JP2004266415A - Connection apparatus - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To avoid doubling an address in a VPN and lighten a burden on a manager. <P>SOLUTION: The connection apparatus connected to a main connection apparatus to form a virtual private network comprises an address acquiring means connected to the main connection apparatus for receiving an IP address of the connection apparatus and an IP address usable in an apparatus under control of the connection apparatus allotted from the main connection apparatus; and a means for allotting a new IP address to the apparatus under control from the usable IP address allotted from the main connection apparatus, without permitting the extension of the lease period of the IP address from the apparatus under control, if receiving a request to extend the lease period, when the IP address is already allotted to the apparatus under control of the connection apparatus. Thus, the PI addresses are switched over one to another from a terminal with the lease period expired, and hence no address is doubled. <P>COPYRIGHT: (C)2004,JPO&NCIPI

Description

[0001]
TECHNICAL FIELD OF THE INVENTION
TECHNICAL FIELD The present invention relates to a connection device for configuring a virtual private network (VPN: Virtual Private Network).
[0002]
[Prior art]
The problem of address duplication in VPNs has been discussed previously. In general, the administrator has designed the network of each site in the VPN so as not to cause an address duplication, and avoided the duplication of the IP address by statically setting the IP address to each device. Japanese Patent Application Laid-Open No. 2000-228677 discloses that there is a method of address replacement for address duplication problems that occur at the time of VPN connection or the like, but it is not realistic because it takes a lot of trouble.
[0003]
[Patent Document 1]
Japanese Patent Application Laid-Open No. 2000-228677
[Problems to be solved by the invention]
As described above, the problem of address duplication in VPNs has been discussed in the past, but there are few solutions that reduce the burden on the administrator.
[0005]
Therefore, an object of the present invention is to provide a technique for avoiding address duplication in a VPN and reducing the burden on an administrator.
[0006]
[Means for Solving the Problems]
The connection device according to the first aspect of the present invention, which is connected to the main connection device to form a virtual private network, is connected to the main connection device, and has an IP address of the connection device and a subordinate of the connection device. Address acquisition means for receiving assignment of an IP address usable in the device from the main connection device, and request for extension of the lease period of the IP address from the device under the control if the IP address has already been assigned to the device under the connection device Means for not permitting the extension of the lease period even if the IP address is received, and allocating a new IP address to the subordinate device from the available IP addresses allocated from the main connection device.
[0007]
As a result, the IP address is sequentially switched from the terminal device whose lease period has expired or has expired, so that address duplication does not occur. In addition, since the switching is automatically performed, the administrator does not need to have any special knowledge, and can construct the VPN without further trouble. Note that if the initial lease period is shortened, address switching will be performed earlier.
[0008]
Further, in the first aspect of the present invention, an IP address has already been assigned to a device under the connection device, and an IP address usable by the address acquisition means from the main connection device to a device under the connection device. In the case where the IP address has been assigned, a means for blocking communication to the virtual private network having an IP address other than the available IP address assigned from the main connection device as a transmission source may be further provided. Good. Thus, it is possible to prevent inappropriate data from being transmitted to another site before the address switching is completed.
[0009]
Further, in the first aspect of the present invention, a means for connecting to the main connection device using the IP address of the main connection device and the authentication information of the connection device may be further provided.
[0010]
The connection device according to the second aspect of the present invention for forming a virtual private network by connecting to a lower connection device (for example, the connection device according to the first embodiment) in response to a connection request from the lower connection device Means for performing an authentication process, means for assigning an IP address of a lower connection device and an IP address usable by a device under the lower connection device when the authentication process is successful, and storing the IP address in a storage device; Means for transmitting the stored data of the IP address of the lower connection device and the IP address that can be used by a device under the lower connection device to the lower connection device.
[0011]
The connection device according to the third aspect of the present invention for forming a virtual private network by connecting to a lower connection device (for example, the connection device according to the first embodiment) corresponds to a connectable lower connection device. Storage means for storing an IP address of the lower-level connection device and an IP address that can be used by a device subordinate to the lower-level connection device; means for performing authentication processing in response to a connection request from the lower-level connection device; Means for transmitting, to the lower-level connection device, the data of the IP address of the lower-level connection device stored in the storage means and an IP address usable by a device subordinate to the lower-level connection device when the authentication process is successful.
[0012]
It is also possible to create a program that operates as the connection device described above, and the program can be a storage medium such as a flexible disk, a CD-ROM, a magneto-optical disk, a semiconductor memory, a hard disk, or a storage device. Is stored in In some cases, digital signals are distributed via a network. Data being processed is temporarily stored in a computer memory.
[0013]
BEST MODE FOR CARRYING OUT THE INVENTION
FIG. 1 shows a schematic diagram of a system according to an embodiment of the present invention. In the Internet 1, a site A, a site B, and a site C are connected to construct a VPN. Although encryption and the like are performed to construct a VPN, they are not directly related to the gist of the present invention, and thus description thereof is omitted here. In the present embodiment, a device that connects to the Internet 1 at the site A is a VPN main connection device 5, a device that connects to the Internet 1 at the site B is a VPN connection device 3a, and a device that connects to the Internet 1 at the site C is a VPN. The connection device is referred to as a connection device 3b.
[0014]
The VPN main connection device 5 includes an address management unit 52 that manages lower VPN connection devices 3a and 3b to be connected and the like, an authentication processing unit 51 that performs authentication processing of lower VPN connection devices 3a and 3b to be connected and the like, It has a DHCP server unit 53 that assigns IP addresses to terminals 305 and 306 connected to the VPN main connection device 5 in the site A. The address management unit 52 manages a table as shown in FIG. 2, for example. In the example of the table shown in FIG. 2, a column 201 of a base name, a column 202 of a user ID, a column 203 of a password, a column 204 of a VPN device IP address, a column 205 of a network address, and a column of a subnet mask 206 are provided. As described above, the user ID and the password, which are the authentication information, are managed for each site, and are used by the authentication processing unit 51 at the time of the authentication process. Further, the IP address of the VPN device (the VPN main connection device 5 and the VPN connection devices 3a and 3b, etc.), the network address and the subnet mask representing the group of IP addresses that can be used for the subordinate terminals are registered for each base. . This table may be set statically, or the values of the columns of the VPN device IP address, network address, and subnet mask of the VPN connection device may be dynamically assigned according to a predetermined rule. . The DHCP server unit 53 obtains an IP address from a group of IP addresses assigned to the own device in the table shown in FIG. 2 and usable for the subordinate terminal devices 305 and 306 in response to a request from the terminal devices 305 and 306. Perform the assignment process.
[0015]
The VPN connection device 3a performs a process for connecting to the VPN main connection device 5 and a VPN main connection device 31a in response to a request from the terminal devices 301 and 302 under the VPN connection device 3a. 5, a DHCP server unit 32a that performs a process of allocating an IP address from a group of IP addresses that can be used for a terminal device under the device, and access to the VPN from the terminal devices 301 and 302 under the VPN connection device 3a. And an address management unit 34a that manages address information related to the VPN connection device 3a. Details of the processing will be described based on the processing flow.
[0016]
The VPN connection device 3b has the same configuration as that of the VPN connection device 3a, except that the symbols are replaced by a to b, and that the subordinate terminal devices are the terminal devices 303 and 304 and the like.
[0017]
Next, processing of the system shown in FIG. 1 will be described with reference to FIGS. The VPN connection device will be described using the VPN connection device 3a located at the base B. In addition, a terminal device will be described using the terminal device 301. Note that the processing contents are the same for the base C.
[0018]
First, the administrator registers at least a user ID and password, and in some cases, a VPN device IP address, a network address, and a subnet mask for each site in the address management unit 52 of the VPN main connection device 5 at the site A. (Step S1). The address management unit 52 holds, for example, a table as shown in FIG. 2 in a storage area. Note that at least the IP address, network address, and subnet mask of the VPN main connection device 5 itself are registered. In addition, the administrator sets the user ID and password of the own device and the IP address of the VPN main connection device 5 to be connected to the remote VPN connection unit 31a of the VPN connection device 3a at the base B (step). S3). In this embodiment, when the VPN connection device 3a is started, the terminal device 301 tries to connect to the VPN connection device 3a before connecting to the VPN main connection device 5.
[0019]
Therefore, the terminal device 301 broadcasts a DHCP_DISCOVER message to the network in the base B (step S5). Upon receiving the DHCP_DISCOVER, the DHCP server unit 32a of the VPN connection apparatus 3a transmits a DHCP_OFFER message including an unused IP address among the group of IP addresses that can be allocated at that time to the terminal apparatus 301 of the transmission source (or Broadcast) (step S7). Upon receiving the DHCP_OFFER message from the VPN connection device 3a, the terminal device 301 holds data such as the presented IP address and transmits a DHCP_REQUEST message requesting the assignment of the IP address and the like to the VPN connection device 3a (step). S9). Upon receiving the DHCP_REQUEST message from the terminal device 301, the DHCP server unit 32a of the VPN connection device 3a registers the assignment of the IP address and the like to the terminal device 301 in the DHCP table (step S11). Then, a DHCP_ACK message is transmitted to the terminal device 301 (step S13). When the terminal device 301 receives the DHCP_ACK message from the VPN connection device 3a, the terminal device 301 completes the assignment of the IP address, so that it can communicate with the network in the base B.
[0020]
By performing such processing, data as shown in FIG. 4A is held in the storage device inside the VPN connection device 3a. In the example of FIG. 4A, the table 401 includes the initial IP address (192.168.1.1) and the subnet mask (255.255.255.0) of the VPN connection apparatus 3a itself, and the table 402 includes The IP address range (192.168.1.2 to 192.168.1.254) to be allocated to the terminal device under the control and the lease period (30 seconds) of the allocated IP address are registered. This part is based on, for example, initial settings of the VPN connection device 3a. Therefore, when the terminal devices 301 and 302 request the assignment of the IP address, the process described above is performed and the pair of the assigned IP address and the MAC address is registered in the table 403. For example, it can be seen that the IP address 192.168.1.2 is assigned to the terminal device having the MAC address 00: 90: 99: 7d: 4c: xx. As shown in the table 402, the lease period is set to a shorter time than usual, for example, 30 seconds, and when an IP address group is assigned from the VPN main connection device 5, the IP address is immediately set. Switching is completed.
[0021]
Then, at an arbitrary timing, the remote VPN connection unit 31a of the VPN connection device 3a transmits a VPN connection request including authentication information (user ID and password) to the VPN main connection device 5 via the Internet 1 (Step S15). . Upon receiving the VPN connection request (step S17), the authentication processing unit 51 of the VPN main connection device 5 performs an authentication process using the authentication information included in the connection request (step S19). Specifically, the table shown in FIG. 2 is searched for the user ID included in the received authentication information, and the password corresponding to the user ID is extracted. Then, the password included in the received authentication information is compared with the extracted password to determine whether they match. If they match, the authentication is successful. If they do not match, the authentication has failed and no further processing is performed.
[0022]
If the authentication is successful, the address management unit 52 reads the IP address or the like for the VPN connection device 3a previously assigned to the user ID from the table shown in FIG. (Step S21). When newly assigned, it is registered in the table of FIG. Then, the address management unit 52 notifies the VPN connection device 3a of the IP address and the like assigned to the VPN connection device 3a (Step S23). The address management unit 34a of the VPN connection device 3a receives a notification such as an IP address from the VPN main connection device 5 (step S25), and sets and registers the received IP address as its own IP address in the storage device (step S27). For example, as shown in a table 411 in FIG. 4B, in addition to the IP address (192.168.1.1) of the VPN connection apparatus 3a originally set originally, a newly notified IP address is used. (192.168.1.11) is additionally registered. By additionally registering in this way, it is possible to operate as a device of the newly notified IP address in the VPN and to operate as a device of the initially set IP address for the network in the base. Become like Here, the subnet mask is additionally registered.
[0023]
Further, the address management unit 52 of the VPN main connection device 5 reads a network address (a group of usable IP addresses) assigned in advance corresponding to the user ID from the table shown in FIG. A network address is assigned based on the IP address etc. assigned to the VPN connection device 3a (step S29). When newly assigned, it is registered in the table shown in FIG. Then, data such as the network address is transmitted to the VPN connection device 3a (step S31). When receiving the network address and the like from the VPN main connection device 5 (step S33), the address management unit 34a of the VPN connection device 3a updates the DHCP table by registering it in the table 412 of FIG. 4B (step S35). ). For example, when data of a network address representing an IP address group (192.168.1.12 to 192.168.1.1254) is received from the VPN main connection device 5, as shown in a table 412 of FIG. 192.168.1.12 and 192.168.11.254 are registered as IP addresses to be assigned to the terminal devices under the control. In the present embodiment, the address management unit 34a also extends the IP address lease period. As shown in a table 412 in FIG. 4B, 30 seconds is extended to, for example, 3 hours. Thus, after switching of the IP address, processing such as extension of the normal lease period is performed.
[0024]
As described above, when the assignment of the IP address group usable to the subordinate terminal device is received from the VPN main connection device 5, the VPN connection device 3a thereafter sets the lease period of the old IP address already assigned to the subordinate terminal device. The IP addresses are switched by sequentially disallowing the extension and assigning one IP address among those assigned from the VPN main connection device 5 as usable IP addresses.
[0025]
A first example of the processing flow of the IP address switching processing will be described with reference to FIG. The terminal device 301 (here, terminal A) to which any of the IP addresses notified as a group of usable IP addresses from the VPN main connection device 5 has not been assigned yet, before the lease period of the assigned IP address expires. Then, a DHCP_REQUEST message for requesting extension of the lease period is transmitted to the VPN connection device 3a (step S41). Upon receiving the DHCP_REQUEST message from the terminal device 301, the DHCP server unit 32a of the VPN connection device 3a checks the IP address group (FIG. 4B table 412) for assigning the source IP address of the DHCP_REQUEST message to the subordinate terminal device. It is determined whether it is included in the range, and if it is not included, the IP address must be switched, so a DHCP_NAK message is returned (step S43). Since the terminal device 301 has to be newly assigned an IP address, the terminal device 301 transmits a DHCP_REQUEST message for requesting the assignment to the VPN connection device 3a (step S45). Upon receiving the DHCP_REQUEST message requesting the assignment of an IP address, the DHCP server unit 32a of the VPN connection device 3a extracts one IP address from the assignable IP addresses and assigns it to the terminal device 301 (step S47). Then, the DHCP table (here, the table 413 in FIG. 4B) is updated. In the table 413 of FIG. 4B, a new IP address designated as the IP address for allocation in the table 412 corresponding to the MAC address 00: 90: 99: 7d: 4c: xx on the first line. 192.168.1.12 has been assigned from the group. This means that the IP address for the first line in the table 403 in FIG. 4A has been switched from 192.168.1.2. Note that the IP addresses of the other terminal devices have not been switched yet.
[0026]
Then, the VPN connection device 3a transmits a DHCP_ACK message to the terminal device 301 (Step S48). The terminal device 301 receives the DHCP_ACK message from the VPN connection device 3a, and can communicate with the new IP address via the VPN.
[0027]
At this stage, the switching of all the IP addresses has not been completed, so, for example, when the terminal device 302 (terminal B) tries to transmit some data to the IP address of another base (step S49), the VPN device 3a The access management unit 33a blocks this access (step S51). This is because, unless the terminal device before the address change does not block access to another site, data may be transmitted to another device during the address change. If the initial lease period is shortened, address switching should be completed promptly, the number of blocked accesses can be reduced, and the period of hindering communication will be short and in such cases Is also reduced.
[0028]
With reference to FIG. 6, a second example of the processing flow of the IP address switching processing will be described. The terminal device 301 (here, terminal A) to which any of the IP addresses notified as a group of usable IP addresses from the VPN main connection device 5 has not been assigned yet, before the lease period of the assigned IP address expires. Then, a DHCP_REQUEST message for requesting extension of the lease period is transmitted to the VPN connection device 3a (step S61). Upon receiving the DHCP_REQUEST message from the terminal device 301, the DHCP server unit 32a of the VPN connection device 3a checks the IP address group (FIG. 4B table 412) for assigning the source IP address of the DHCP_REQUEST message to the subordinate terminal device. Judge whether it is included in the range, and do not respond if it is not included. If there is no response, the terminal device 301 repeats step S61. However, since no response can be obtained, the lease period elapses.
[0029]
Then, the terminal device 301 broadcasts a DHCP_DISCOVER message to the network in the base B in order to acquire an IP address from the beginning (step S63). Upon receiving the DHCP_DISCOVER, the DHCP server unit 32a of the VPN connection device 3a transmits a DHCP_OFFER message including an unused IP address among the group of IP addresses that can be assigned at that time to the terminal device 301 of the transmission source (step S65). Upon receiving the DHCP_OFFER message from the VPN connection device 3a, the terminal device 301 retains data such as the presented IP address and transmits a DHCP_REQUEST message requesting assignment of the IP address and the like to the VPN connection device 3a (or Broadcast) (step S67). Upon receiving the DHCP_REQUEST message from the terminal device 301, the DHCP server unit 32a of the VPN connection device 3a registers the assignment of the IP address and the like to the terminal device 301 in the DHCP table (step S68). In the table 413 of FIG. 4B, a new IP address designated as the IP address for allocation in the table 412 corresponding to the MAC address 00: 90: 99: 7d: 4c: xx on the first line. 192.168.1.12 has been assigned from the group. Then, a DHCP_ACK message is transmitted to the terminal device 301 (step S69). Upon receiving the DHCP_ACK message from the VPN connection device 3a, the terminal device 301 can perform communication via the VPN.
[0030]
At this stage, since switching of all IP addresses has not been completed, for example, when the terminal device 302 (terminal B) attempts to transmit some data to the IP address of another base (step S71), the VPN device 3a The access management unit 33a blocks this access (step S73). This is because, unless the terminal device before the address change does not block access to another site, data may be transmitted to another device during the address change. If the initial lease period is shortened, address switching should be completed promptly, the number of blocked accesses can be reduced, and the period that hinders communication is short and in such cases Is also reduced.
[0031]
By repeating such processing, the VPN main connection device 5 can send all the terminal devices to which the IP address has been uniquely assigned before receiving the assignment of the usable IP address to the subordinate terminal device from the VPN main connection device 5. When the designated IP address is assigned, the IP address (192.168.1.1) and the subnet mask (255) of the VPN terminal device 3a initially used as shown in the table 421 (FIG. 4C). .255.255.0) becomes unnecessary and may be discarded. The table 422 is not changed. The table 423 indicates that the IP addresses in the allocation IP addresses defined in the table 422 are allocated to all the MAC addresses.
[0032]
By using the VPN connection device and the VPN main connection device that perform the operations described above, the administrator does not need to statically set the IP address over a plurality of bases, and furthermore, the VPN connection device and the VPN main connection. This is very convenient because the IP address can be automatically set without duplication of the IP address just by connecting the device.
[0033]
One embodiment of the present invention described above is only one embodiment, and the present invention is not limited to the present embodiment. The operation of the VPN main connection device 5 and the VPN connection device 3a or 3b may be switched by mode switching in one VPN connection device. Also, the functional block diagram shown in FIG. 1 is an example, and other functional divisions may be followed.
[0034]
In addition, the description of the exchange of the DHCP message is partially omitted, and only the matters necessary for understanding the embodiment of the present invention are described.
[0035]
Further, an example in which steps S23 and S31 are performed separately has been described, but the notification may be performed simultaneously.
[0036]
【The invention's effect】
Address duplication in the VPN can be avoided and the burden on the administrator can be reduced.
[Brief description of the drawings]
FIG. 1 is a system schematic diagram according to an embodiment of the present invention.
FIG. 2 is an example of data in a table managed in the VPN main connection device.
FIG. 3 is a flowchart illustrating processing in a VPN main connection device and a VPN connection device.
FIGS. 4A to 4C are diagrams illustrating transition examples of data of a table managed in the VPN connection device;
FIG. 5 is a diagram showing a flow (first example) of IP address switching in the VPN connection device.
FIG. 6 is a diagram illustrating a flow (second example) of IP address switching in the VPN connection device.
[Explanation of symbols]
1 Internet 3a, 3b VPN connection device 5 VPN main connection device 31a, 31b Remote VPN connection unit 32a, 32b DHCP server unit 33a, 33b Access management unit 34a, 34b Address management unit 51 Authentication processing unit 52 Address management unit 53 DHCP server unit

Claims (8)

A connection device for forming a virtual private network by connecting to a main connection device,
Address acquisition means for connecting to the main connection device and receiving, from the main connection device, an IP address of the connection device and an assignment of an IP address usable in a device under the connection device;
If an IP address has already been assigned to a device under the connection device, the extension of the lease period is not permitted even if a request to extend the lease period of the IP address is received from the device under the connection, and the IP address is assigned from the main connection device. Means for assigning a new IP address from the available IP addresses to the subordinate devices
A connection device having: When an IP address has already been assigned to a device under the connection device, and the address acquisition unit has been assigned an IP address that can be used in a device under the connection device from the main connection device. 2. The connection device according to claim 1, further comprising means for blocking communication to the virtual private network, the transmission source being an IP address other than the usable IP address assigned from the main connection device. The connection device according to claim 1, further comprising a unit that connects to the main connection device using an IP address of the main connection device and authentication information of the connection device. A connection device for forming a virtual private network by connecting to a lower connection device,
Means for performing an authentication process in response to a connection request from the lower connection device,
Means for allocating an IP address of the lower-level connection device and an IP address that can be used by a device under the lower-level connection device when the authentication processing is successful, and storing the IP address in a storage device;
Means for transmitting, to the lower-level connection device, data of the IP address of the lower-level connection device stored in the storage device and data of an IP address usable by a device under the lower-level connection device;
A connection device having: A connection device for forming a virtual private network by connecting to a lower connection device,
Storage means for storing an IP address of the lower-level connection device and an IP address usable by a device under the lower-level connection device corresponding to the connectable lower-level connection device;
Means for performing an authentication process in response to a connection request from the lower connection device,
Means for transmitting, to the lower-level connection device, data of the IP address of the lower-level connection device stored in the storage unit and data of an IP address that can be used by a device under the lower-level connection device, if the authentication process is successful; A connection device having: A program executed by a connection device for forming a virtual private network by connecting to a main connection device,
Connecting to the main connection device, receiving from the main connection device an IP address of the connection device and an assignment of an IP address usable in a device under the connection device;
If an IP address has already been assigned to a device under the connection device, the extension of the lease period is not permitted even if a request to extend the lease period of the IP address is received from the device under the connection, and the IP address is assigned from the main connection device. Assigning a new IP address to the subordinate device from the received available IP addresses;
For causing the connection device to execute. A program executed on a connection device for forming a virtual private network by connecting to a lower connection device,
Performing an authentication process in response to a connection request from the lower connection device;
If the authentication process is successful, assigning an IP address of the lower connection device and an IP address usable by a device under the lower connection device, and storing the IP address in a storage device;
Transmitting the IP address of the lower-level connection device stored in the storage device and data of an IP address usable by a device under the lower-level connection device to the lower-level connection device;
For causing the connection device to execute. A program to be executed by a connection device for forming a virtual private network by connecting to a lower connection device,
Performing an authentication process in response to a connection request from the lower connection device;
When the authentication process is successful, the IP address of the lower-level connection device corresponding to the lower-level connection device that can be connected and the IP address that can be used by a device under the lower-level connection device are stored in the storage unit. Transmitting, to the lower-level connection device, data of the IP address of the lower-level connection device and an IP address that can be used by a device under the lower-level connection device to the lower-level connection device.

Images