JP2004112018A - INTERNET ACCESS Web MONITOR AND CONTROL SYSTEM - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To provide a monitor and control system wherein only an authorized Web client can access a control unit with a Web server function installed in the intranet of a private network through the Internet. <P>SOLUTION: By an address port conversion router with a dynamic port mapping function, the passing of packets to the inside of the intranet through the Internet is made possible, and an intranet apparatus name server is installed in the system to open information (public IP and public port number) for access to an internal apparatus into public. The access information is open to only Web clients each having an electronic certificate. Further, dynamically changing the public port number for access to the internal apparatus makes a third party difficult to specify the public port number. <P>COPYRIGHT: (C)2004,JPO

Description

[0001]
TECHNICAL FIELD OF THE INVENTION
The present invention relates to a system for monitoring and controlling a control device with a Web server function in an intranet configured by a private network by accessing the control device from the Internet.
[0002]
[Prior art]
A special router is required to access a control device with a Web function connected to the private address intranet from the Internet. FIG. 4 shows a conventional example using an address translation router. Reference numeral 10 denotes a private network forming an intranet, and 60 denotes the Internet. Reference numeral 11 denotes a control device 1 with a Web server function. For explanation, the IP address of this device is 192.168.0.11. Reference numeral 51 denotes a Web client device (hereinafter, abbreviated as Web client) that accesses 11. Reference numeral 20 denotes an address translation router that relays the intranet and the Internet. This router has a function of transferring a packet addressed to a specific port number to a predetermined private address. This function is known as a port forwarding function or a static IP masquerading function. For the sake of explanation, the address on the intranet side of this router is 192.168.0.1, and the address on the Internet side is 210.130.30.1. This router internally has an address conversion table shown in FIG. The internal IP is a private IP address that specifies an intranet internal device (hereinafter, abbreviated as an internal device), and the internal port number is a port number on which a server application running on the device is on standby. The public IP and public port number are the global IP address and port number for which the address translation router discloses the internal IP and internal port number to the Internet.
[0003]
According to this table, a packet having a destination IP address of 210.130.30.1 and a port number of 80 is input, and the control device with a Web server function in which the IP is 192.168.0.11 and the port number is 80 is waiting. 1 is transferred to one Web server application. As a result, the device can be accessed from the Internet. However, in the conventional example, the Web client can access only an internal device determined in advance for each port number. The internal device is connected to an intranet, but is accessible from the Internet by an address translation router. It is possible for a third party to execute a port scan on the Internet, detect a public port number, and access an internal device.
[0004]
FIG. 6 is an improvement of the conventional example of FIG. The same components as those in FIG. 4 are denoted by the same reference numerals and description thereof is omitted. The configuration is such that the address translation router is replaced with an address / port translation router. Reference numeral 30 denotes an address / port conversion router that relays the intranet and the Internet. This router has a function of converting both a destination IP address and a port number of a packet input from the Internet and transferring the packet to a private address. For the sake of explanation, it is assumed that the address on the intranet side of this router is 192.168.0.1 as in the case of FIG. 4, and the address on the Internet side is 210.130.30.1. This router internally has an address / port conversion table shown in FIG. The internal IP is the private IP address of the internal device, and the internal port number is the port number on which the server application running on the device is on standby. The public IP and the public port number are an IP address and a port number that make the internal IP and the internal port number public so that they can be accessed from the Internet via the address / port conversion router.
[0005]
Reference numeral 52 denotes a Web client device with a port number designation function. This device is equipped with a function that allows access to an internal device server application using a public port number instead of an internal port number.
[0006]
Since the address / port conversion router converts both the IP address and the port number of the input packet, the Web client can access a plurality of internal device server applications waiting on the same port number. Reference numeral 12 denotes an added control device 2 with a Web server function. For explanation, the IP address of this device is 192.168.0.12. According to the table shown in FIG. 7, a packet input with a destination IP address of 210.130.30.1 and a port number of 1000 has a Web server function with an IP of 192.168.0.11 and a standby port number of 80. The data is transferred to the Web server application of the control device 1. According to the table shown in FIG. 7, a packet input with a destination IP address of 210.130.30.1 and a port number of 1002 has a Web server function with an IP of 192.168.0.12 and a standby port number of 80. The data is transferred to the Web server application of the control device 2. As a result, Web servers of a plurality of internal devices can be accessed from the Internet.
[0007]
However, the following problems remain in the improved example of FIG. The Web client cannot obtain information for accessing the internal device online. Therefore, the Web client needs to store all information for accessing the internal device. When the access information to the internal device is changed, the Web client cannot access the internal device. The internal device is connected to an intranet, but is accessible from the Internet by an address / port conversion router. The access information to the internal device (address / port conversion table in FIG. 7) is fixed. As a result, it is possible for a third party to execute a port scan on the Internet to detect a public port number and access an internal device.
[0008]
[Problems to be solved by the invention]
An object of the present invention is to allow only a client having a specific right to access a control device with a Web server function in an intranet configured by a private network from the Internet.
[0009]
[Means for Solving the Problems]
According to the first aspect of the present invention, an intranet device name server addressed by a global address is installed on the Internet side, and this device allows a Web client to access an application of each device in the intranet. The public IP and the public port number necessary for this purpose are managed and provided.
[0010]
A second aspect of the present invention is configured so that data of an intranet device name server can be obtained only by a Web client having a specific right.
[0011]
According to a third aspect of the present invention, a public port number for an application of each internal device is not fixed but is changed under a predetermined condition.
[0012]
According to a fourth aspect of the present invention, a special delimiter character is used for a domain name for identifying an internal device name, and a Web client interprets the domain name and sends the internal device name to the internal device name server. Is to obtain a public IP and a public port number for accessing the Internet.
[0013]
The invention of claim 5 is that the Web client device accesses the application of the internal device using the public port number obtained above.
[0014]
BEST MODE FOR CARRYING OUT THE INVENTION
Hereinafter, embodiments of the present invention will be described with reference to the drawings. FIG. 1 is a block diagram showing an embodiment of the present invention. The same components as those in FIG. Reference numeral 31 denotes an address / port conversion router with a port mapping function for relaying between the intranet and the Internet. The router 31 has a function of responding to a global address inquiry from the internal device and a function of setting an address / port conversion table (port mapping function) from the internal device. This function is implemented in a UPnP (Universal Plug & Play) router. This router internally has a dynamically rewritable address / port conversion table shown in FIG. Although the contents of this table are the same as those in FIG. 7, in FIG. 2, the internal device can dynamically rewrite the address / port conversion table. That is, the internal device can dynamically change the public port number and publish the internal port number to the Internet. For the sake of explanation, the address on the intranet side of this router is 192.168.0.1 as in the case of FIG. 6, and the address on the Internet side is 210.130.30.1.
[0015]
Reference numeral 40 denotes an intranet device name server newly installed on the Internet side. This apparatus provides a Web client on the Internet with a public IP and a public port number for accessing the internal apparatus server application from the intranet apparatus name and the internal port number of the server application standby. This device has data as shown in FIG. The intranet device name is a device name for identifying a device in the intranet. This name must be unique within the range of devices managed by the intranet device name server. The internal port number is a port number on which the internal device server application is waiting. The data in the intranet device name server is configured to be provided only to authorized Web clients.
[0016]
Reference numeral 53 denotes a Web client device having an internal device name resolution function / port number designation function. That is, the Web client device has a function of interpreting a domain name in which the internal device is described and obtaining a public IP and a public port number for accessing the internal device, and specifying the obtained public port number to specify the internal device. Has the ability to access Also, this Web client device has an electronic certificate proving that it has the right to access the internal device and obtain information.
[0017]
For the purpose of explanation, the intranet device names 11 and 12 are assumed to be wdevice1 and wdevice2. The IP addresses of the 40 intranet device name servers are 210.120.1.10. 40, the domain name of the intranet device name server is named inamesvr. xyzabc. co. jp.
[0018]
The intranet devices 11 and 12 cannot be represented by domain names in the existing DNS (Domain Name Server). In this proposal, the internal device is displayed with a domain name using a special character of two consecutive dots as an identifier. Therefore, the domain names of the internal devices 11 and 12 are respectively
wdevice1. . inamesvr. xyzabc. co. jp
wdevice2. . inamesvr. xyzabc. co. jp
It is written as This notation method is an extension of the notation method of the domain name used in the existing DNS when there is an internal device. In this notation, inamesvr. xyzabc. co. jp is also the host name of the intranet device name server.
[0019]
The operation of the present invention will be described. The internal device 11 opens the HTTP server application (standby at the internal port number 80) and the HTTPS server server application (standby at the internal port number 443) to the address / port conversion router 31 to the outside with the port numbers 1000 and 1001, respectively. Issues a port mapping request to. At the same time, the internal device 11 also sends an HTTP server application (standby at the internal port number 80) and an HTTPS server application (standby at the internal port number 443) with its own device name wdevice1 to the intranet device name server 40, and a public IP. At 210.130.30.1, data indicating that the external port number is accessible at 1000 and 1001 is issued. Similarly, the internal device 12 issues a port mapping request to the address / port change router 31 and issues public data of its own server application to the intranet device name server 40. As a result, the table of FIG. 2 is created inside the port / address translation router 31 with the port mapping function. The data of FIG. 3 is still created in the intranet device name server 40.
[0020]
If the Web client is wdevice1. . inamesvr. xyzabc. co. An example will be described in which an HTTP server application (standby at an internal port number 80) of an apparatus described in a domain by jp is accessed. First, the Web client uses the existing DNS function, inamesvr. xyzabc. co. Perform name resolution up to jp. The resolved IP address 210.120.1.10 is the IP address of the host of the intranet device name server. The Web client knows that the special characters of two consecutive dots are internal devices. Therefore, the Web client issues a name wdevice1 after two consecutive dots and an internal port number (80) to the intranet device name server to inquire access information to the internal device. At this time, the Web client presents an electronic certificate certifying that the Web client is an authorized client. The intranet device name server checks the electronic certificate and determines whether the client is a client who can return an answer. If it is a client that can return an answer, the public IP and public port number for accessing the internal device are returned to the Web client. There is no response if the digital certificate is rejected. When a Web client accesses a domain name having two consecutive dots and having no special characters, the Web client executes all name resolution using the existing DNS function.
[0021]
The Web client accesses the HTTP server application of the internal device 11 using the public IP (210.120.1.10) and the public port number (1000) obtained above.
[0022]
The device in the intranet cancels the current port mapping and issues a new port mapping request to the address / port conversion router at the timing set by the conditions to randomly change the public port number. At the same time, this change data is also transmitted to the intranet device name server to reflect the public port number on the latest one. Also in FIG. 1 showing the embodiment of the present invention, the internal device is connected to the inside of the intranet, but can be accessed from the Internet by an address / port conversion router. However, since the public port number is dynamically changed, it is difficult for a third party to track and detect the changed public port number. Even if the public port number is detected, it becomes invalid after a certain time. It takes about 10 hours to porch scan all possible 65536 TCP port numbers in the actual measurement result. Therefore, if the public port number is switched and operated every hour, it becomes difficult for a third party to detect and track the public port number.
[0023]
The Web client caches access information to the internal device. Therefore, when the public port number is changed, the Web client fails to access the internal device because the access information to the caching internal device becomes old. In this case, the latest information is obtained and accessed from the intranet apparatus name server, and the caching information is updated.
[0024]
An application example of the present invention will be described. In order for the intranet device name server to return an answer only to a client having a specific authority, various methods such as a combination of a login name and a password other than the electronic certificate can be adopted.
[0025]
Further, the data in the intranet device name server can be encrypted and stored with the public key of the Web client so that only the specific Web client having the private key can obtain the data. By employing this public key method, access information can be managed more finely for each Web client.
[0026]
If the IP address of the Web client is limited, packet filtering can be set in the address / port translation router. This makes it more difficult for a third party to access the internal device.
[0027]
【The invention's effect】
According to the present invention, the following effects can be obtained.
[0028]
According to the first aspect, the presence of the intranet device name server allows a Web client to access a plurality of intranet devices. Even when the public port number is dynamically changed, the Web client can obtain the latest information for accessing the intranet.
[0029]
According to the second aspect, since only the authorized Web client can obtain the public IP and the public port number for accessing the internal device from the intranet device name server, it is difficult for a third party to access the internal device. Become.
[0030]
According to the third aspect, since the public port number is not fixed, it becomes difficult for a third party to detect the public port number for accessing the internal device, and it becomes difficult for the third party to access the internal device. Become.
[0031]
According to the fourth aspect, a domain name notation compatible with the conventional DNS is used to specify the internal device, so that the new internal device name can be expressed while maintaining compatibility with the conventional domain name notation. become. The Web client can resolve the name up to the intranet device name server by the conventional DNS function, and can obtain the public IP and the public port number for accessing the internal device from the intranet device name server.
[0032]
According to the fifth aspect, the Web client has a function of specifying a port number to access, so that the internal device can be accessed by the public port number obtained in the fifth aspect.
[Brief description of the drawings]
FIG. 1 is a configuration diagram showing one embodiment of the present invention.
FIG. 2 is a dynamically rewritable address / port conversion table.
FIG. 3 shows data in an intranet device name server.
FIG. 4 is a configuration diagram of a conventional example.
FIG. 5 is an address conversion table.
FIG. 6 is an improved example.
FIG. 7 is an address / port conversion table.
[Explanation of symbols]
10 Private network 11 Control device 1 with Web server function
12 Control device 2 with Web server function
Reference Signs List 20 address translation router 30 address / port translation router 31 address / port translation router 40 with port mapping function intranet device name server 51 web client device 52 web client device 53 with port number designation function 53 internal device name resolution function / port number designation function Web client device 60 Internet

Claims (5)

Supervision and control comprising a device in an intranet addressed by a private address, a Web client device connected to the Internet and addressed by a global address, and an address / port translation router for translating the Internet and the intranet by translating addresses and port numbers. In the system, an intranet device name server addressed by a global address is additionally installed on the Internet side, and this device sets a public IP and a public port number necessary for a Web client to access an application of each device in the intranet. A supervisory control system characterized by the configuration provided. 2. The monitoring control system according to claim 1, wherein the data of the intranet device name server is configured to be readable only by a Web client having a specific right. 2. The supervisory control system according to claim 1, wherein a public port number for accessing an application of each internal device is not fixed, but is changed according to a predetermined condition. 2. The monitoring and control system according to claim 1, wherein a domain name that identifies the device name in the intranet is used as a special delimiter, and the Web client interprets the domain name, A monitoring control system characterized by obtaining a public IP and a public port number for accessing an internal device from an intranet device name server. 2. The monitoring control system according to claim 1, wherein the Web client device accesses an application of the internal device using the public port number obtained in claim 4.

Images