware circuit for protocol processing may be provided for each protocol type, and the circuit may be switched according to setting information.

  The tunnel construction unit 251 in the tunnel connection communication unit 25 reads the tunnel connection destination position information and the parameter value from the data storage unit 16 and transmits a tunnel connection request to the tunnel termination device 30 that is the connection destination. Performs processing to establish a tunnel with the end device. The protocol processing unit 252 is a functional unit that performs protocol processing for tunnel communication such as encapsulation / decapsulation and encryption / decryption of data transmitted and received by the user terminal 50. To construct a tunnel is to set information for performing encapsulation / decapsulation and encryption / decryption in packet communication with a tunnel connection destination in the apparatus.

  The tunnel connection device 20 can be realized by causing a computer (including a communication device having a configuration including a CPU, a memory, and the like) to execute programs corresponding to the tunnel connection communication unit 25 and the setting unit 23.

  The program may be installed in a computer from a recording medium such as a portable memory, or may be downloaded from a server on the network.

  Although FIG. 3 shows a configuration in which the user terminal 50 and the tunnel connection device 20 are connected, this is only an example. As shown in FIG. 4, the user terminal 50 may have a function of the tunnel connection device 20 as a driver. In this case, the user terminal 50 may be called a tunnel connection device.

  In the present embodiment, it is assumed that tunnel connection device 20 shown in FIG. 3 is a device that can be carried to a desired place by a user. In addition, the user terminal 50 at this time may be a general camera terminal or the like, a Web camera, a home appliance, or the like.

  FIG. 5 shows a functional configuration diagram of the tunnel termination device 30.

  As shown in FIG. 5, the tunnel termination device 30 includes a virtual network control device communication unit 31, a registration request unit 32, a setting unit 33, a virtual network configuration change control unit 34, a data storage unit 35, and a tunnel termination communication unit 36. Have. The tunnel termination communication unit 36 includes a tunnel construction unit 361 and a protocol processing unit 362.

  The virtual network control device communication unit 31 is a functional unit for performing communication with the virtual network control device 10.

  The registration request unit 32 is a functional unit that transmits a location registration request to the virtual network control device 10 when the tunnel termination device 30 is activated or connected to the network. In response to this location registration request, location registration is performed in the virtual network control device 10. If the tunnel termination device 30 is not automatically registered, the registration request unit 32 may not be provided. Also, the tunnel connection device 20 may include a registration request unit similar to the tunnel termination device 30 to perform location registration.

  The setting unit 33 is a functional unit that receives tunnel connection information (setting information) from the virtual network control device 10 and performs settings for tunnel connection based on the received tunnel connection information. The virtual network control device communication unit 31 is preset with address information of the virtual network control device 10.

  The tunnel connection information includes parameter values such as identification information (or location information) of the tunnel connection device 20 that is connected to the tunnel termination device 30, secret information (such as an initial shared key) necessary for generating a tunnel, Includes the protocol types (L2, L3, L4, etc., described later) that make up the tunnel. In addition to these, encryption type, tunnel QoS information, and the like may be included.

  Also, “perform setting for tunnel connection based on tunnel connection information” means setting for enabling connection of the instructed tunnel. For example, a tunnel program corresponding to the instructed protocol type (assuming that each type of program is stored in the data storage unit 35. corresponding to the protocol processing unit 362) is started and connected. The identification information (or position information) and parameter values of the incoming tunnel connection device are stored in the data storage unit 35 so that the tunnel construction unit 361 and the like can refer to them. This is only an example.

  In the data storage unit 35, a program for each tunnel is stored in association with each protocol type, and information and parameter values of tunnel connection devices coming to the connection are stored.

  As described above, in addition to starting a program corresponding to the protocol processing unit 362 as a module for each protocol type (this also corresponds to switching the function according to the setting information), it has a function of a plurality of protocol types. A program (protocol processing unit 362) may be activated to switch functions according to setting information. Further, a hardware circuit for protocol processing may be provided for each protocol type, and the circuit may be switched according to setting information.

  The tunnel construction unit 361 in the tunnel termination communication unit 36 reads the identification information (or location information) of the tunnel connection device and various parameter values from the data storage unit 35, and in response to receiving the tunnel connection request, The request source confirms that it is the notified tunnel connection device, and performs processing for establishing a tunnel with the tunnel connection device. Further, the protocol processing unit 362 performs processing for tunnel communication such as encapsulation / decapsulation of data to be transmitted / received.

  The tunnel termination communication unit 36 also has a function of creating a table of identification information (may be position information) of tunnel connection devices that are tunnel-connected and storing them in the data storage unit 35.

  The virtual network configuration change control unit 34 receives a virtual network configuration change instruction including new virtual network configuration information from the virtual network control device 10 in a state where the virtual network has already been constructed and tunnel communication is possible in the virtual network. This is a functional unit that transmits tunnel setting information and the like based on the configuration of the new virtual network to each tunnel connection device that is tunnel-connected through the already constructed tunnel. The virtual network configuration change instruction includes, for example, identification information (or location information) of a tunnel termination device and identification information (or location information) of a tunnel connection device connected to the tunnel termination device in the changed virtual network configuration. Table, protocol type, and other necessary parameter values.

  The virtual network configuration change control unit 34 compares the table included in the received virtual network configuration change instruction with the table of identification information (or location information) of the tunnel connection device that is currently establishing the tunnel, The tunnel connection device to which (setting information) should be sent is determined. For example, if a tunnel connection device that should be connected to a tunnel termination device other than itself is currently tunnel-connected due to a configuration change, it is determined that an instruction (setting information) should be sent to that tunnel termination device. The instruction to transmit includes the same setting information as when a new tunnel connection is made, and the tunnel connection apparatus that has received the setting performs setting according to the setting information.

  Further, when changing the protocol type used by itself, the tunnel terminating device 30 activates the protocol processing function of the protocol according to the instruction, sets it, and waits for connection.

  Further, the instruction to transmit may be an instruction instructing the virtual network control apparatus 10 to send a tunnel setting information request instead of the setting information. Receiving this, the tunnel connection apparatus 20 receives the setting information from the virtual network control apparatus 10 and performs setting.

  The tunnel termination device 30 stores programs corresponding to the tunnel termination communication unit 36, the setting unit 33, the registration unit 32, and the virtual network configuration change control unit 34 on a computer (including a communication device having a configuration including a CPU, a memory, and the like). This can be realized by executing.

  The program may be installed in a computer from a recording medium such as a portable memory, or may be downloaded from a server on the network.

(System operation example)
Next, an example of system operation will be described. First, an example of a processing procedure from when the virtual network control device 10 receives a virtual network construction instruction from an external device to when a virtual network is constructed will be described with reference to the sequence diagram of FIG.

  First, when an administrator who manages a virtual network instructs virtual network construction from a user interface (such as a Web screen) of an external device (such as a Web browser terminal), the virtual network construction instruction (including virtual network configuration information) is issued. It is sent to the control device 10 (step 1).

  The virtual network construction / change instruction receiving unit 11 of the virtual network control apparatus 10 that has received the virtual network construction instruction stores the virtual network configuration information included in the virtual network construction instruction in the configuration information storage unit 12 (step 2).

  Based on the configuration information, the instruction notifying unit 16 of the virtual network control device 10 sends the identification information (or location information) of the tunnel connection device coming to the connection to the corresponding tunnel termination device 30, the protocol type, and various parameter values. Etc. (step 3). Note that the configuration instruction notification to the tunnel termination device 30 does not need to be at this timing, and may be at another timing. For example, it may be after notification of setting information to the tunnel connection device 20. The setting unit 33 that has received the information from the virtual network control device 10 stores and sets the information (step 4). In this example, it is assumed that the location information of the tunnel termination device 30 is registered in advance in the location information storage unit 15 together with the identification information when the tunnel termination device is installed.

  Here, when the tunnel connection device 20 is activated, the tunnel connection device 20 transmits a tunnel setting information request to the virtual network control device 10 (step 5). The tunnel setting information request includes identification information of the tunnel connection device 20.

  In the virtual network control device 10 that has received the tunnel setting information request, the instruction notification unit 16 reads the tunnel setting information corresponding to the tunnel connection device 20 from the configuration information storage unit 12 in response to the tunnel setting information request (step 6). Then, the data is transmitted to the tunnel connection device 20 (step 7).

  The tunnel connection device 20 that has received the tunnel setting information performs setting based on the setting information, and transmits a tunnel connection request to the tunnel termination device 30 by the tunnel construction unit 251 in the tunnel connection communication unit 25 (step 8). The tunnel connection device 20 and the tunnel termination device 30 each generate a tunnel (which may be called a virtual path) using information received from the virtual network control device 10 (step 9).

  Note that if necessary depending on the type of protocol used in the tunnel, the tunnel construction unit 362 in the tunnel termination communication unit 36 of the tunnel termination device 30 moves the location on the virtual network to the tunnel connection device 20 that is the transmission source of the tunnel connection request. Give out information. For example, in the case of the L3 mode described later, a virtual IP address (virtual address) is paid out as position information on the virtual network.

  Although the above example describes one tunnel connection device 20, there are generally a plurality of tunnel connection devices 20 connected to one tunnel termination device 30, and each tunnel connection device 20 is configured in the same manner. Build a tunnel.

  An example in which a plurality of tunnel connection devices 20 constructs a tunnel is shown in FIG. FIG. 7 shows a configuration in which the tunnel connection device 20 and the user terminal 50 are connected as a configuration on the terminal side, and a configuration in which the function of the tunnel connection device 20 is deployed in the user terminal 50.

  In the configuration shown in FIG. 7, after the tunnel is generated, the tunnel connection device 20 captures, for example, a packet transmitted by the user terminal 50, selects the packet according to the tunnel protocol, attaches a virtual header, and encapsulates and encrypts the packet. And transmit to the tunnel termination device 30 through the tunnel.

  When the tunnel termination device 30 receives a packet from the tunnel connection device 20 through the tunnel, the tunnel termination device 30 transfers the packet according to the header information of the packet. There are two transfer destinations: a server in the same network as the tunnel termination device 30 or a network that can be routed from the network, and the other tunnel connection device 20.

  When the tunnel termination device 30 transfers the packet to the server, the encapsulation is canceled, and when the packet is transferred to the tunnel connection device 20, the encapsulation is performed again for the tunnel connection device 20 after the release of the encapsulation. The tunnel connection device 20 cancels the encapsulation of the packet received from the tunnel termination device 30 and transfers the packet to the user terminal 50.

  The tunnel termination device 30 and the tunnel connection device 20 constitute a virtual network, and the server and the user terminal 50 are connected to this virtual network.

  Next, with reference to the sequence diagram of FIG. 8, a processing procedure in the case of changing the configuration after the virtual network is constructed will be described.

  When a tunneling connection between the tunnel termination device 30 and the tunnel connection device 20 is established and a virtual network is configured, and a virtual network configuration change instruction is given from an external device by a system administrator or the like, the virtual network configuration change The instruction is notified to the virtual network control device 10 (step 11). The virtual network configuration change instruction includes the changed virtual network configuration information.

  Then, the instruction notification unit 16 of the virtual network control apparatus 10 notifies the tunnel termination apparatus 30 of a virtual network configuration change instruction (Step 12). In the tunnel terminating device 30 that has received the virtual network configuration change instruction, the virtual network configuration change control unit 34 includes the tunnel connection device table included in the instructed configuration information, and the tunnel connection that is currently establishing the tunnel connection with itself. The device tables are compared, for example, by selecting a tunnel connection device that has established a tunnel connection from among the tunnel connection devices included in the configuration information, this is determined as a device to which a setting change instruction should be sent (step 13) An instruction is transmitted through the tunnel to the tunnel connection device 20 determined to be sent (step 14). The tunnel connection device 20 that has received the setting change instruction performs setting (switching) based on the setting information included in the instruction (step 15).

  Further, as described above, an instruction to access the virtual network control apparatus 10 may be issued as a setting change instruction. In this case, as illustrated in FIG. 8, the tunnel connection device 20 transmits a setting information request to the virtual network control device 10 (step 21), and the instruction notification unit 16 of the virtual network control device 10 transmits the tunnel connection device 20. Whether or not there is a change in the setting is checked with reference to the configuration information storage unit 12 (step 22). If it is determined that there is a change, the changed setting information is transmitted to the tunnel connection device 20 (step 23). Then, the tunnel connection device 20 performs setting (step 24).

  In addition, the stopped tunnel connection device 20 that is not currently connected to any tunnel termination device 30 accesses the virtual network control device 10 and inquires about configuration information at the time of separate startup or at a time based on a predetermined rule. go to. Also at this time, the same operation as in steps 21 to 24 is performed.

  A method of controlling the tunnel connection device 20 with a signal from the tunnel of the tunnel termination device 30 can be referred to as inbound signaling. On the other hand, a method for directly instructing the tunnel termination device 30 and the tunnel connection device 20 from the virtual network control device 10 is called meta-signaling.

  As described above, according to the technique according to the present embodiment, an instruction is given to the tunnel connection apparatus 20 that is in the tunnel connection by inbound signaling, and the tunnel connection apparatus 20 that is not performing the tunnel connection is activated, etc. Since the virtual network control device 10 is accessed and the configuration information is inquired, the configuration change instruction is input to the virtual network control device 10 so that the virtual network control device 10 is reflected on the virtual network. It becomes possible. In the prior art, when the terminal device side frequently accesses the control device, the load on the control device increases, and conversely, the configuration cannot be immediately reflected when the access frequency is low. However, in this embodiment, since the change instruction is performed by inbound signaling, the configuration can be immediately reflected while the number of accesses to the virtual network control device 10 is significantly reduced compared to the conventional one. The problem is solved.

  In the present embodiment, a network is configured between user terminals 50 (clients) associated with the tunnel connection device 20 by using the tunnel termination device 30 as a virtual hub by the configuration and procedure as described above.

(Specific example of tunnel communication)
The virtual network constructed by the technology of the present embodiment can handle various layers of protocols from L2 to L4. For example, this is done by switching the encapsulation part of packets to be transmitted / received according to the setting of the layer to be handled by the tunnel connection device 20 and the tunnel termination device 30, and the virtual address in each layer (if L2, MAC address, L3 This is realized by acting as if it has an IP address. Specific examples of the encapsulation method in each layer are shown below. The following communication is mainly performed by the functions of the protocol processing unit 252 of the tunnel connection communication unit 25 and the protocol processing unit 362 of the tunnel termination communication unit 36.

<L2 mode>
An operation example when the type of protocol to be used is L2 (referred to as L2 mode) will be described with reference to FIGS.

  FIG. 9 is a diagram illustrating an example of communication from the user terminal 50 to the server 60. In this example, it is assumed that an IP address is assigned to each device as shown in FIG. That is, 172.16.010 (virtual network address) is assigned as the IP address of the user terminal, and 172.16.0.40 (virtual network address) is assigned as the IP address of the server 60. In FIG. 9, MACpc is the MAC address of the user terminal 50, and MACsv is the MAC address of the server 60. The same applies to the other drawings.

  As shown in FIG. 9, an Ether frame (which may be called a packet) is transmitted from the user terminal 50 (step 101). The destination MAC address in this frame is the MAC address of the server 60, the destination IP address is the IP address of the server 60, the source MAC address is the MAC address of the user terminal 50, and the source IP address is the user terminal 50. IP address.

  The tunnel connection device 20 that has received the frame encrypts / encapsulates all the frames including the Mac address (step 102), and transmits the local address (192.168.2.20) of the tunnel connection device 20 itself as the transmission source. To the tunnel terminating device 30 (step 103). The tunnel termination device 30 decodes / decapsulates the encapsulated frame received from the tunnel connection device 20 (step 104), and learns the layer 2 address (MAC address) of the user terminal that is the transmission source. Thereafter, the tunnel termination device 30 behaves as if it is the owner of the L2 address of the user terminal 50 with respect to other servers placed in the same segment. That is, the destination / source address of the frame transmitted from the tunnel termination device 30 to the server 60 is the same as the destination / source address of the frame transmitted from the user terminal 50 (step 5).

  Next, an example of communication from the server 60 to the user terminal 50 is shown in FIG. As shown in FIG. 10, basically the reverse process of communication from the user terminal 50 to the server 60 is performed. That is, the tunnel termination device 30 receives a frame from the server 60 (step 201), encrypts / encapsulates the received frame as it is, and transmits it to the tunnel connection device 20 (step 202, step 203). Then, the tunnel connection device 20 decodes / decapsulates the frame and transmits it to the user terminal 50 (step 204, step 205). Note that frames received by the tunnel termination device 30 from other tunnel connection devices 20 can be transmitted to the user terminal 50 by the same processing.

<L3 mode>
Next, an operation example when the type of protocol to be used is L3 (referred to as L3 mode) will be described with reference to FIGS. In each figure, MACrt is the MAC address of the router, and MACvns is the MAC address of the tunnel termination device 30.

  FIG. 11 is a diagram illustrating an example of communication from the user terminal 50 to the server 60. In the L3 mode, the tunnel connection device 20 has a virtual IP address (172.16.050 in this example) assigned from the tunnel termination device 30.

  An Ether frame having the address shown in FIG. 11 is transmitted from the user terminal 50 (step 301).

  The tunnel connection device 20 that has received the frame learns the MAC address of the user terminal 50 (holds it together with the IP address in the storage device) (step 302). Also, the tunnel connection device 20 selects a frame captured from the user terminal 50 and destined for the virtual IP address (addressed to the virtual network IP address), and transfers the frame to the tunnel termination device 30 through the tunnel.

  An example of processing for selecting a frame addressed to a virtual IP address is shown in FIG. In the example shown in FIG. 12, an example is shown in which communication is performed using a socket as an example of the communication means. Also, as shown in FIG. 12, the tunnel connection device 20 holds a route table in which a predetermined virtual IP address group is recorded as a virtual network address.

  As shown in FIG. 12, the tunnel connection device 20 stores the MAC address of the frame received from the user terminal 50 and refers to the routing table if the destination IP address is included in the virtual IP address group ( Destination IP determination Yes), the transmission source IP address is rewritten to the virtual IP address assigned to the tunnel connection device 20, and tunnel transfer is performed. In the example of FIG. 12, a virtual NW header (VN header) describing meta information or the like is attached, but this header is not essential. The virtual NW header is used, for example, for identification of a control packet used for key exchange or the like. If the destination IP address is not included in the virtual IP address group (destination IP determination No), the destination IP address is not transmitted through the tunnel but is transmitted to a normal LAN segment.

  As described above, when performing tunnel transfer in FIG. 11, the tunnel connection device 20 cuts out a portion corresponding to the L3 packet (in this example, an IP packet) from the captured frame, and replaces the L3 address with the virtual IP address. To the tunnel terminating device 30 (S303 to S305).

  Upon receiving the encapsulated packet, the tunnel terminating device 30 performs decoding / decapsulation (step 306), and depending on the destination IP address of the encapsulated packet, the server 60 and other tunnels having the virtual IP address Transmission is performed toward the connection device 20 (step 307).

  An example of communication from the server 60 to the user terminal 50 is shown in FIG. As shown in FIG. 13, basically the reverse process of communication from the user terminal 50 to the server 60 is performed. That is, the tunnel terminating device 30 captures the frame transmitted from the server 60 (step 401), extracts a portion corresponding to the L3 packet from the captured frame, performs encryption / encapsulation (step 402), and establishes the tunnel connection. Transfer to the device 20 (step 403). The tunnel connection device 20 that has received this, after decryption / decapsulation (step 404), changes the destination IP address from the virtual IP address to the real address of the user terminal 50 (step 405). The packet is transmitted as if it was directly transmitted to the user terminal 50 (step 406). Frames received by the tunnel termination device 30 from other tunnel connection devices 20 can be transmitted to the user terminal 50 by the same processing.

Note that this L3 mode address change operation may not be employed when the tunnel connection device 20 is implemented as a driver incorporated in the user terminal 50. This is because the tunnel connection device 20 introduced as a driver appears as if the number of interfaces having virtual IP addresses has increased from the user terminal 50, and packets are sent from the user terminal 50 with virtual IP addresses from the beginning. .
<L4 mode>
Next, an operation example when the type of protocol to be used is L4 (referred to as L4 mode) will be described with reference to FIGS. In the L4 mode in the present embodiment, the SOCKS technique and the technique disclosed in Patent Document 2 (referred to as RSOCKS) are used. Of course, using these techniques is just one example of L4 mode.

  A first example of the L4 mode is shown in FIG. In this example, the tunnel connection device 20 includes a SOCKS client function as the tunnel connection communication unit 25, and the tunnel termination device 30 includes a SOCKS server function as the tunnel termination communication unit 36.

  In this example, the tunnel connection device 20 performs a tunneling connection with the tunnel termination device 30. When the user terminal 50 (application client) accesses one of the open ports of the tunnel connection device 20, the access is transferred to the tunnel termination device 30 through the tunnel, and a specific setting set for each port in the tunnel termination device 30 is made. Redirected to the application server. This is the same as normal SOCKS behavior. As shown in FIG. 14, the configuration of the first example can be used with the same arrangement of the tunnel connection device 20 and the tunnel termination device 30 as those of L2 and L3.

  As a second example, as shown in FIG. 15, the tunnel termination device 30 is provided with the RSOCKS server function, and the tunnel connection device 20 is provided with the RSOCKS client function, thereby performing the same operation as the normal RSOCKS operation. Is also possible. The RSOCKS server corresponds to the connection control server unit disclosed in Patent Document 2, and the RSOCKS client corresponds to the connection control client unit disclosed in Patent Document 2.

  A third example of the L4 mode is shown in FIG. This configuration is a combination of the SOCKS configuration shown in FIG. 14 and the RSOCKS configuration shown in FIG. 15. By arranging a tunnel connection device 20 as a device equivalent to a SOCKS client on the application server side, a server, a user, It is configured to control both accesses.

In this configuration, the virtual network system does not switch the layers to be encapsulated, but is connected to the client (user terminal 50), the tunnel connection device 20 (which is referred to as F tunnel connection device), the tunnel termination device 30, and the server. 60, each of which creates a tunnel in the tunnel connection device 20 (which will be referred to as an R tunnel connection device) and the tunnel termination device 30 associated with each other, and a session established between the F tunnel connection device 20 and the tunnel termination device 30. The session established between the tunnel termination device 30 and the R tunnel connection device 20 is associated with the tunnel termination device 30 so that the user terminal 50 and the server 60 can communicate with each other. It can be said that this is a system in which the tunnel termination device 30 relays RSOCKS and SOCKS.
In the configuration of the L4 mode shown in FIG. 16, the user terminal 50 (server client) communicates with a port opened to the F tunnel connection device 20 placed in the same LAN (step 501). In response to the communication from the user terminal 50, the F tunnel connection device 20 generates a session in a tunnel that extends in advance with the tunnel termination device 30 (step 502). The tunnel termination device 30 receives the session generation, generates a session with the server 60 through a tunnel established in advance with the R tunnel connection device 20 (step 503), and connects both of these sessions (step 504).

  In this configuration, since the server 60 receives communication from the R tunnel connection device 20, communication from the user terminal 50 can be awaited without opening a port toward the Internet. An example of communication from the user terminal 50 to the server 60 in this configuration is shown in FIG. In this communication, an address and a port are assigned as shown in FIG. In FIG. 17, the suffix fvnc indicates the F tunnel connection device 20, rvnc indicates the R tunnel connection device 20, and vns indicates the tunnel termination device 30.

  The user terminal 50 transmits a packet to a specific port of the F tunnel connection device 20 located locally (step 601). The F tunnel connection device 20 transmits a packet to the tunnel termination device 30 using its own local address as a transmission source (step 602). In this example, a virtual NW header is added.

  The tunnel termination device 30 holds session identification information between the F tunnel connection device 20 and the tunnel termination device 30 and session identification information between the tunnel termination device 30 and the R tunnel connection device 20 in association with each other. The tunnel terminating device 30 that has received the packet from the F tunnel connection device 20 identifies the packet transmission destination by referring to the correspondence information, and uses the packet transmission destination address as its own address, and the R tunnel that is the transmission destination. A packet is transmitted to the connection device 20 (step 603). The R tunnel connection device 20 holds information on the port of the server 60 associated with the received port, and transmits the received packet to the standby port of the server 60 based on the information (step 604).

(Effect of embodiment)
By adopting the method according to the present embodiment, the configuration of the virtual network can be changed on demand. Therefore, in this method, the layers that can be encapsulated can be switched between L2 to L4, and the protocols can be independently switched between the encapsulation header and the encapsulated internal data.

Hereinafter, the configurations disclosed in this specification are listed as examples.
(Section 1)
A virtual network system including a tunnel connection device and a tunnel termination device, and constituting a virtual network by a tunnel set between the tunnel connection device and the tunnel termination device,
The tunnel termination device is
Means for receiving a virtual network configuration change instruction including the changed virtual network configuration information from a predetermined control device;
The tunnel connection device selected from the one or more tunnel connection devices constituting the changed virtual network designated by the virtual network configuration information is connected to the tunnel termination device, and the tunnel connection is selected. Means for transmitting a setting change instruction to the device via the tunnel,
The tunnel connection device
Means for receiving the setting change instruction from the tunnel terminating device via the tunnel;
Means for performing a tunnel connection corresponding to the changed virtual network based on the setting change instruction.
(Section 2)
2. The virtual change according to claim 1, wherein the setting change instruction includes information indicating a tunnel termination device serving as a connection destination corresponding to the changed virtual network and a protocol type corresponding to the changed virtual network. Network system.
(Section 3)
The tunnel connection device that has received the setting change instruction connects to the connection destination tunnel termination device, and establishes a communication layer tunnel corresponding to the protocol type with the tunnel termination device. The virtual network system according to item 2.
(Section 4)
The virtual network system according to claim 1, wherein the setting change instruction is an instruction to access the predetermined control device and acquire setting information from the predetermined control device.
(Section 5)
The tunnel connection device that has received the setting change instruction acquires the changed setting information from the predetermined control device, connects to the tunnel termination device of the connection destination specified by the setting information, and the tunnel termination device 5. A virtual network system according to claim 4, wherein a tunnel of a communication layer corresponding to the protocol type specified by the setting information is established.
(Section 6)
The tunnel connection device comprises means for obtaining the setting information from the predetermined control device by accessing the predetermined control device at the time of activation or at a time based on a predetermined rule. The described virtual network system.
(Section 7)
The tunnel connection device is connected to a tunnel termination device of a connection destination specified by the setting information acquired from the predetermined control device, and corresponds to the protocol type specified by the setting information with the tunnel termination device. The virtual network system according to claim 6, wherein a tunnel of a communication layer is established.
(Section 8)
A configuration change method in a virtual network system including a tunnel connection device and a tunnel termination device, and configuring a virtual network by a tunnel set between the tunnel connection device and the tunnel termination device,
The tunnel termination device receiving a virtual network configuration change instruction including the changed virtual network configuration information from a predetermined control device;
The tunnel termination device is connected to the tunnel termination device from among one or a plurality of tunnel connection devices constituting the changed virtual network specified by the virtual network configuration information. Selecting and transmitting a setting change instruction via the tunnel to the tunnel connection device;
The tunnel connection device receives the setting change instruction from the tunnel termination device via the tunnel; and
The tunnel connection device performing tunnel connection corresponding to the virtual network after the change based on the setting change instruction;
A configuration change method comprising:
(Section 9)
The tunnel termination device in a virtual network system including a tunnel connection device and a tunnel termination device, and forming a virtual network by a tunnel set between the tunnel connection device and the tunnel termination device,
Means for receiving a virtual network configuration change instruction including the changed virtual network configuration information from a predetermined control device;
The tunnel connection device selected from the one or more tunnel connection devices constituting the changed virtual network designated by the virtual network configuration information is connected to the tunnel termination device, and the tunnel connection is selected. Means for transmitting a setting change instruction to the device via the tunnel;
A tunnel termination device comprising:
(Section 10)
A tunnel connection device that is tunnel-connected to the tunnel termination device according to Item 9,
Means for receiving the setting change instruction from the tunnel termination device via a tunnel with the tunnel termination device;
Means for performing tunnel connection corresponding to the virtual network after the change based on the setting change instruction.
(Section 11)
A program for causing a computer to function as each unit of the tunnel termination device according to Item 9.
(Section 12)
A program for causing a computer to function as each means of the tunnel connection device according to Item 10.

  The present invention is not limited to the above-described embodiments, and various modifications and applications are possible within the scope of the claims.

DESCRIPTION OF SYMBOLS 10 Virtual network control apparatus 20 Tunnel connection apparatus 30 Tunnel termination apparatus 40 IP network 50 User terminal 60 Server 11 Virtual NW construction instruction reception part 12 Configuration information storage part 13 Device communication part 14 Location information registration part 15 Position information storage part 16 Instruction Notification unit 21 vs. virtual NW control device communication unit 23 setting unit 24 data storage unit 25 tunnel connection communication unit 251 tunnel construction unit 252 protocol processing unit 31 vs. virtual NW control device communication unit 32 registration request unit 33 setting unit 34 virtual NW configuration change Control unit 35 Data storage unit 36 Tunnel termination communication unit 361 Tunnel construction unit 362 Protocol processing unit

Claims (10)

A virtual network system including a tunnel connection device and a tunnel termination device, and constituting a virtual network by a tunnel set between the tunnel connection device and the tunnel termination device,
The tunnel connection device
Means for accessing a predetermined control device, obtaining setting information from the predetermined control device, and connecting with a tunnel terminating device based on the setting information;
The tunnel termination device is
Means for receiving a virtual network configuration change instruction from the predetermined control device;
Select a tunnel connection device connected to the tunnel termination device from one or a plurality of tunnel connection devices specified by the virtual network configuration change instruction , and set the tunnel connection device via the tunnel A virtual network system comprising: means for transmitting a change instruction. The virtual configuration according to claim 1, wherein the setting change instruction includes information indicating a tunnel termination device serving as a connection destination corresponding to the changed virtual network and a protocol type corresponding to the changed virtual network. Network system. The tunnel connection device that has received the setting change instruction connects to the connection destination tunnel termination device, and establishes a communication layer tunnel corresponding to the protocol type with the tunnel termination device. The virtual network system according to claim 2. The virtual network system according to claim 1, wherein the setting change instruction is an instruction for accessing the predetermined control device and instructing to acquire setting information from the predetermined control device. The tunnel connection device that has received the setting change instruction acquires the changed setting information from the predetermined control device, connects to the tunnel termination device of the connection destination specified by the setting information, and the tunnel termination device 5. The virtual network system according to claim 4, wherein a communication layer tunnel corresponding to the protocol type specified by the setting information is established. A configuration change method in a virtual network system including a tunnel connection device and a tunnel termination device, and configuring a virtual network by a tunnel set between the tunnel connection device and the tunnel termination device,
The tunnel connection device accessing a predetermined control device, obtaining setting information from the predetermined control device, and connecting to the tunnel termination device based on the setting information;
The tunnel termination device receiving a virtual network configuration change instruction from the predetermined control device;
The tunnel termination device selects a tunnel connection device connected to the tunnel termination device from one or a plurality of tunnel connection devices specified by the virtual network configuration change instruction, and Sending a setting change instruction via the tunnel ;
A configuration change method comprising: The tunnel termination device in a virtual network system including a tunnel connection device and a tunnel termination device, and forming a virtual network by a tunnel set between the tunnel connection device and the tunnel termination device,
The tunnel connection device accesses a predetermined control device, acquires setting information from the predetermined control device, and is connected to the tunnel termination device based on the setting information,
Means for receiving a virtual network configuration change instruction from the predetermined control device;
The tunnel connection device connected to the tunnel termination device is selected from one or a plurality of tunnel connection devices specified by the virtual network configuration change instruction, and the tunnel connection device is selected via the tunnel. Means for sending a setting change instruction;
A tunnel termination device comprising: The tunnel connection device in a virtual network system including a tunnel connection device and a tunnel termination device, and forming a virtual network by a tunnel set between the tunnel connection device and the tunnel termination device,
Means for accessing a predetermined control device, obtaining setting information from the predetermined control device, and connecting to the tunnel terminating device based on the setting information;
Means for receiving a setting change instruction via the tunnel from the tunnel terminating device that has received the virtual network configuration change instruction from the predetermined control device;
Means for performing connection corresponding to the virtual network after the change based on the setting change instruction;
A tunnel connection device comprising: The program for functioning a computer as each means of the tunnel termination | terminus apparatus of Claim 7 . The program for functioning a computer as each means of the tunnel connection apparatus of Claim 8 .

Images