JP2002094508A - Method and system for managing connection in inter- private-network communication - Google Patents

Abstract

PROBLEM TO BE SOLVED: To provide a method and system for managing connection in Inter- private-network communication where a manager of a virtual private network(VPN) can control the communication opening or the revision setting of the communication between VPNs to be built on a communication network operated by a communication enterprise. SOLUTION: User network management systems 8A, 8B transmit connection rules about opening and revision setting for inter-VPN communication set by a VPN manager to the user network management systems 8A, 8B belonging to VPNs 2A, 2B to a management system 5, the security management system 5 collates the connection rules sent from the user network management system with connection rules sent from the other user network management system managing the user network belonging to the other VPN being a connection opposite party of the VPN in the connection rules, and converts the connection rules into the information to be set to an inter-VPN connection device 4 and distributes the converted information when the matched connection rules exist.

Description

DETAILED DESCRIPTION OF THE INVENTION

[0001]

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to a connection management method and apparatus for communication between virtual private networks.

[0002]

2. Description of the Related Art When secure communication is performed between logically independent virtual private networks (hereinafter, referred to as VPNs), firewalls having a packet filtering function, an address conversion function, and the like are installed in each VPN, and each of them is installed. It is necessary to perform management and operation in accordance with the VPN usage rules.

[0003] When a communication carrier implements a connection between VPNs constructed and operated on a wide-area packet communication network operated by the communication carrier as a service, from the viewpoint of economy, V
Instead of arranging a firewall for each PN, management and operation are performed using a virtual private network connection device (inter-VPN connection device) that centrally performs packet filtering and address conversion of a plurality of inter-VPN communications.

[0004]

Here, in the case where communication between VPNs is to be established or its setting is to be changed, conventionally, each virtual private network administrator (VPN administrator) has to perform communication between VPNs. The usage rules must be adjusted off-line, and the contents must be submitted to the service receptionist on the telecommunications carrier side as a service order. It is necessary to discuss whether there is a security infringement on the VPN connection device, and then to convert the setting information to the setting information regarding packet filtering, address conversion and the like of the VPN connection device, and to directly set the setting information for the VPN connection device.

SUMMARY OF THE INVENTION In view of the above problems, an object of the present invention is to enable a VPN administrator to manage and control the connection setting between VPNs, which has conventionally been performed by requesting a telecommunications carrier, similarly to its own firewall. It is in.

[0006]

According to the present invention, in order to solve the above problems, communication between logically independent virtual private networks constructed and operated on a wide area packet communication network operated by a communication carrier is provided. A connection management method for communication between virtual private networks, which has a packet filtering function, an address conversion function, and the like, and is performed through a virtual private network connection device managed by a security management system for a wide area packet communication network. A connection rule relating to packet filtering and address translation for establishing communication between virtual private networks and changing settings set by a managing administrator for a user network management system that manages a user network belonging to the virtual private network, The connection is sent from the user network management system to the security management system. In the security management system, the connection rule sent from one user network management system belongs to another virtual private network which is a connection partner of one virtual private network in the connection rule. The connection rule is compared with the connection rule sent from another user network management system that manages the user network, and if there is a matching connection rule, the connection rule is converted into setting information for the virtual private network connection device and distributed. Shall be.

According to the present invention, in order to solve the above problems, communication between logically independent virtual private networks constructed and operated on a wide area packet communication network operated by a communication carrier is performed by a packet filtering function. A connection management device in the communication between virtual private networks, which is performed through the virtual private network connection device managed by the security management system of the wide area packet communication network.
Manages the user network belonging to the virtual private network, and sends to the security management system connection rules regarding packet filtering and address translation for establishing communication between virtual private networks and changing settings, which are set by the administrator managing the virtual private network. A user network management system that sends a connection rule sent from one user network management system to another user who manages a user network belonging to another virtual private network that is a connection partner of one virtual private network in the connection rule A security management system that checks the connection rules sent from the network management system and, if there is a matching connection rule, converts the connection rule into setting information for the virtual private network connection device and distributes the information. To.

In the connection management device, the security management system includes a user network management system communication unit that receives a connection rule from the user network management system, a connection rule management unit that manages the connection rule, and a different virtual private network. A connection rule judging unit that collates connection rules from the server and determines whether connection is possible, and a virtual private network connection device that automatically generates and distributes setting information to the virtual private network connection device when the connection rules match. And a control unit.

In the connection management device, the connection rule management unit of the security management system identifies a virtual private network managed by the user network management system from a header and a connection rule of a packet from the user network management system. Based on this, the connection rules from the user network management system are registered and managed as a logically independent table for each virtual private network, and the virtual private network connection device is managed by the virtual private network administrator himself. It is characterized by having a data management system capable of operating the table as a virtual firewall.

[0010] In the connection management device, the user network management system communication unit, the connection rule management unit, and the connection rule determination unit of the security management system, when receiving the connection rule from the user network management system, store the address in the table. It has a function of retrieving a connection rule of a virtual private network of a connection partner from information and transmitting a registration status to a user network management system.

In the connection management device, the user network management system sends a connection rule set by the virtual private network administrator to the virtual firewall to the security management system, and the virtual private network of the connection partner from the security management system. A security management system control unit that receives the registration status of the network connection rule; and an administrator communication unit that notifies the virtual private network administrator of the registration status of the connection rule of the virtual private network to be connected to. I do.

[0012]

DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS The present invention will be described below in detail with reference to the drawings.

FIG. 1 shows an example of an embodiment of the present invention, and here shows the configuration of the entire system including a connection relationship between devices and a control procedure.

In FIG. 1, reference numeral 1 denotes a wide area packet communication network operated by a communication carrier; 2A and 2B, virtual private networks constructed and operated on the wide area packet communication network 1; 3A-1, 3A-2; A user network belonging to the private network 2A, 3B-1 and 3B-2 are user networks belonging to the virtual private network 2B, 4 is a virtual private network (VPN) connection device for realizing communication between virtual private networks, and 5 is a virtual private network. This is a security management system that manages the network connection device 4.

The user network 3A-1 is connected to the terminal devices 6A-1,6
A-2, a packet switching device 7A and a user network management system 8A, and the user network 3B-1 is a terminal device 6B.
-1, 6B-2, the packet switching device 7B and the user network management system 8B (the user network 3A-
The same applies to 2, 3B-2, but is omitted here. ).

The terminal devices 6A-1 and 6A-2 are connected to the wide area packet communication network 1 via a packet switching device 7A in the same user network, and the terminal devices 6B-1 and 6B-2 are connected to the same user network. It is connected to the wide area packet communication network 1 via the packet switching device 7B inside.

The security management system 5 is connected to the wide area packet network 1 via a network 9 for network management. The security management system 5 has a communication path with the user network management systems 8A and 8B.

Each virtual private network 2A, 2
B has at least one manager, and manages the virtual private network based on the unified operation guideline. These managers are the terminal devices 6A-1,
Using 6A-2, 6B-1, 6B-2, bidirectional information is exchanged with the user network management systems 8A, 8B managed by itself.

FIG. 2 shows details of the security management system 5, which is different from a user network management system communication unit 51 for receiving connection rules from the user network management system and a connection rule management unit 52 for managing connection rules. A connection rule judging unit 53 that collates connection rules from the virtual private network and determines whether connection is possible. If the connection rules match, the virtual private network that automatically generates and distributes setting information to the virtual private network connection device. And a network connection device control unit 54.

The connection rule management unit 52 identifies the virtual private network managed by the user network management system from the header of the packet from the user network management system and the connection rules, and based on the identification, the user network management system. Register and manage connection rules from as a logically independent table for each virtual private network,
The virtual private network connection device has a data management method capable of operating its table as a virtual firewall managed by the virtual private network administrator.

FIG. 3 shows the details of the user network management system, which receives information such as connection rules set by the virtual private network administrator, and informs the virtual private network administrator of the virtual private network to be connected to. An administrator communication unit 81 for notifying the registration status of the connection rule, a user network data management unit 82 for registering data set by the virtual private network administrator, and a device control in a user network for controlling each device in the user network. And a portion 83. In addition, the security management system transmits the connection rule set by the virtual private network administrator to the security management system, and receives the registration status of the connection rule of the connection partner virtual private network from the security management system. A system control unit 84 is provided.

Here, the virtual private network 2
It is assumed that A and 2B are logically independent, the connection setting between the two is not made in the virtual private network connection device 4, and communication between the two is impossible.

Now, it is assumed that the administrator of the virtual private network 2A desires to open communication between the terminal device 6A-2 under management and the terminal device 6B-2 in the virtual private network 2B. I do.

In this case, the administrator of the virtual private network 2A transmits a user network management system 8A from a certain terminal device 6A-1 in the virtual private network 2A.
Then, a connection rule for communication between the terminal devices 6A-2 and 6B-2 is set (a).

At this time, FIG. 4 shows an example of a connection rule table relating to packet filtering notified from the terminal device 6A-1 to the user management system 8A, and FIG. 5 shows an example of a connection rule table relating to address translation. Shown in

The user network management system 8A accepts this in the administrator communication unit 81, registers the data in the user network data management unit 82, and acquires the address information of the security management system 5 in the security management system control unit 84. Then, the connection rule is transferred to the security management system 5 (b).

The security management system 5 receives this connection rule at the user network management system communication unit (reception unit) 51 and, based on the source / destination address and the address conversion table of the packet filtering table of the connection rule, determines the virtual private Network 2A and 2
Recognizing that the communication is with B, the connection rule determining unit 53
In the step (c), a table group of connection rules set by the administrator of the virtual private network 2B registered so far in the connection rule management unit 52 is searched.

As a result of the search, if there is no connection rule permitting communication between the terminal device 6A-2 and the terminal device 6B-2, the user network management system 8A establishes the corresponding connection with the virtual private network of the connection partner. The user network management system communication unit (transmission unit) 51 notifies that the rule has not been registered, and the user network management system 8A receives this at the security management system control unit 84.
The information is transferred from the administrator communication unit 81 to the terminal device 6A-1 used by the administrator.

The connection rules registered from the user network management system 8A are flagged as ineffective temporary registration connection rules and registered in the connection rule management unit 52.

Next, the virtual private network 2B
Of the terminal device 6B-1 in the virtual private network 2B, from the terminal device 6B-1 to the user network management system 8B, establishes a connection rule for opening communication between the terminal device 6A-2 and the terminal device 6B-2. User network management system 8
It is assumed that B has been set (d).

The user network management system 8B accepts this in the administrator communication unit 81, registers the data in the user network data management unit 82, and then acquires the address information of the security management system 5 in the security management system control unit 84. Then, the connection rule is transmitted to the security management system 5 (e).

The security management system 5 receives this connection rule at the user network management system communication unit (reception unit) 51 and, based on the source / destination address and the address conversion table of the packet filtering table of the connection rule, determines the virtual private Recognizing that the communication is between the networks 2A and 2B, the connection rule determining unit 5
3, registered in the connection rule management unit 52,
The administrator of the virtual private network 2A searches a table group of connection rules set so far (f).

Based on the packet filtering information and the address conversion information of the connection rule, the connection rule is first determined by the connection rule determination unit 53 in the virtual private network 2.
When a match is found with the connection rule registered by the administrator of A (g), the connection rule of the virtual private networks 2A and 2B is sent to the inter-VPN connection device control unit 54. In the inter-VPN connection device control unit 54, the connection rules are converted into setting information of the inter-VPN connection device 4 and distributed (h).

The inter-VPN connection device 4 receives this, and rewrites the packet filtering table and the address translation table, so that the terminal devices 6A-2 and 6B-
2 can be communicated with (2).

After the setting in the inter-VPN connection device 4 is confirmed, a setting completion notification is delivered from the security management system 5 to the user network management systems 8A and 8B (nu), and the user network management systems 8A and 8B. Transmits this to the terminal devices 6A-1 and 6B-1 that are used by the administrator, respectively (R).

FIG. 6 shows the flow of processing in the security management system, and FIG. 7 shows the flow of processing in the user network management system.

[0037]

As described above, according to the present invention,
When establishing communication between VPNs or changing the settings of already connected communication, a VPN administrator registers connection rules for communication from one's own VPN to another VPN in the security management system. It is possible to control the inter-VPN connection device managed by the communication carrier.

As a result, the connection control between VPNs, which has been conventionally requested by a communication carrier, can be performed by the user, and the extranet construction operation management between the enterprise networks using the VPN can be performed by the user. This can be performed flexibly and quickly on the side. In addition, VPN for telecommunications carriers
Since the setting of the connection device can be automated, the management operation of the operator is reduced.

[Brief description of the drawings]

FIG. 1 is a configuration diagram of an entire system showing an example of an embodiment of the present invention;

FIG. 2 is a configuration diagram showing details of a security management system.

FIG. 3 is a configuration diagram showing details of a user network management system;

FIG. 4 is an explanatory diagram showing an example of a table of connection rules relating to packet filtering.

FIG. 5 is an explanatory diagram showing an example of a table of connection rules relating to address conversion.

FIG. 6 is a flowchart showing a flow of processing in the security management system.

FIG. 7 is a flowchart showing a processing flow in the user network management system.

[Explanation of symbols]

1: Wide area packet communication network, 2A, 2B: Virtual private network, 3A-1, 3A-2, 3B-1, 3B
-2: user network, 4: virtual private network connection device, 5: security management system, 6A-1,
6A-2, 6B-1, 6B-2: terminal device, 7A, 7
B: packet switching device, 8A, 8B: user network management system, 9: network for network management, 51: user network management system communication unit, 52: connection rule management unit, 53: connection rule determination unit, 54: virtual private network Inter-connection device control unit, 81: administrator communication unit, 82: user network data management unit, 83: user network device control unit, 84: security management system control unit.

 ────────────────────────────────────────────────── ─── Continuing on the front page (72) Inventor Kaori Iimori 2-3-1 Otemachi, Chiyoda-ku, Tokyo F-term in Nippon Telegraph and Telephone Corporation (reference) 5K030 GA15 HA08 HC01 KX24 LD19 MD07 5K033 AA08 CC01 DA01 DA06 DB20 EA07

Claims (6)

[Claims] 1. A communication between logically independent virtual private networks constructed and operated on a wide area packet communication network operated by a communication carrier and having a packet filtering function, an address conversion function, and the like. In a connection management method for communication between virtual private networks performed through a virtual private network connection device managed by a communication network security management system, an administrator managing a virtual private network manages a user network belonging to the virtual private network. From the user network management system to the security management system, the connection rules relating to packet filtering and address conversion for establishing virtual private network communication and changing the settings set for the user network management system to be performed. The security management system sends the connection rule sent from one user network management system to another user network that manages a user network belonging to another virtual private network that is a connection partner of one virtual private network in the connection rule. The method is characterized in that the connection rule is compared with the connection rule sent from the management system, and if there is a matching connection rule, the connection rule is converted into setting information for the connection device between virtual private networks and delivered. Connection management method for communication. 2. Communication between logically independent virtual private networks constructed and operated on a wide area packet communication network operated by a communication carrier and having a packet filtering function, an address conversion function, etc. In a connection management device for communication between virtual private networks via a connection device between virtual private networks managed by a security management system for a communication network, a management for managing a user network belonging to the virtual private network and managing the virtual private network User network management system that sends connection rules regarding packet filtering and address translation for establishing communication between virtual private networks and changing the settings to the security management system, and one user network management system The sent connection rules,
When there is a matching connection rule that matches a connection rule sent from another user network management system that manages a user network belonging to another virtual private network that is a connection partner of one virtual private network in the connection rule, and matches A security management system that converts the connection rule into setting information for the virtual private network connection device and distributes the setting information to the virtual private network connection device. 3. A security management system comprising: a user network management system communication unit that receives a connection rule from a user network management system; a connection rule management unit that manages a connection rule; and a connection rule from a different virtual private network. A connection rule determining unit for determining whether connection is possible; and a virtual private network connection device control unit for automatically generating and distributing setting information to the virtual private network connection device when the connection rules match. 3. The connection management device according to claim 2, wherein the communication is performed between virtual private networks. 4. The connection rule management unit of the security management system identifies a virtual private network managed by the user network management system from a header of a packet from the user network management system and a connection rule, and based on the identified virtual private network, Register connection rules from the network management system as a logically independent table for each virtual private network.
4. A data management system which manages a virtual private network connection device for a virtual private network administrator and operates a table as a virtual firewall managed by the virtual private network administrator.
The connection management device in the communication between virtual private networks described in the above. 5. The user network management system communication unit, connection rule management unit and connection rule determination unit of the security management system, when receiving a connection rule from the user network management system, use the address information in the table to create a virtual connection partner. 5. The connection management apparatus according to claim 4, further comprising a function of searching for a connection rule of the private network and transmitting a registration status to the user network management system. 6. The user network management system transmits a connection rule set by the virtual private network administrator to the virtual firewall to the security management system, and registers the connection rule of the connection partner virtual private network from the security management system. 6. The security management system control unit according to claim 5, further comprising: a security management system control unit that receives the status; and an administrator communication unit that notifies a virtual private network administrator of a registration status of a connection rule of a connection partner virtual private network. A user network management system for a connection management device in communication between virtual private networks.