JP2002354048A - Rooter device - Google Patents

Abstract

PROBLEM TO BE SOLVED: To provide a rooter device which enables an efficient memory usage by getting appropriate communication connectivity. SOLUTION: The rooter device 1 which lies between WAN 2 and LAN 3 transfers addresses and has the protocol port number decision part 14 that identifies a series of communication sessions. The protocol port number decision part 14 makes relationships among address transferring entries within an address transferring table, and synchronizes the entry survival time, which prevents incorrect disconnection of a communication session caused by an address transferring function to ensure appropriate communication connectivity, and by making use of memory effectively, high speed address transferring entry controlling method is provided.

Description

DETAILED DESCRIPTION OF THE INVENTION

[0001]

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to a router device for performing address translation between a global address network and a private address network.
More specifically, the present invention relates to an address translation entry management method in a router device.

[0002]

2. Description of the Related Art In recent years, with the explosive spread of the Internet, there is an increasing demand for connecting terminals such as a plurality of personal computers (hereinafter referred to as "PCs") to the Internet even in a small office environment or at home. . The connection to the Internet is generally established via a local area network (hereinafter, referred to as "LAN") and via a router connected to the LAN.

[0003] To connect to the Internet, a global IP address is required, but it is very difficult to secure the same number of terminals as the number of terminals in a LAN. Therefore, a private IP address is usually used in a LAN. Then, when communicating via the Internet, the NA
T (Network Address Transla)
connection) to the Internet by performing an address conversion called an IP masquerade.

Hereinafter, a conventional address conversion method will be described.

FIG. 8 is a diagram showing an outline of a conventional network configuration and address conversion processing.

In FIG. 8, PCs 101, 102, 10
3 is connected to the LAN 104. Router device 105
Is interposed between the LAN 104 and the Internet 106 and performs address conversion between them. It is assumed that a terminal 107 is connected to the Internet 106. The IP address of the PC 101 is A, the IP address of the router device 105 on the Internet 106 side is B,
Assume that the IP address of the terminal 107 is C.

When a packet is transmitted from the PC 101 to the terminal 107, the source IP address is A and the destination IP address is C. This packet is routed toward the Internet 106 by the router device 105, and the source IP address A is changed to the I
It is rewritten to B which is the P address. At this time, an address translation entry relating to this translation is added to the address translation table of the router device 105.
For the communication of the same protocol performed between the terminal 01 and the terminal 107, the address conversion entry is referred to and the address conversion is performed. Further, since the memory of the router device 105 has an upper limit of the capacity, an address translation entry without reference for a certain period of time is deleted from the table. With this address conversion function, it is possible to connect to the Internet 106 from a terminal in the LAN 104 constructed with a private address.

[0008]

However, in the above-mentioned conventional method, the router device 105 generates an address translation entry each time a connection is made from within the LAN 104, and only performs address translation in accordance with the rules determined by this entry. And does not consider the relationship between each address translation entry. For this reason, it is not efficient to use the memory of the address translation table, and it takes time to search for entries as the number of address translation entries in the table increases. As a result, even though the communication session has not ended, it may be determined that the lifetime of the entry has expired, and the communication session may be incorrectly disconnected.

Here, a problem which may occur in the address conversion processing according to the above-mentioned conventional method will be described in detail with reference to FIG. 9, 111 is a PC in the private address network, 112 is a router device, 1
Reference numeral 13 denotes a terminal in the global address network. Here, a case is considered where the PC 111 performs FTP communication while the terminal 113 functions as an FTP server. The PC 111, the router 112, the terminal 1
The 13 IP addresses are A, B, and C, respectively.

[0010] FTP (File Transfer P)
protocol) is an FTP control connection (TCP port 21) for exchanging control commands for FTP communication
FTP communication is performed by two connections, ie, an FTP data connection (TCP port No. 20) for actually performing data transfer. When FTP communication is performed from the PC 111 to the terminal 113, the router device 112 intervenes between them to perform address conversion. Router device 112
Converts the source IP address of the packet from the PC 111 from A to B, and then transfers the packet to the terminal 113.
For the packet from the terminal 113, the destination IP address is converted from B to A and transferred to the PC 111.

Here, when the PC 111 downloads a huge file from the terminal 113, no communication takes place on the FTP control connection during the file transfer in the FTP data connection. The lifetime of the address translation entry in the file expires, and the entry is deleted. Therefore, even if an attempt is made to send an FTP control command from the PC 111 to the terminal 113 after the end of the data transfer, the router device 112 has to delete the address translation entry corresponding to the FTP control command and create a new entry. Is regarded as another session, the packet is discarded, and the FTP communication cannot be normally completed.

Accordingly, an object of the present invention is to provide a router device capable of ensuring appropriate communication connectivity and efficiently using a memory.

[0013]

A router device according to the present invention for solving the above problems monitors communication passing through the router device, associates address translation entries in an address translation table, and determines the entry lifetime. It is configured to synchronize.

According to the router device of the present invention, it is possible to secure an appropriate communication connectivity and to provide a high-speed address translation entry management system using a memory efficiently.

[0015]

1 is a block diagram showing a configuration of a router apparatus for performing address translation between a global address network and a private address network according to a first embodiment of the present invention; The router / port number discriminator is a router device for associating an address translation entry in the address translation table and synchronizing the entry lifetime. It is possible to prevent a communication session from being illegally disconnected.

According to a second aspect of the present invention, the protocol / port number discriminating unit groups a plurality of address translation entries identified as a series of communication sessions and performs a collective operation for each group. 2. The router device according to claim 1, wherein the use of memory in the address conversion table is made more efficient, and collective operation is performed for each group, so that entry management can be simplified and speeded up.

According to a third aspect of the present invention, the protocol / port number discriminating section assigns an appropriate entry lifetime according to the nature of the communication protocol when generating the address translation entry. The router device described above can prevent a communication session from being illegally disconnected due to an address translation function, and can efficiently use a memory.

According to a fourth aspect of the present invention, the protocol / port number discriminating section assigns an appropriate entry lifetime according to a communication partner when an address translation entry is generated. It is possible to enhance the security of the address translation function.

According to a fifth aspect of the present invention, the protocol / port number determining unit monitors a series of communication sessions and dynamically changes the entry lifetime while grasping the communication state between the terminals. The router device according to claim 1, wherein efficient use of memory is enabled.

Hereinafter, embodiments of the present invention will be described with reference to the drawings.

(Embodiment 1) FIG. 1 is a diagram showing a network configuration according to a first embodiment of the present invention. First
The difference between the embodiment and the conventional technique lies in that address translation entries are associated and their lifetimes are synchronized.

In FIG. 1, a router device 1 according to a first embodiment of the present invention includes a wide area network (hereinafter, referred to as “WAN”) 2 such as the Internet as a global address network, and a LAN 3 as a private address network. And performs address translation. The router device 1 is LA
LAN interface unit 11 connected to N3, WAN2
Interface unit 12 connected to the
An input processing unit 13 for identifying whether or not the packet is to be processed by the router device 1; a protocol / port number determining unit for monitoring the details of the content of the packet to be processed and referring to, adding to, and changing the entry of the address translation table 18 14, an address translation processing unit 15 that actually translates the address of a packet, a routing unit 16 that forwards a packet to an appropriate interface, and a timer management unit that monitors the address translation table 18 and deletes entries that have not been referenced for a certain period of time. 17. The address translation table 18 is secured inside the memory of the router device 1 and is an accumulation of entries describing the content of the address translation process.

Here, the difference between the structure of the entry of the conventional address translation table and the structure of the entry of the address translation table 18 in the present embodiment will be described with reference to FIG. FIG. 2A shows the structure of a conventional address translation table. An entry including all information necessary for the address translation process is generated each time a new communication connection is generated. FIG. 2B shows the structure of the address translation table 18 according to the present embodiment. The entries are hierarchically divided into a source part and a destination part (IP level) of a packet, and a part related to a higher protocol (upper layer level). Has been In addition, an entry constituting one communication session is associated with a plurality of entries among them.

FIG. 3 is a flowchart showing the flow of an address translation process by the router device 1 of the present embodiment. FIG. 4 is a diagram showing the grouping of address translation entries and the synchronization of the lifetime of the entries by the router device 1 of the present embodiment. FIG.

In FIG. 4, 3a is a PC connected to the LAN 3, 2a is a terminal on the WAN 2, and the IP addresses of the PC 3a, the router 1, and the terminal 2a are A and A, respectively.
B and C. Each time communication is performed from the PC 3a to the terminal 2a, an entry is added to the address translation table 18 of the router device 1 by the procedure shown in FIG. 3, but each time a new entry is created, the protocol / port number discriminating unit 1 of FIG.
4 is associated with an existing address translation entry, and an address translation table 18 shown in FIG.
FTP control connection (TCP21) and F
A TP data connection (TCP No. 20) entry is associated. Since the lifetimes of the associated entries are synchronized, it is possible to prevent unauthorized deletion of the address translation entry of the FTP communication as described with reference to FIG. 9 of the related art.

(Embodiment 2) Hereinafter, a second embodiment of the present invention will be described with reference to FIG. The outline of the address conversion process in the router device 1 according to the second embodiment is the same as that shown in FIGS. The difference between the second embodiment and the conventional technique lies in that the grouping of the address translation entries is performed and the management such as the synchronization of the lifetime is collectively performed.

FIG. 5 is a diagram showing the configuration of the address translation table 18 of the router device 1 according to the second embodiment.
When a packet passes through the router device 1, the packet is inspected by the protocol / port number discriminating unit 14 in FIG.
As shown in FIG. 5, the entries are grouped based on the upper layer protocol, the destination port number, and the like, the lifetimes in the entries are unified with the entries in the group, and processes such as the lifetime management are integrated.

(Embodiment 3) Hereinafter, a third embodiment of the present invention will be described with reference to FIG. The outline of the address conversion process in the router device 1 according to the third embodiment is the same as that shown in FIGS. The difference between the third embodiment and the conventional technique lies in that the address translation entry lifetime is optimized depending on the type and state of the communication protocol.

FIG. 6 is a diagram showing an example of setting the lifetime of an address translation entry by the router device 1 according to the third embodiment. For example, with respect to upper layer protocols of IP, ICMP, UDP, TC
The value of the survival time is increased in the order of P. Among them, TCP, which is a connection-type communication protocol, is based on Teln depending on the protocol used thereon.
protocols with high communication durability such as et and FTP,
When a new address translation entry is created with a protocol such as POP3 having low communication continuity, the life of the address translation entry is varied.

(Embodiment 4) Hereinafter, a fourth embodiment of the present invention will be described with reference to FIG.

FIG. 7 is a diagram showing a network configuration according to the fourth embodiment. Router device 1 according to fourth embodiment
Are the same as those shown in FIGS. 1 to 3 and the description is omitted. The difference between the fourth embodiment and the conventional technique lies in that the address translation entry lifetime is changed for each connection destination network.

In FIG. 7, 2b is the Internet, 2b
c and 2d are networks to which the PC 3a communicates. The router device 1 has a highly reliable network I in advance.
Enable to specify P address. Network 2c
Is a registered network. When communication is performed from the PC 3a to the external network, an address translation entry is generated in the router device 1. When the address translation entry is the network 2c registered in the router device 1, the entry is longer than when the other device is connected. Set the survival time. This eliminates the need to worry about address translation entries being deleted even if the user is not always communicating with the other party, such as when Telnet is performed from the home network to the work network. In the case of connection, by shortening the entry lifetime, the risk of unauthorized access from the other party can be reduced.

(Embodiment 5) The outline of the address conversion process in the router 1 of the fifth embodiment is shown in FIGS.
The description is omitted because it is the same as that shown in FIG. The difference between the fifth embodiment and the conventional technique lies in that the address translation entry lifetime is optimized in synchronization with the communication protocol state transition.

Address conversion table 1 in router device 1
8 in the protocol / port number discriminator 1 of FIG.
4 refers to the upper layer protocol for TCP packets, monitors the TCP communication contents, and if the FIN message passes, shortens the lifetime of the corresponding entry. If the RST message passes, The entry lifetime management according to the TCP state transition, such as deleting the corresponding entry, is performed.

[0035]

According to the present invention, appropriate communication connectivity is ensured by preventing a communication session from being illegally disconnected due to an address translation function, and a high-speed address can be efficiently utilized by using a memory. A translation entry management scheme can be provided.

[Brief description of the drawings]

FIG. 1 is a diagram showing a network configuration according to a first embodiment of the present invention.

FIG. 2A shows a structure of a conventional address conversion table; FIG. 2B shows a structure of an address conversion table in the embodiment;

FIG. 3 is a flowchart illustrating a flow of an address conversion process performed by the router device according to the embodiment;

FIG. 4 is an explanatory diagram of grouping of address translation entries and synchronization of the lifetime of entries by the router device according to the present embodiment;

FIG. 5 is a diagram showing a configuration of an address conversion table of a router device according to a second embodiment.

FIG. 6 is a diagram illustrating a setting example of a lifetime of an address translation entry by the router device 1 according to the third embodiment.

FIG. 7 is a diagram illustrating a network configuration according to a fourth embodiment;

FIG. 8 is a diagram showing an outline of a conventional network configuration and address conversion processing;

FIG. 9 is an explanatory diagram showing a problem that may occur due to the address conversion process according to the conventional method.

[Explanation of symbols]

 DESCRIPTION OF SYMBOLS 1 Router device 2 WAN 2a Terminal 2b Internet 2c, 2d Network 3 LAN 3a PC 11 LAN interface unit 12 WAN interface unit 13 Input processing unit 14 Protocol / port number discrimination unit 15 Address conversion processing unit 16 Routing unit 17 Timer management unit 18 Address Conversion table

 ──────────────────────────────────────────────────続 き Continued on the front page F term (reference) 5K030 HC01 HC14 HD03 HD06 HD09 KA05 LB05 5K033 CB09 DA06 DB18 EC04

Claims (5)

[Claims] 1. A router device for performing an address translation by interposing between a global address network and a private address network, comprising a protocol / port number discriminating unit for identifying a series of communication sessions, wherein the protocol / port number discriminating unit is A router device for associating an address translation entry in an address translation table and synchronizing the entry lifetime. 2. The system according to claim 1, wherein the protocol / port number discriminating unit groups the plurality of address translation entries identified as the series of communication sessions and performs a collective operation for each group. 2. The router device according to 1. 3. The router device according to claim 1, wherein said protocol / port number discriminator allocates an appropriate entry lifetime according to the nature of a communication protocol when generating an address translation entry. 4. The router device according to claim 1, wherein said protocol / port number discriminating unit allocates an appropriate entry lifetime according to a communication partner when an address translation entry is generated. 5. The protocol / port number discriminating unit monitors the series of communication sessions and dynamically changes an entry lifetime while grasping a communication state between terminals. Item 2. The router device according to item 1.