JP2004064182A - Inter-private-network connection method and gateway control apparatus - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To provide an inter-private-network connection method and a gateway control apparatus capable of efficiently and flexibly interconnecting private networks. <P>SOLUTION: Gateways 41, 51 connected to user packet communication networks 4, 5 and access control apparatuses 11, 12, 21, 22 of the packet communication networks 1, 2 are individually connected, each of the gateways 41, 51 refers to a routing table to control a path of packets to the packet communication networks 1, 2, refers to a filtering table to perform transfer or abort control of packets, and refers to an address conversion table to perform address conversion control of the packets so as to allow the private networks configured by using the packet communication networks 1, 2 to exchange the packets. Further, the gateway control apparatus 32 acquires policy of connection priority from a policy control apparatus 31 and acquires address assignment information or the like from a connection authentication control apparatus 33 to generate and set each table possessed by each gateway. <P>COPYRIGHT: (C)2004,JPO

Description

[0001]
TECHNICAL FIELD OF THE INVENTION
The present invention relates to a connection method between private networks and a gateway control device, and relates to a connection between private networks physically configured in a closed area and a method such as IP-VPN (IP Virtual Private Network) and VLAN (Virtual Local Area Network). The present invention relates to a private network connection method and a gateway control device for realizing a connection between logically configured virtual private networks.
[0002]
[Prior art]
At present, in a public network, a service of a virtual private network (hereinafter, referred to as a VPN: Virtual Private Network) using a public network like a leased line communication network is provided.
Since this VPN is provided as a service cheaper than a dedicated line system in order to multiplex communication of each user and improve accommodation efficiency, many users including companies have introduced the VPN.
[0003]
Such a VPN has been attracting much attention because there is an example of constructing a VPN using a wide area packet communication network such as a provider communication network or the Internet, that is, a so-called wide area intranet, and a secure network can be easily constructed.
In a VPN using a wide area packet communication network, a service called extranet connection is also provided in order to realize communication between individual VPNs.
In this extranet connection, packet communication between VPNs is realized by performing packet control such as packet filtering and address conversion.
[0004]
Conventionally, as a system for realizing such an extranet connection, a private network connection system for managing each VPN is constructed, and the above-described packet control is performed by a VPN connection device installed in the private network connection system. A device that performs intensive control has been proposed (for example, see Japanese Patent Application Laid-Open No. 2002-94508).
[0005]
According to this, regarding the setting of the inter-VPN connection device, the connection rule between the VPNs is managed by the policy server as a policy, and the policy server sets the control setting of the inter-VPN connection device in accordance with the contract information of the user or the connection request. Are automatically generated, and a packet filtering table and an address conversion table of the inter-VPN connection device are set.
Furthermore, regarding connection of the user packet communication network to the VPN, a RADIUS (Remote Authentication Dial In User Service) server manages user authentication information and address assignment to the user, authenticates the user, and performs gateway of the user packet communication network. And a connection with the VPN.
[0006]
[Problems to be solved by the invention]
However, such a conventional connection method between private networks has a problem that private networks cannot be connected efficiently and flexibly.
That is, in the conventional private network connection method, extranet communication traffic between any private networks included in the system always passes through the VPN connection device.
[0007]
For this reason, there is a problem that interference occurs between a large number of extranet communication traffics as the number of users performing extranet communication increases and the bandwidth of the connection between the user network and the service network increases.
In addition, there is a problem in that an inter-VPN connection device having sufficient transfer processing performance to reduce interference increases costs.
[0008]
Therefore, when the extranet connection service is provided by the inter-VPN connection device as in the related art, the extranet communication traffic concentrates on the inter-VPN connection device, and the throughput of the inter-VPN communication decreases and the cost of the inter-VPN connection device increases. Invite.
An object of the present invention is to solve such a problem, and an object of the present invention is to provide a private network connection method and a gateway control device capable of efficiently and flexibly connecting private networks.
[0009]
[Means for Solving the Problems]
In order to achieve such an object, a method for connecting private networks according to the present invention comprises connecting a plurality of packet communication networks, and connecting these packet communication networks, and referring to a filtering table of the packet communication network. A packet communication network connection device that controls the transfer or discarding of packets communicated by using the own address translation table and performs packet address translation control, and the rules of whether communication between packet communication networks is possible A policy control device that manages and controls a filtering table and an address translation table of a packet communication network connection device, and is connected between a packet communication network and a gateway of each user packet communication network connected via the network; Transfer of packets communicated between the user packet communication network and the packet communication network Or a plurality of access control devices for controlling discarding, and managing user authentication information and addresses allocated to the user packet communication network, and performing transfer control in the access control device and transmission to the user packet communication network based on a result of user authentication. Used in a private network connection system having a connection authentication control device for controlling the address allocation of each packet communication network, each user packet communication network connected to each packet communication network, and each user packet communication network For a plurality of private networks composed of user terminals, it is assumed that a private network connection method for realizing packet exchange between these private networks is assumed.
[0010]
In such a private network connection method, a gateway connected to each user packet communication network via a network and an access control device of each packet communication network are individually connected, and each gateway uses a routing table of the gateway. , Control the route of the packet to each packet communication network, refer to the filtering table of the gateway, control the transfer or discard of the packet, and refer to the address translation table of the gateway to translate the address of the packet. By performing the control, packets are exchanged between the private networks configured using the respective packet communication networks.
[0011]
Regarding the table used in each gateway, the gateway control device provided in the private network connection system collects address allocation information, address conversion information, and filtering information used for the configuration of each private network from the private network connection system. Based on the information, a routing table, a filter link table, and an address conversion table used in the gateway may be generated.
[0012]
In addition, the gateway control device according to the present invention connects a plurality of packet communication networks and these packet communication networks, and refers to its own filtering table to transfer or discard packets communicated between the packet communication networks. A packet communication network connecting device that performs control and refers to its own address conversion table to perform address conversion control of packets, and a packet communication network connecting device that manages, as a policy, a rule of whether or not communication between packet communication networks is possible. A policy control device for controlling a filtering table and an address translation table of the user packet communication network and a packet communication network connected via a network. Control the forwarding or discarding of packets communicated between Access control device, and connection authentication control for managing user authentication information and an address assigned to a user packet communication network, and controlling transfer control in the access control device and address assignment to the user packet communication network based on a user authentication result. A plurality of private networks each comprising a packet communication network, each user packet communication network connected to each packet communication network, and user terminals connected to each user packet communication network. It is used in a private network connection system that realizes exchange of packets between them, and is premised on a gateway control device that controls each gateway.
[0013]
In such a gateway control device, access to each packet communication network via the network is performed based on address allocation information, address conversion information, and filtering information used for the configuration of each private network collected from the private network connection system. It is provided with a table generation unit that generates a routing table, a filter link table, and an address conversion table used in a gateway individually connected to the control device.
[0014]
At this time, the WWW server function unit that communicates with the user terminal by the HTTP protocol, and the IP address of the connection request destination accepted by the WWW server function unit is the IP address of the private network to which the user terminal does not belong. In this case, the packet communication network connection request receiving unit that receives the connection request as a packet communication network connection request, and the tables generated by the table generation unit in response to the request reception by the packet communication network connection request receiving unit are desired. A gateway setting unit for setting a gateway of the user packet communication network to which the user terminal is connected in response to the request reception in the table generation unit. A table may be set for the gateway.
[0015]
Alternatively, a DNS server function unit for notifying an IP address corresponding to an IP address inquiry from a user terminal, and an IP address of an inquiry destination accepted by the DNS server function unit may be an IP address of a private network to which the user terminal does not belong. If the address is an address, an inter-packet communication network connection request accepting unit that accepts an inquiry as an inter-packet communication network connection request, and each table generated by the table generating unit in response to the request received by the inter-packet communication network connection request accepting unit. And a gateway setting unit for setting a desired gateway to a desired gateway, wherein the table generation unit generates each table used in a gateway of the user packet communication network to which the user terminal is connected in response to the request reception, and the gateway setting unit , Set each table for the gateway It may be.
[0016]
BEST MODE FOR CARRYING OUT THE INVENTION
Next, embodiments of the present invention will be described with reference to the drawings.
FIG. 1 is a block diagram showing a configuration of a private network connection system according to one embodiment of the present invention.
The private network connection system 10 includes a plurality of packet communication networks 1 and 2 connecting the user packet communication networks 4 and 5, and controls the packet communication networks 1 and 2 to establish an extranet connection between the user packet networks. Various control devices for realizing the control, a management network 3 connecting these control devices, and a gateway 41 connecting the user packet communication networks 4 and 5 to the packet communication networks 1 and 2 via access networks 6 and 7, 51.
[0017]
User terminals 42 and 52 are connected to the user packet communication networks 4 and 5, respectively, and via the gateways 41 and 51, PPP connections 61 to 64 which are logical connections of the access networks 6 and 7 are used. It is connected to the access control devices 11, 21, 12, 22.
The user packet communication network 8 to which the servers 83 and 84 are connected is connected to the packet communication network 2 via the dedicated connection line 80 and the router 23.
[0018]
In the private network connection system 10, the control devices include a policy control device 31, a gateway control device 32, a connection authentication control device 33, a packet communication network connection device 34, and access control devices 11, 12, 21, 22. Is provided.
The packet communication network connecting device 34 connects the packet communication networks 1 and 2, refers to its own filtering table, controls the transfer or discard of packets communicated between these packet communication networks, and converts its own address conversion. The address conversion of the packet is controlled with reference to the table.
[0019]
The policy control device 31 manages a rule of whether communication between the packet communication networks 1 and 2 is possible as a policy and controls a filtering table and an address conversion table of the inter-packet communication network connecting device 34.
The access control devices 11, 12, 21, 22 are connected to the gateways 41, 51 of the user packet communication networks 4, 5 connected to the private network connection system 10 via the access networks 6, 7, and the packet communication networks 1, 2. To control transfer or discard of packets exchanged between the user packet communication networks 4 and 5 and the packet communication networks 1 and 2.
[0020]
The connection authentication control device 33 manages user authentication information of each user and addresses assigned to the user packet communication networks 4 and 5, and controls transfer of the access control devices 11, 12, 21 and 22 based on the user authentication result. And assigns addresses to the user packet communication networks 4 and 5.
The gateway control device 32 collects address conversion information and filtering information from the policy control device 31 and collects address assignment information from the connection authentication control device 33.
Then, based on the information, a routing table, a filter link table, and an address conversion table used by the gateways 41 and 51 are generated and set to desired gateways 41 and 51.
[0021]
The gateways 41 and 51 connected to the user packet communication networks 4 and 5 connect to the access control devices 11, 12, 21 and 22 of the packet communication networks 1 and 2 via the access networks 6 and 7. At this time, the gateways 41 and 51 control the route of the packet to the packet communication networks 1 and 2 with reference to their own routing tables.
In addition, control of forwarding or discarding of packets is performed with reference to its own filtering table, and address conversion control of packets is performed with reference to its own address conversion table.
[0022]
FIG. 2 is an explanatory diagram illustrating a configuration example of a private network.
The user terminals 42 and 52 belong to the private network A configured by using the packet communication network 1, and the connection authentication control device 33 individually assigns IP addresses A1 and A2 that can be used in the packet communication network 1. ing.
These IP addresses A1 and A2 are used for packet transmission and reception in the packet communication network 1. The IP address A0 indicates the network address of the private network A to which A1 and A2 belong.
[0023]
The servers 83 and 84 belong to a private network D configured using the packet communication network 2, and are assigned IP addresses D 3 and D 4 that can be used in the packet communication network 2 by the connection authentication control device 33.
These IP addresses D3 and D4 are used for packet transmission and reception in the packet communication network 2. The IP address D0 indicates the network address of the private network D to which the IP addresses D3 and D4 belong.
[0024]
Further, in the private network A and the private network D, the addresses are independently assigned, and therefore, the addresses are duplicated, that is, the IP address A1 or the IP address A2 and the IP address D3 or the IP address D4 have the same value. Therefore, address conversion is performed in the private network communication between the user terminals 42 and 52 and the servers 83 and 84.
In this example, IP addresses C1 and C2 that are available in the private network D and do not overlap with the IP addresses D3 and D4 are individually assigned to the user terminals 42 and 52 by the connection authentication control device 33. The address conversion rules between the addresses A1 and A2 and the IP addresses C1 and C2 are held by the policy control device 31.
[0025]
Further, IP addresses B3 and B4 that are available in the private network A and do not overlap with the IP addresses A1 and A2 are assigned to the servers 83 and 84, and the IP addresses D3 and D4 and the IP addresses B3 and B4 are The address conversion rule is held by the policy control device 31.
[0026]
FIG. 3 shows a configuration example of the gateway control device 32.
The gateway control device 32 includes address assignment information 321, address conversion information 322, filtering information 323, a WWW server function unit 324, a packet communication network connection request reception unit 325, a table generation unit 326, and a gateway setting unit 327. ing.
[0027]
In the gateway control device 32, the WWW server function unit 324 receives a connection request for an arbitrary web page from the user terminal 42 by performing data communication with the user terminal 42 using the HTTP protocol.
Then, the packet communication network connection request receiving unit 325 analyzes the IP address of the connection request destination, and if the IP address is an IP address of a private network to which the user terminal 42 does not belong, the connection request is transmitted by packet communication. Accepted as a network connection request.
[0028]
When the inter-packet communication network connection request receiving unit 325 receives the inter-packet communication network connection request, the table generation unit 326 stores a table used by the gateway 41 of the user terminal 42 to which the user packet communication network 4 is connected. A routing table, a filtering table, and an address conversion table are generated. Then, the gateway setting unit 327 sets each table in the gateway 41.
With the above operation, the gateway 41 is automatically controlled in response to the extranet connection request transmitted from the user terminal 42 based on the same rules as the packet communication network connection device 34 controlled by the policy control device 31. Then, an extranet connection can be provided to the user terminal 42.
[0029]
Next, the operation of the gateway control device 32 will be described with reference to FIG. FIG. 4 is an explanatory diagram showing the processing operation of the gateway control device 32.
The gateway control device 32 acquires the address assignment information 321 from the connection authentication control device 33, acquires the address conversion information 322 and the filtering information 323 from the policy control device 31, and holds them.
The table generation unit 326 generates various tables used in the gateway based on the information. That is, a routing table is generated from the address allocation information 321 and the address conversion information 322, a filtering table is generated from the address allocation information 321, the address conversion information 322, and the filtering information 323, and the routing table is generated from the address allocation information 321 and the address conversion information 322. , Generate an address conversion table.
[0030]
The gateway control device 32 sets each table generated in this manner in a gateway, for example, the gateway 41. A general management protocol such as SNMP (Simple Network Management Protocol) may be used for setting the table.
By the above operation, the gateway 41 sets the extranet connection from the user packet communication network 4 to the user packet communication network 8 based on the same rule as the packet communication network connection device 34 controlled by the policy control device 31. Can be automatically performed.
[0031]
FIG. 5 is an explanatory diagram showing an example of a table configuration of the gateway 41. In each table, Prefix is a value indicating a part to be referred to in the address when searching the address conversion table.
The routing table 411 is a table showing a correspondence relationship between a destination IP address (destination IP) of a packet received from the user packet communication network 4 and an output link of the access network 6 to which the packet is to be output.
[0032]
The filtering table 412 indicates a correspondence relationship between a combination of a destination IP address (destination IP) and a source IP address (source IP) of a packet received from the user packet communication network 4 and control of the packet, that is, transfer or discard. It is a table shown.
The address conversion table 413 includes a combination of a destination IP address (destination IP) and a source IP address (source IP) of a packet received from the user packet communication network 4 and a destination IP address (destination IP) after the address conversion. 6 is a table showing a correspondence relationship between the IP address and a transmission source IP address (transmission source IP).
[0033]
The routing table 414 is a table showing the correspondence between the destination IP address of the packet received from the packet communication network 2 (PPP connection 62) and the output link of the access network 6.
The filtering table 415 indicates a correspondence relationship between a combination of a destination IP address (destination IP) and a source IP address (source IP) of a packet received from the packet communication network 2 and control of the packet, that is, transfer or discard. It is a table.
The address translation table 416 includes a combination of a destination IP address (destination IP) and a source IP address (source IP) of a packet received from the packet communication network 2, a destination IP address (destination IP) after the address translation, and 6 is a table showing a correspondence relationship with a transmission source IP address (transmission source IP).
[0034]
Next, the operation of the private network connection system 10 will be described with reference to FIG. 1, FIG. 2 and FIG.
First, a case where packets are exchanged between the user terminals 42 and 52 belonging to the same private network A (network address A0) will be described.
[0035]
When the user terminal 42 assigned the IP address A1 transmits a packet to the user terminal 52 assigned the IP address A2, the gateway 41 receives the packet from the user terminal 42 via the user packet communication network 4, Refer to the routing table 411 in FIG.
Since the destination IP address of the packet is A2 and the output link of the network address A0 to which the destination IP address A2 belongs indicates 61, the PPP connection 61 of the access network 6 is determined as the transfer route of the packet. .
[0036]
At this time, although the filtering table 412 and the address conversion table 413 are referred to, the packet does not correspond to the setting contents of any of the tables, so that the packet is transferred without filtering or address conversion of the packet.
By the above operation, the user terminal 42 is connected to the packet communication network 1 without performing the filtering and address conversion processing, and can perform packet communication with the user terminal 52 as a terminal of the same private network A.
[0037]
Next, a case where packets are exchanged between the user terminal 42 belonging to the private network A and the servers 83 and 84 belonging to another private network D will be described.
When transmitting a packet to the server 83, the user terminal 42 transmits the packet with the IP address B3 available in the packet communication network 1 of the server 83 as a destination. The gateway 41 refers to the routing table 411, and determines the PPP connection 62 as a transfer route corresponding to the network address B0 to which the destination IP address B3 belongs.
[0038]
At this time, referring to the filtering table 412, since the control corresponding to the set of the destination IP address B3 and the source IP address A1 indicates the transfer, the transfer of the packet is determined.
Also, referring to the address conversion table 413, the destination IP address D3 and the source IP address C1 are set as the converted addresses corresponding to the above set, so that these addresses are rewritten and transferred.
[0039]
Further, when transmitting a packet to the server 84, the user terminal 42 transmits the packet with the IP address B4 available in the packet communication network 1 of the server 84 as a destination. The gateway 41 refers to the routing table 411 and determines the transfer route as the PPP connection 62 based on the network address B0 of the destination IP address B4.
Here, referring to the filtering table 412, since the packet corresponds to the combination of the network address B0 of the destination IP and the source IP address A0, the packet is discarded without being transferred.
[0040]
On the other hand, when the server 83 transmits a packet to the user terminal 42, the server 83 transmits the packet to the IP address C1 of the user terminal 42 that can be used in the packet communication network 2 as a transmission destination.
The gateway 41 receives this packet via the PPP connection 62, refers to the routing table 414, and determines the user packet communication network 4 as a transfer route corresponding to the destination IP address C1.
[0041]
At this time, referring to the filtering table 415, since the control corresponding to the set of the destination IP address C1 and the source IP address D3 indicates the transfer, the transfer of the packet is determined.
Also, referring to the address conversion table 416, the destination IP address A1 and the source IP address B3 are set as converted addresses corresponding to the above set, so that these addresses are rewritten and transferred.
[0042]
When the server 84 transmits a packet to the user terminal 42, the server 84 transmits the packet with the IP address C1 of the user terminal 42 usable in the packet communication network 2 as a transmission destination.
The gateway 41 receives this packet via the PPP connection 62, refers to the routing table 414, determines the transfer route as the user packet communication network 4 based on the destination IP address C1, but refers to the filtering table 415, The packet is discarded because it corresponds to the set of the network address C0 of the destination IP and the source IP address D0.
[0043]
By the above operation, the user terminal 42 can perform extranet communication with the user packet communication network 8 without passing through the inter-packet communication network connecting device 34, and perform packet communication between the user terminal 42 and the server 83. Is permitted, and packet communication between the user terminal 42 and the server 84 is denied.
The gateway 51 also has the same table configuration as described above, and performs the same processing operation as described above.
[0044]
In this way, the gateway of each user packet communication network and the access control device of each packet communication network are individually connected, and each gateway refers to the routing table of the gateway to determine the route of the packet to each packet communication network. Control by referring to the filtering table of the gateway, and controlling the transfer or discarding of packets, and by referring to the address conversion table of the gateway, performing address conversion control of the packet. Since packets are exchanged between the private networks, the private networks can be efficiently and flexibly connected without using a packet communication network connection device.
Therefore, the communication traffic of the extranet is not concentrated on the packet communication network connecting device as in the prior art, but is distributed to the respective gateways, thereby avoiding a decrease in the throughput of the private network communication and an increase in the cost of the private network connecting device. it can.
[0045]
Further, in the conventional connection method between virtual private networks, since a different address is assigned to the user packet communication network at the time of connection, the routing table, the filtering table, and the address conversion table of the extranet communication between the private networks are connected each time the connection is made. Unlike the conventional policy server, which performs centralized connection control in the packet communication network connection device, the control cannot be performed.
Therefore, control of extranet communication cannot be controlled at the gateway of the user packet communication network.
On the other hand, according to the present embodiment, address assignment information, policy information, and the like are obtained from the connection authentication control device and the policy control device, and each table to be set in the gateway is generated. No problem.
[0046]
FIG. 6 shows another configuration example of the gateway control device 32.
This gateway control device 32 is the same as the above-described gateway control device except that a DNS (Domain Name System) server function unit 328 is provided instead of the WWW server function unit 324 in FIG.
In the gateway control device 32, the DNS server function unit 328 accepts an IP address inquiry from the user terminal 42 by performing data communication with the user terminal 42.
At this time, the packet communication network connection request receiving unit 325 analyzes the IP address of the inquiry destination, and if the IP address is of a private network to which the user terminal 42 does not belong, the inquiry is used as a packet communication network connection request. Accept.
[0047]
In the table generation unit 326, when the packet communication network connection request receiving unit 325 receives the packet communication network connection request, the user packet communication network 4 of the user terminal 42 is connected as shown in FIG. A routing table, a filtering table, and an address conversion table are respectively generated as tables used by the gateway 41. Then, the gateway setting unit 327 sets each table in the gateway 41.
With the above operation, the gateway 41 is automatically controlled in response to the extranet connection request transmitted from the user terminal 42 based on the same rules as the packet communication network connection device 34 controlled by the policy control device 31. Then, an extranet connection can be provided to the user terminal 42.
[0048]
In the conventional connection method between private networks, a routing table, a filtering table, and an address conversion table required for extranet communication between private networks are generated based on a procedure for requesting extranet communication by a user.
Therefore, even when the user packet communication network is connected to a plurality of private networks, a connection procedure is required to perform extranet communication, and user convenience is reduced.
[0049]
In the present embodiment, as described above, in the gateway control device, the WWW server function unit or the DNS server function unit and the packet communication network connection request receiving unit are linked, and in response to the detection of the packet communication network connection request, , A table used by the gateway is generated and set.
Thus, the extranet connection between the private networks required for the communication can be performed without requiring the user to perform a special setting request operation for the extranet connection, without requiring the user to perform a special setting request operation for the extranet connection. It can be realized by a very easy operation of accessing to.
[0050]
In the above-described embodiment, an IP-VPN in which the transmission protocol is limited to IP has been described as an example of the VPN. However, the present invention is not limited to this. For example, various VPNs such as a VLAN that can use a LAN protocol can be used. And the same operation and effect can be obtained.
In addition, when the gateways 41 and 51 are connected to the access control devices 11 to 14, a case has been described as an example in which the access networks 6 and 7 are connected to the access networks 6 and 7 via PPP (Point-to-Point Protocol) connections 61 to 64. However, the connection is not limited to this, and connection can be made using a LAN protocol used in VLAN such as Ethernet (registered trademark).
Further, the access control devices 11 and 12 can be configured as the same device as logical functions.
[0051]
【The invention's effect】
As described above, according to the present invention, the gateway of each user packet communication network and the access control device of each packet communication network are individually connected via a network, and each gateway refers to the routing table of the gateway. To control the route of a packet to each packet communication network, perform forwarding or discarding of a packet by referring to the filtering table of the gateway, and perform address translation control of the packet by referring to the address translation table of the gateway. Packets are exchanged between each private network configured using each packet communication network, so that extranet communication can be performed without passing through the packet communication network connection device that connects the packet communication networks. Can connect private networks efficiently and flexibly. .
Therefore, the communication traffic of the extranet is not concentrated on the packet communication network connecting device as in the prior art, but is distributed to the respective gateways, thereby avoiding a decrease in the throughput of the private network communication and an increase in the cost of the private network connecting device. it can.
[0052]
Further, in the gateway control device, the WWW server function unit or the DNS server function unit and the packet communication network connection request receiving unit are linked to generate a table used by the gateway in response to detection of the packet communication network connection request. Since the setting is performed, the extranet connection between the VPNs required for the communication can be performed without requiring the user to perform a special setting request operation for the extranet connection, and the WWW server function unit of the gateway control device. This can be realized by a very easy operation of accessing the DNS server function.
[Brief description of the drawings]
FIG. 1 is a block diagram showing a private network connection system according to an embodiment of the present invention.
FIG. 2 is a configuration example of a private network.
FIG. 3 is a configuration example of a gateway control device.
FIG. 4 is an explanatory diagram showing a processing operation of the gateway control device.
FIG. 5 is a table configuration example of a gateway.
FIG. 6 is another configuration example of the gateway control device.
[Explanation of symbols]
1, 2 ... packet communication network, A, D ... private network, 10 ... private network connection system, 11, 12, 21, 22 ... access control device, 23 ... router, 3 ... management network, 31 ... policy control device, 32: gateway control device, 33: connection authentication control device, 34: connection device between packet communication networks, 4, 5, 8 ... user packet communication network, 41, 51 ... gateway, 42, 52 ... user terminal, 6, 7 ... Access network, 61, 62, 63, 64 ... PPP connection, 80 ... dedicated connection line, 83, 84 ... server, 321 ... address assignment information, 322 ... address conversion information, 323 ... filtering information, 324 ... WWW server function unit, 325: Packet communication network connection request receiving unit, 326: Table generation unit, 327: Gateway setting unit, 328: DNS server Ability portions, 411 and 414 ... routing tables, 412 and 415 ... filtering table, 413, 416 ... address conversion table.

Claims (5)

A plurality of packet communication networks;
The connection between these packet communication networks is performed, the transfer or discarding of the packet communicated between the packet communication networks is controlled by referring to the own filtering table, and the address conversion of the packet is performed by referring to the own address conversion table. An inter-packet communication network connecting device for controlling,
A policy control device that manages a rule as to whether communication is possible between the packet communication networks as a policy and controls a filtering table and an address translation table of the packet communication network connection device;
Control of transfer or discarding of a packet connected between a gateway of each user packet communication network connected via a network and the packet communication network and communicated between the user packet communication network and the packet communication network A plurality of access control devices for performing
A connection authentication control device that manages user authentication information and an assigned address to the user packet communication network, and controls transfer control in the access control device and address assignment to the user packet communication network based on a user authentication result; Used in a private network connection system having
Regarding a plurality of private networks composed of the respective packet communication networks, the respective user packet communication networks connected to the respective packet communication networks, and the user terminals connected to the respective user packet communication networks, between these private networks, A private network connection method for realizing the exchange of packets,
A gateway connected to each user packet communication network via the network and the access control device of each packet communication network are individually connected,
At each of the gateways,
Controlling the route of the packet to each of the packet communication networks with reference to the routing table of the gateway;
Controlling the forwarding or discarding of the packet by referring to the filtering table of the gateway,
By performing address translation control of the packet with reference to the address translation table of the gateway,
A method for connecting private networks, comprising exchanging packets between private networks configured using the packet communication networks. The private network connection method according to claim 1,
A gateway control device provided in the private network connection system,
Collecting address assignment information, address translation information and filtering information used for the configuration of each private network from the private network connection system,
A method for connecting private networks, wherein a routing table, a filter link table, and an address conversion table used in the gateway are generated based on the information. A plurality of packet communication networks;
The connection between these packet communication networks is performed, the transfer or discarding of the packet communicated between the packet communication networks is controlled by referring to the own filtering table, and the address conversion of the packet is performed by referring to the own address conversion table. An inter-packet communication network connecting device for controlling,
A policy control device that manages a rule as to whether communication is possible between the packet communication networks as a policy and controls a filtering table and an address translation table of the packet communication network connection device;
Control of transfer or discarding of a packet connected between a gateway of each user packet communication network connected via a network and the packet communication network and communicated between the user packet communication network and the packet communication network A plurality of access control devices for performing
A connection authentication control device that manages user authentication information and an assigned address to the user packet communication network, and controls transfer control in the access control device and address assignment to the user packet communication network based on a user authentication result; Has,
Regarding a plurality of private networks composed of the respective packet communication networks, the respective user packet communication networks connected to the respective packet communication networks, and the user terminals connected to the respective user packet communication networks, between these private networks, A gateway control device used in a private network connection system that realizes exchange of packets, and controls each of the gateways,
Based on the address allocation information, address translation information, and filtering information used for the configuration of each private network collected from the private network connection system, individually with the access control device of each packet communication network via the network. A gateway control device comprising: a table generation unit that generates a routing table, a filtering table, and an address conversion table used by the connected gateway. The gateway control device according to claim 3,
A WWW server function unit for performing communication with the user terminal by an HTTP protocol;
If the IP address of the connection request destination accepted by the WWW server function unit is an IP address of a private network to which the user terminal does not belong, a packet communication network connection request for accepting the connection request as a packet communication network connection request Reception desk,
A gateway setting unit that sets each table generated by the table generation unit to a desired gateway in response to the request reception by the packet communication network connection request reception unit,
The table generating unit generates each table used in a gateway of a user packet communication network to which the user terminal is connected in response to the request reception,
The gateway control device, wherein the gateway setting unit sets the tables for the gateway. The gateway control device according to claim 3,
A DNS server function unit for notifying an IP address corresponding to an IP address inquiry from the user terminal;
If the IP address of the inquiry received by the DNS server function unit is the IP address of a private network to which the user terminal does not belong, a packet communication network connection request receiving unit that receives the inquiry as a packet communication network connection request When,
A gateway setting unit that sets each table generated by the table generation unit to a desired gateway in response to the request reception by the packet communication network connection request reception unit,
The table generating unit generates each table used in a gateway of a user packet communication network to which the user terminal is connected in response to the request reception,
The gateway control device, wherein the gateway setting unit sets the tables for the gateway.

Images