JP2002330150A - Dynamic delivery device, method, program and recording medium of virtual private network(vpn) environment - Google Patents

Abstract

PROBLEM TO BE SOLVED: To swell 'the upper number of the group of a VPN client' than 'the upper number of virtual local area network(LAN) space which can be generated to the computer device provided with functionality processing the incoming call of a VPN connection'. SOLUTION: Virtual LAN space is generated to the VPN device to be connected to delete if it becomes unnecessary after the VPN device to be connected has accepted a connection demand to the not-yet-generated virtual LAN space from the VPN client.

Description

DETAILED DESCRIPTION OF THE INVENTION

[0001]

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to a VPN (Virtual Pri
vate Network) Virtual LAN (Local
(Area Network) Used for devices that generate space.

[0002]

2. Description of the Related Art VPN services provided by an NSP (Network Service Provider) are roughly classified into two types, namely, "LAN connection VPN" and "remote access VPN". The LAN-to-LAN connection VPN refers to a form in which existing LANs are connected to each other with a fixed connection destination. The remote access VPN connects the VPN client to the connected VPN.
Refers to a form in which a VPN connection is made dynamically to the environment.

[0003] A VPN client refers to a computer device or a LAN having a function of calling out a VPN connection. The connected VPN environment refers to a computer device or a LAN having a function of processing an incoming call of the VPN connection.

The function of calling a VPN connection refers to a function of issuing a request to start a VPN connection and a function of establishing a VPN connection. The function of processing the incoming call of the VPN connection includes a function of receiving a request to start a VPN connection, and a function of
Refers to a function for establishing a PN connection.

[0005] As an example of a computer device having a function of calling out a VPN connection, a personal computer device in which software having a VPN function is installed is cited. As an example of a LAN having a function of calling out a VPN connection, a LAN including a router having a VPN function can be cited.

[0006] As an example of a computer device having a function of processing an incoming call of a VPN connection, there is a router having a VPN function. An example of a LAN having a function of processing an incoming call of a VPN connection is a LAN including a router having a VPN function.

As an example of a technique for realizing the VPN function, P
PTP (Point to Point Tunneling Protocol) or IPse
c (Internet Protocol Security protocol), MPLS
(Multi Protocol Label Switching).

[0008] The VPN client can switch the connected VPN environment as the connection destination by changing the connection destination when making a call for the VPN connection.

The VPN clients can communicate with each other when each VPN client makes a VPN connection to the same connected VPN environment.

[0010]

SUMMARY OF THE INVENTION VPN clients that do not have the function of processing incoming calls of a VPN connection
When making a PN connection, it is assumed that a connected VPN environment already exists. The connected VPN environment is a virtual LAN generated inside a real LAN or a computer device having a function of processing an incoming call of a VPN connection.
N space (hereinafter, virtual LAN space).

[0011] The NSP is provided with a function of processing an incoming call of a VPN connection and providing a virtual LAN space therein in order to provide a "VPN service in which an arbitrary VPN client is a member of a group". It is necessary to create a virtual LAN space for each group in advance. The NSP associates each of the virtual LAN spaces created for each group with a VPN client that permits a VPN connection.

In the prior art, the "V
Since the "upper limit number of PN client groups" is limited by the "upper limit number of virtual LAN spaces that can be created in a computer device having a function of processing an incoming call of a VPN connection", it is difficult to increase the scale.

It is an object of the present invention to provide a “V
A technology capable of making the “upper limit number of PN client groups” larger than “the upper limit number of virtual LAN spaces that can be generated in a computer device having a function of processing an incoming call of a VPN connection”. is there.

[0014]

SUMMARY OF THE INVENTION A first aspect of the present invention is that the V
A dynamic providing device for a PN environment, which is characterized by the present invention, includes a means for processing an incoming call of a VPN connection from a VPN client, and a plurality of the VPN clients being classified into groups and belonging to the same group. Means for generating a virtual LAN space capable of communicating between the VPN clients, means for managing the state of the virtual LAN space, means for managing the right of the VPN client to generate the virtual LAN space, A connected VPN device having means for managing a right of access of the VPN client to the virtual LAN space; and a VPN communication path established between the VPN client and the connected VPN device. is there.

The means for processing an incoming call of the VPN connection includes:
Checking the connection destination of the VPN connection request when the VPN client receives the called VPN connection request;
When the connection destination of the VPN connection request is a virtual LAN space that has already been generated, a step of performing VPN connection processing on this virtual LAN space; and when the connection destination of the VPN connection request is a virtual LAN space that has not been generated. Indicates the virtual L to the user of the VPN client that has issued the VPN connection request.
Referring to the means for managing the right to create the AN space and the means to manage the right to access the virtual LAN space to perform user authentication and confirmation of the presence or absence of the virtual LAN space creation authority; If the user has the right to create a virtual LAN space, the user is instructed to create a virtual LAN space by the means for creating the virtual LAN space, and the virtual LAN space is created after the virtual LAN space is created. Performing the VPN connection process for the virtual LAN space, and if the user authentication is not performed correctly for the user or if the user does not have the authority to create the virtual LAN space or both of them. Rejecting a VPN connection request. The means for generating the virtual LAN space comprises: It is desirable to provide a means for deleting the generated virtual LAN space when the beforehand defined to be deleted condition is satisfied.

The conditions to be deleted include conditions when "a deletion request is issued from each user", "when there is no VPN client connected to VPN", or "when a certain period of time has elapsed". Is desirable.

The VPN connection processing includes user authentication and encryption key exchange processing. If the VPN connection processing is correctly performed, the VPN client is connected between the VPN client and the connected VPN device. It is desirable to have means for establishing a communication path.

With this, the NSP generates a virtual LAN space for the connected VPN device after the connected VPN device receives a connection request from the VPN client to the virtual LAN space that has not been generated. By deleting, the “upper limit number of groups of VPN clients” that can be provided can be equal to or more than the “upper limit number of virtual LAN spaces that can be created in the device”.

A second aspect of the present invention is a method for dynamically providing a VPN environment.
When a client receives a VPN connection request that has been called, V
The connection destination of the PN connection request is checked, and if the connection destination of the VPN connection request is a virtual LAN space that has already been generated, this virtual L
A VPN connection process is performed on the AN space, and when the connection destination of the VPN connection request is a virtual LAN space that has not been generated, the VP
The user of the VPN client that has issued the N connection request is checked for user authentication and the presence or absence of the virtual LAN space creation authority, and the user authentication for the user is correctly performed and the user has the virtual LAN space creation authority. If it has, the virtual LAN space requested by the user is generated, and after the virtual LAN space is generated, this virtual L
The VPN connection processing is performed on the AN space, and if either the user authentication is not performed correctly for the user or the user does not have the authority to create the virtual LAN space or both, the VPN connection request is issued. Refuse,
When a predetermined condition to be deleted is satisfied, the generated virtual LAN space is to be deleted.

The condition to be deleted includes a condition of "when a deletion request is issued from each user", "when there is no VPN client connected to VPN", or "when a certain time has elapsed". Is desirable.

The VPN connection processing includes user authentication and encryption key exchange processing. If the VPN connection processing is performed correctly, the VPN client is connected between the VPN client and the connected VPN device. It is desirable to build a communication channel.

A third aspect of the present invention is a program. A feature of the present invention is that a VPN is installed in an information processing apparatus so that the information processing apparatus has a VPN.
A function of processing an incoming call of a VPN connection from a client, a function of generating a virtual LAN space in which a plurality of the VPN clients are classified by group and capable of communicating between the VPN clients belonging to the same group, A function of managing the state of the LAN space;
A function of managing a right of the client to create the virtual LAN space, and a function of the virtual LA of the VPN client;
This is to realize a function as a connected VPN device having a function of managing an access right to the N space.

The function of processing the incoming call of the VPN connection is as follows.
Checking the connection destination of the VPN connection request when the VPN client receives the called VPN connection request;
When the connection destination of the VPN connection request is a virtual LAN space that has already been generated, a step of performing VPN connection processing on this virtual LAN space; and when the connection destination of the VPN connection request is a virtual LAN space that has not been generated. Indicates the virtual L to the user of the VPN client that has issued the VPN connection request.
A step of referring to a function for managing a right to create an AN space and a function to manage an access right to the virtual LAN space to confirm user authentication and the presence or absence of a virtual LAN space creation right; If the virtual LAN space is created and the user has the authority to create the virtual LAN space, the virtual LAN space creation function is instructed to create the virtual LAN space requested by the user, and the virtual LAN space is created after the virtual LAN space is created. Performing the VPN connection process for the virtual LAN space, and if the user authentication is not performed correctly for the user or if the user does not have the authority to create the virtual LAN space or both of them. And rejecting a VPN connection request. The function of generating the virtual LAN space includes: Desirable to be realized a function to remove the generated virtual LAN space when the beforehand defined to be deleted condition is satisfied.

The conditions to be deleted include conditions when "a deletion request is issued from each user", "when there is no VPN client connected to VPN", or "when a certain time has elapsed". Is desirable.

The VPN connection processing includes user authentication and encryption key exchange processing. If the VPN connection processing is correctly performed, the VPN client is connected between the VPN client and the connected VPN device. It is desirable to realize a function of constructing a communication path.

Alternatively, a third aspect of the present invention is a program. A feature of the present invention is that a program installed on an information processing apparatus allows the information processing apparatus to connect to a VPN connection originated by a VPN client. When the request is received, the connection destination of the VPN connection request is checked. If the connection destination of the VPN connection request is a virtual LAN space that has already been generated, a VPN connection process is performed on this virtual LAN space.
If the connection destination of the VPN connection request is a virtual LAN space that has not been generated, the user of the VPN client that has issued the VPN connection request is authenticated for user and confirms whether or not the user has a virtual LAN space generation authority. If the user authentication is performed correctly and the user has the authority to create a virtual LAN space, the virtual LAN space requested by the user is created, and after the virtual LAN space is created, the virtual LAN space is created. The VPN connection processing is performed, and if either the user authentication is not performed correctly for the user or the user does not have the authority to create a virtual LAN space or both, the VPN connection request is rejected. When the defined condition to be deleted is satisfied, a procedure for deleting the generated virtual LAN space is executed. In the filtrate.

The condition to be deleted includes a condition of "when a deletion request is issued from each user", "when there is no VPN client connected to VPN", or "when a certain time has elapsed". Is desirable.

The VPN connection processing includes user authentication and encryption key exchange processing. If the VPN connection processing is correctly performed, the VPN client is connected between the VPN client and the connected VPN device. It is desirable to execute a procedure for establishing a communication path.

According to a fourth aspect of the present invention, there is provided a recording medium readable by the information processing apparatus in which the program of the present invention is recorded.

[0030]

DESCRIPTION OF THE PREFERRED EMBODIMENTS An apparatus and method for dynamically providing a VPN environment, a program and a recording medium according to an embodiment of the present invention will be described with reference to FIGS. FIG. 1 is an overall configuration diagram of an apparatus for dynamically providing a VPN environment according to an embodiment of the present invention. FIG. 2 is a flowchart showing a processing procedure of the connected VPN device. FIGS. 3, 4 and 5 are flowcharts showing the processing procedure of the virtual LAN space management mechanism. FIG.
9 is a flowchart showing a processing procedure of the VPN configuration management mechanism. FIG. 7 is a flowchart showing the processing procedure of the virtual LAN space creation right management mechanism. FIG. 8 is a flowchart showing a processing procedure of the VPN member management mechanism.

A first aspect of the present invention is a device for dynamically providing a VPN environment, and the feature of the present invention is that, as shown in FIG. And a virtual L which allows communication between the VPN clients 1-4 belonging to the same group where the VPN clients 1-4 belong to the same group.
A virtual LAN space management mechanism 40 for generating the AN spaces 51 to 53; a VPN configuration management mechanism 61 for managing the states of the virtual LAN spaces 51 to 53;
4, a virtual LAN space creation right management mechanism 62 that manages the right to create the virtual LAN spaces 51-53, and a VPN member management mechanism that manages the access rights of the VPN clients 1-4 to the virtual LAN spaces 51-53. 63 and the VPN clients 1 to 63
4 and VPN communication paths 21 to 24 constructed between the connected VPN device 30. Note that VPN
The clients 1-4 are provided with calling mechanisms 11-14.

As shown in FIGS. 3, 4 and 5, when the incoming call mechanism 41-47 receives a VPN connection request originated by the VPN clients 1-4, it checks the connection destination of the VPN connection request. Performing a VPN connection process on the virtual LAN space when the connection destination of the VPN connection request is an already generated virtual LAN space; and when the connection destination of the VPN connection request is an ungenerated virtual LAN space. Has V
VPN client i that has issued the PN connection request (i is 1
4) referring to the virtual LAN space creation right management mechanism 62 and the VPN member management mechanism 63 for user authentication and confirming the presence or absence of the virtual LAN space creation right for the user, and user authentication for the user. Is performed correctly and the user has the authority to create a virtual LAN space, the virtual LAN space management mechanism 40 is instructed to create a virtual LAN space requested by the user, and the virtual LAN space 5x (x is 1 to 5). 3), the VPN connection process is performed on the virtual LAN space 5x after the generation of the virtual LAN space 5x, and the user authentication for the user is not performed correctly or the user has authority to generate the virtual LAN space. Rejecting the VPN connection request if either or both of the virtual LAN space management Structure 40, a virtual LA that is generated when the condition to be deleted which is predefined is satisfied
The N space 5x is deleted.

The conditions to be deleted include a condition "when a deletion request is issued from each user", "when there is no VPN client connected to VPN", or "when a certain time has elapsed".

The VPN connection processing includes user authentication and encryption key exchange processing. If the VPN connection processing is correctly performed, VPN communication between the VPN client i and the connected VPN device 30 is performed. The road 2i is constructed.

A second aspect of the present invention is a method for dynamically providing a VPN environment.
When the client 1 to 4 receives the called VPN connection request, the connection destination of the VPN connection request is checked. If the connection destination of the VPN connection request is the already generated virtual LAN spaces 51 to 53, the virtual LAN space 51 is used. When the connection destination of the VPN connection request is a virtual LAN space that has not been generated, the VP that issues the VPN connection request is executed.
The user of the N client i is checked for the user authentication and the presence or absence of the virtual LAN space creation authority. If the user authentication for the user is correctly performed and the user has the virtual LAN space creation authority, A virtual LAN space 5x requested by the user is generated, and after the virtual LAN space 5x is generated, the VPN connection process is performed on the virtual LAN space 5x, and user authentication for the user is not correctly performed or virtual If the user does not have the authority to create a LAN space or both of them, the VPN connection request is rejected, and if a predefined condition to be deleted is satisfied, the generated virtual LAN space 5x is deleted. Where you do it.

The conditions to be deleted include conditions when "a deletion request is issued from each user", "when there is no VPN client connected to VPN", or "when a certain time has elapsed".

The VPN connection processing includes user authentication and encryption key exchange processing. If the VPN connection processing is correctly performed, VPN communication between the VPN client i and the connected VPN device 30 is performed. The road 2i is constructed.

A third aspect of the present invention is a program. A feature of the present invention is that the program is installed in a computer device as an information processing device so that the computer device receives the program from the VPN clients 1 to 4. Incoming call mechanism 4 as a function for processing incoming calls of VPN connection
1, a virtual LAN space management mechanism 40 as a function of generating virtual LAN spaces 51 to 53 in which the VPN clients 1 to 4 are classified into groups and which can communicate among the VPN clients belonging to the same group;
A VPN configuration management mechanism 61 as a function of managing the state of the spaces 51 to 53, and a virtual LAN space creation right management mechanism 62 as a function of managing the right of the VPN clients 1 to 4 to create the virtual LAN spaces 51 to 53. And VPN
This is to realize a function as a connected VPN device 30 including a VPN member management mechanism 63 as a function of managing access rights of the clients 1 to 4 to the virtual LAN spaces 51 to 53.

The call receiving mechanism 41 includes VPN clients 1 to
(4) When the called VPN connection request is received, a step of checking the connection destination of the VPN connection request is performed. If the connection destination of the VPN connection request is a virtual LAN space that has already been generated, a VPN connection is made to this virtual LAN space. And if the connection destination of the VPN connection request is an ungenerated virtual LAN space, the virtual LAN space creation right management mechanism 6 is provided to the user of the VPN client i that has issued the VPN connection request.
2 and referring to the VPN member management mechanism 63 to confirm user authentication and the presence or absence of the virtual LAN space creation authority, and that the user authentication for the user is correctly performed and the user has the virtual LAN space creation authority. If there is, the virtual LAN space management mechanism 40 is instructed to generate a virtual LAN space requested by the user, and the virtual LAN space 5
x is generated, and the VPN connection process is performed on the virtual LAN space 5x. If the user authentication is not correctly performed for the user or the virtual LA
And / or rejecting the VPN connection request if the user does not have the authority to create the N space.
Is implemented with a function of deleting the generated virtual LAN space when a predefined condition to be deleted is satisfied.

The conditions to be deleted include a condition "when a deletion request is issued from each user", "when there is no VPN client connected to the VPN", or "when a certain time has elapsed".

The VPN connection processing includes user authentication and encryption key exchange processing. If the VPN connection processing is correctly performed, the VPN communication between the VPN client i and the connected VPN device 30 is performed. The function of constructing the road 2i is realized.

Alternatively, a third aspect of the present invention is a program. A feature of the present invention resides in that a VPN client 1 is installed in a computer as an information processing apparatus so as to be installed in the computer.
When the connection destination of the VPN connection request is a virtual LAN space that has already been generated, the connection destination of the VPN connection request is checked when the VPN connection request originated by any of .about.4 is received. If the connection destination of the VPN connection request is a virtual LAN space that has not been generated, the user of the VPN client i that has issued the VPN connection request is authenticated to confirm the user authentication and the presence or absence of the virtual LAN space generation authority. If the user authentication for the user is performed correctly and the user has the authority to create a virtual LAN space, the virtual LAN space 5x requested by the user is created, and the virtual LAN space 5x is created after the virtual LAN space 5x is created. Virtual LA
The VPN connection processing is performed on the N space 5x, and if either the user authentication is not performed correctly for the user or the user does not have the authority to create the virtual LAN space or both, the VPN connection is performed. The procedure is to reject the request and execute a procedure for deleting the generated virtual LAN space 5x when a predefined condition for deletion is satisfied.

The conditions to be deleted include conditions when "a deletion request is issued from each user", "when there is no VPN client connected to VPN", or "when a certain time has elapsed".

The VPN connection processing includes user authentication and encryption key exchange processing. If the VPN connection processing is correctly performed, VPN communication between the VPN client i and the connected VPN device 30 is performed. The procedure for constructing the road 2i is executed.

A fourth aspect of the present invention is a computer-readable recording medium on which the program of the present invention is recorded. By installing the program of the present invention in a computer device using the recording medium of the present invention, the computer device is made to be a device corresponding to the device for dynamically providing a VPN environment of the present invention, and the computer device is installed in the computer device of the present invention. The target providing method can be executed. Note that the program of the present invention can be installed in a computer device directly from a server holding the program of the present invention via a network.

Hereinafter, an embodiment of the present invention will be described.

In FIG. 1, reference numeral 30 denotes a connected VPN device, reference numeral 40 denotes a virtual LAN space management mechanism, and reference numerals 41 to 4
7 is a call receiving mechanism of the connected VPN device, 51 to 53 are virtual LAN spaces, 61 is a VPN configuration management mechanism, and 6 is
2 is a virtual LAN space creation right management mechanism, and 63 is a VPN
Member management mechanism, reference numerals 1 to 4 are VPN clients, reference numerals 11 to 14 are VPN client calling mechanisms, reference numeral 2
1 to 24 are VPN communication paths.

The virtual LAN space management mechanism 40 associates the incoming call mechanism 41 with the virtual LAN space 51 so that the VPN client 1 connected to the VPN communication path 21 and the calling mechanism 11 from the incoming call mechanism 41 can be connected to the virtual LAN. It is a member of the space 51. The association between the incoming call mechanism 41 and the virtual LAN space 51 and the separation of the plurality of virtual LAN spaces from each other in a network are realized by packet filtering, label switching, and the like.

The VPN configuration management mechanism 61 is composed of VPN configuration information and its information management mechanism. The VPN configuration information includes items such as the identifier of the corresponding virtual LAN space, the identifier of the user who created the virtual LAN space, and the conditions for deleting the virtual LAN space. Examples of virtual LAN space deletion conditions include when a deletion request is issued from a user, when there are no more VPN clients connected to the VPN, or when a certain time has elapsed.

The virtual LAN space creation right management mechanism 62 includes virtual LAN space creation right information and its information management mechanism. The virtual LAN space creation right information includes items such as an identifier of a user who is permitted to create a virtual LAN space and authentication information for each user.

The VPN member management mechanism 63 comprises VPN member information and its information management mechanism. The VPN member information includes items such as an identifier of a virtual LAN space, an identifier of a user who is permitted to connect to each virtual LAN space, and a type of authority given to each user. Examples of the type of authority given to each user include authority to delete a virtual LAN, authority to edit VPN member information, and the like.

FIG. 2 shows a processing procedure of the connected VPN device 30. The connected VPN device 30 is a connected VPN.
Various requests are received from the user from outside the device 30 or from inside the VPN via the call receiving mechanisms 41 to 47,
The processing according to the request is started.

FIGS. 3, 4 and 5 show the processing procedure of the virtual LAN space management mechanism 40. The virtual LAN space management mechanism 40 first receives a request for the virtual LAN space management mechanism 40 and starts processing according to the request.

If the request to the virtual LAN space management mechanism 40 is a VPN connection request, user authentication is performed, and if the result of the user authentication is not correct, the VPN connection request is rejected. If the result of the user authentication is correct, the virtual LAN space management mechanism 40 checks whether a virtual LAN space (5x) corresponding to the requested connected VPN environment has already been created.

If the virtual LAN space 5x has been created, it is checked whether the user who has issued the VPN connection request has the authority to connect to the virtual LAN space. If the user who has issued the VPN connection request does not have authority to connect to the virtual LAN space, the VPN connection request is rejected. VP
If the user who has issued the N connection request has the authority to connect to the virtual LAN space, a connection process to the virtual LAN space is performed.

When the virtual LAN space 5x has not been created,
It is checked whether the user who has issued the VPN connection request has authority to create a virtual LAN space. If the user who has issued the VPN connection request does not have authority to create a virtual LAN space, the VPN connection request is rejected. If the user who has issued the VPN connection request has the authority to create a virtual LAN space, the virtual LAN space is created, the VPN configuration information is registered in the VPN configuration management mechanism 61, and the created virtual LAN space is created. Perform connection processing.

At this time, the contents of the VPN configuration information registered in the VPN configuration management mechanism 61 include an identifier of the virtual LAN space,
In addition to the user identifier of the user who issued the VPN connection request,
The initial value of the virtual LAN space deletion condition is “delete when the number of connected users becomes 0”. However, when the virtual LAN space is generated, the already generated virtual LA
If the number of N spaces has reached the upper limit of the virtual LAN space management mechanism 40, the VPN connection request is rejected.

When the virtual LAN space has been created, the connection processing to the virtual LAN space is not limited to the case where the virtual LAN space has not been created.
It also includes a process of registering the connection information of the user to the virtual LAN space in the VPN member management mechanism 63.

When the request to the virtual LAN space management mechanism 40 is a VPN disconnection request, the virtual LAN space management mechanism 40 sends the user who has issued the VPN disconnection request a virtual LAN corresponding to the connected VPN environment requested to be disconnected. Disconnect from the space 5x and connect the user to the virtual LAN
It is deleted from the N member management mechanism 63. Next, the virtual LAN space management mechanism 40 checks whether there is a user connected to the virtual LAN space 5x. When there is no connected user, the virtual L
The deletion condition of the AN space 5x is checked, and if it is described that deletion is to be performed when the connected user becomes 0, the virtual LAN space 5
x is deleted, and VPN configuration information is deleted from the VPN configuration management mechanism 61.

If the request to the virtual LAN space management mechanism 40 is a virtual LAN space deletion request, user authentication is performed. If the result of the user authentication is not correct, the virtual LAN space deletion request is rejected. If the result of user authentication is correct,
The virtual LAN space management mechanism 40 checks whether the user who has issued the virtual LAN space deletion request has the authority to delete the virtual LAN space 5x. If the user who has issued the virtual LAN space deletion request has the authority to delete the virtual LAN space 5x, the virtual LAN space management mechanism 40 determines whether there is a user connected to the virtual LAN space 5x. Find out. If there is no connected user, virtual L
The AN space 5x is deleted, and the VPN configuration management mechanism 61
Delete the PN configuration information. When there is a connected user, the deletion condition of the virtual LAN space 5x is checked from the VPN configuration management mechanism 61, and if it is described that the virtual LAN space deletion request is forcibly deleted when it is received,
The virtual LAN space 5x is deleted and the VPN configuration management mechanism 61
From the VPN configuration information.

FIG. 6 shows a processing procedure of the VPN configuration management mechanism 61. First, the VPN configuration management mechanism 61
When there is a request from the user to the N configuration management mechanism 61, user authentication is performed, and if the result of the user authentication is not correct, the request is rejected. If the result of user authentication is correct,
The processing according to the request is started.

If the request to the VPN configuration management mechanism 61 is a virtual LAN space deletion condition change request, the VPN configuration management mechanism 61 transmits the virtual LA space of the requested VPN configuration information.
The deletion condition of the N section is changed.

When the request to the VPN configuration management mechanism 61 is V
In the case of a PN configuration information deletion request, the VPN configuration management mechanism 61 deletes the requested VPN configuration information. When the request to the VPN configuration management mechanism 61 is a VPN configuration information registration request, the VPN configuration management mechanism 61 uses the identifier of the user who issued the request and the information of the newly generated virtual LAN space identifier as VPN configuration information. register.

FIG. 7 shows a virtual LAN space creation right management mechanism 6.
2 shows a processing procedure. First, the virtual LAN space creation right management mechanism 62 receives a request to the virtual LAN space creation right management mechanism 62, performs user authentication, and rejects the virtual LAN space creation right change request if the result of the user authentication is incorrect. If the result of the user authentication is correct, it is checked whether the requesting user has the right to change the virtual LAN space creation right. Here, the change of the virtual LAN space creation right refers to giving the virtual LAN space creation right to a certain user and depriving a certain user of the virtual LAN space creation right. If the requesting user has the right to change the virtual LAN space creation right, the virtual LAN
The process of changing the space creation right is performed, and if the requesting user does not have the right to change the virtual LAN space creation right, the request is rejected.

FIG. 8 shows a processing procedure of the VPN member management mechanism 63. The VPN member management mechanism 63 first receives a request to the VPN member management mechanism 63, performs user authentication, and if the result of the user authentication is not correct, the VP
The request for changing the N member information is rejected. If the result of the user authentication is correct, it is checked whether the requesting user has the authority to change the VPN member information. Where VP
Changing the N member information includes changing the member list that permits connection to each virtual LAN space, giving a certain user the authority to change the VPN member information, and changing the VPN member information from a certain user. To deprive you of the authority to do so. If the requesting user has the authority to change the VPN member information, it performs the process of changing the VPN member information, and if the requesting user does not have the authority to change the VPN member information. Rejects the request.

[0066]

As described above, according to the present invention,
The NSP generates a virtual LAN space as needed for the connected VPN device and deletes the virtual LAN space when it is no longer necessary. The number of virtual LAN spaces that can be created can be equal to or greater than the upper limit number. As a result, the NSP is able to register “V
The maximum number of PN client groups "can be increased.

[Brief description of the drawings]

FIG. 1 is an overall configuration diagram of an apparatus for dynamically providing a VPN environment according to an embodiment of the present invention.

FIG. 2 is a flowchart illustrating a processing procedure of a connected VPN device according to the embodiment of the present invention.

FIG. 3 is a flowchart showing a processing procedure of a virtual LAN space management mechanism according to the embodiment of the present invention.

FIG. 4 is a flowchart showing a processing procedure of a virtual LAN space management mechanism according to the embodiment of the present invention.

FIG. 5 is a flowchart showing a processing procedure of a virtual LAN space management mechanism according to the embodiment of the present invention.

FIG. 6 is a flowchart showing a processing procedure of the VPN configuration management mechanism according to the embodiment of the present invention.

FIG. 7 is a flowchart showing a processing procedure of a virtual LAN space creation right management mechanism according to the embodiment of the present invention.

FIG. 8 is a flowchart showing a processing procedure of the VPN member management mechanism according to the embodiment of the present invention.

[Explanation of symbols]

 1-4 VPN client 11-14 Calling mechanism 21-24 VPN communication path 30 Connected VPN device 40 Virtual LAN space management mechanism 41-47 Calling mechanism 51-53 Virtual LAN space 61 VPN configuration management mechanism 62 Virtual LAN space generation Rights management mechanism 63 VPN member management mechanism

Continuing from the front page (72) Inventor Koichi Okada 2-3-1 Otemachi, Chiyoda-ku, Tokyo F-term in Nippon Telegraph and Telephone Corporation (reference) 5J104 AA07 AA16 EA15 KA01 NA02 PA07 5K033 AA09 CB01 DA01 DA05 DB12 DB19 EC01 EC03

Claims (15)

[Claims] 1. A means for processing an incoming call of a VPN connection from a VPN (Virtual Private Network) client, and a plurality of the VPN clients are classified into groups, and communication is possible between the VPN clients belonging to the same group. Means for generating a virtual LAN (Local Area Network) space; means for managing the state of the virtual LAN space; means for managing the right of the VPN client to generate the virtual LAN space; A VPN environment, comprising: a connected VPN device having means for managing access rights to a LAN space; and a VPN communication path established between the VPN client and the connected VPN device. Dynamic offer device. 2. The method according to claim 1, wherein the step of examining the destination of the VPN connection request is performed when the VPN client receives the VPN connection request originated by the VPN client. In the case of a virtual LAN space that has already been generated, a step of performing VPN connection processing for this virtual LAN space; and in the case that the connection destination of the VPN connection request is a virtual LAN space that has not been generated, a VPN connection request is issued. User authentication and virtual LAN referring to means for managing the right to create the virtual LAN space for the user of the VPN client and means for managing the right to access the virtual LAN space
Confirming whether or not the user has the space generation authority; and, if the user authentication for the user is correctly performed and the user has the virtual LAN space generation authority, the user is provided to the means for generating the virtual LAN space. Instructing the generation of a virtual LAN space requested by the user and performing the VPN connection process on the virtual LAN space after the virtual LAN space has been generated; and Rejecting the VPN connection request if the user does not have the authority to create the virtual LAN space. 2. The VPN environment according to claim 1, further comprising means for deleting the generated virtual LAN space when a power condition is satisfied. Dynamic providing apparatus. 3. The condition to be deleted includes conditions when “a deletion request is issued from each user”, “when there is no VPN client connected to the VPN”, or “when a certain time has elapsed”. The apparatus for dynamically providing a VPN environment according to claim 2. 4. The processing of the VPN connection includes processing of user authentication and exchange of an encryption key.
3. The apparatus according to claim 1, further comprising a unit configured to establish the VPN communication path between a PN client and the connected VPN device.
A device for dynamically providing a VPN environment as described above. 5. When a VPN client receives a call for a VPN connection request, the connection destination of the VPN connection request is checked. In the case where the connection destination of the VPN connection request is a virtual LAN space that has not been generated, the user of the VPN client that has issued the VPN connection request has the user authentication and the virtual LAN space generation authority. The presence / absence is confirmed, and if the user authentication for the user is performed correctly and the user has the authority to create a virtual LAN space, a virtual LAN space requested by the user is created and
After the AN space is created, the VPN connection process is performed on this virtual LAN space, and either the user authentication for the user is not correctly performed or the user does not have the authority to create the virtual LAN space, or A method for dynamically providing a VPN environment, characterized by rejecting a VPN connection request in both cases and deleting a generated virtual LAN space when a predefined condition to be deleted is satisfied. 6. The condition to be deleted includes the conditions of “when a deletion request is issued from each user”, “when there is no VPN client connected to VPN”, or “when a certain time has elapsed”. The method of dynamically providing a VPN environment according to claim 5. 7. The VPN connection processing includes user authentication and encryption key exchange processing. If the VPN connection processing is correctly performed, the VPN connection processing is performed.
7. The VPN according to claim 5, wherein the VPN communication path is constructed between a PN client and the connected VPN device.
How to dynamically provide an environment. 8. The information processing apparatus, when installed in the information processing apparatus, has a function of processing an incoming call of a VPN connection from a VPN client, and the plurality of VPN clients are classified into groups and belong to the same group. A function of creating a virtual LAN space capable of communicating between the VPN clients, a function of managing the state of the virtual LAN space, a function of managing the right of the VPN client to create the virtual LAN space, A program for realizing a function as a connected VPN device having a function of managing an access right of a VPN client to the virtual LAN space. 9. The function of processing an incoming call of the VPN connection includes the steps of: when the VPN client receives the incoming VPN connection request, checking a connection destination of the VPN connection request; In the case of a virtual LAN space that has already been generated, a step of performing VPN connection processing for this virtual LAN space; and in the case that the connection destination of the VPN connection request is a virtual LAN space that has not been generated, a VPN connection request is issued. User authentication and virtual LAN referring to a function of managing a right to create the virtual LAN space and a function of managing an access right to the virtual LAN space for a user of the VPN client
A step of confirming whether or not the user has the space generation authority; and a function for generating the virtual LAN space when the user authentication for the user is correctly performed and the user has the generation authority for the virtual LAN space. Instructing the generation of a virtual LAN space requested by the user and performing the VPN connection process on the virtual LAN space after the virtual LAN space has been generated; and A rejection of a VPN connection request in the case where the user does not have the authority to create a virtual LAN space, and a function to create a virtual LAN space. 9. The system according to claim 8, wherein the virtual LAN space is generated when a power condition is satisfied. Of the program. 10. The condition to be deleted includes the conditions of “when a deletion request is issued from each user”, “when there is no VPN client connected to the VPN”, or “when a certain time has elapsed”. The program according to claim 9, comprising: 11. The VPN connection processing includes user authentication and encryption key exchange processing. If the VPN connection processing is correctly performed, the VPN connection processing is performed.
10. The non-transitory computer-readable storage medium according to claim 8, wherein a function of constructing the VPN communication path between a PN client and the connected VPN device is realized. 12. When installed in an information processing apparatus, when a VPN connection request originated by a VPN client is received by the information processing apparatus, the connection destination of the VPN connection request is checked, and the connection destination of the VPN connection request is already determined. If the virtual LAN space has already been generated, VPN connection processing is performed on the virtual LAN space. If the connection destination of the VPN connection request is a virtual LAN space that has not been generated, the VPN that has issued the VPN connection request is used. The user of the client is checked for user authentication and the presence or absence of the authority to create a virtual LAN space. If the user authentication for the user is correctly performed and the user has the authority to create a virtual LAN space, the user Generates the virtual LAN space required by
After the AN space is created, the VPN connection process is performed on this virtual LAN space, and either the user authentication for the user is not correctly performed or the user does not have the authority to create the virtual LAN space, or A program for rejecting a VPN connection request in both cases, and executing a procedure for deleting a generated virtual LAN space when a predetermined condition to be deleted is satisfied. 13. The condition to be deleted includes the conditions of “when a deletion request is issued from each user”, “when there is no VPN client connected to VPN”, or “when a certain period of time has elapsed”. Claim 12 including
The program described. 14. The VPN connection processing includes user authentication and encryption key exchange processing. If the VPN connection processing is correctly performed, the VPN connection processing is performed.
14. The non-transitory computer-readable storage medium according to claim 12, wherein the program executes a procedure for establishing the VPN communication path between a PN client and the connected VPN device. 15. A recording medium readable by the information processing device, wherein the program according to claim 8 is recorded.