JP2005012424A - Management device and communication system - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To reduce burden of maintenance on a user by eliminating the necessity of authentication by a domestic terminal or a home server etc., and to reinforce security by collectively performing the authentication by a management device, and performing management. <P>SOLUTION: In this communication system, an intra-network system 1 as a management device decides the access propriety by a terminal in response to an authentication request from a domestic connecting terminal 2 or an external connecting terminal 4. If the access should be permitted, a virtual logical path is established to the terminal 2 and a virtual logical path is further established to the terminal 4, thereby enabling layer-2 communication between the terminal 2 and the terminal 4, or enabling layer-3 communication formed by one sub-network. <P>COPYRIGHT: (C)2005,JPO&NCIPI

Description

[0001]
BACKGROUND OF THE INVENTION
The present invention relates to a management apparatus and a communication system that perform authentication instead of, for example, a home terminal or a home server.
[0002]
[Prior art]
Conventionally, the Internet has been used for collecting information, but due to the constant connection of DSL or the like, attention is being focused on connection to personal computers in the home, and further to home appliances. At present, in order to realize such a request, it is necessary to permit access to the home network by installing a gateway device such as a home server in the home and performing authentication by the gateway device.
[0003]
Here, for example, Non-Patent Document 1 discloses a technique related to the construction of a VPN using PPTP. Using this technology makes it possible to safely access the home, but this realization requires advanced expertise and daily maintenance by end users.
[0004]
[Non-Patent Document 1]
UNIX USER 2003/6 "First Feature Our Tunnel Builder"
[0005]
[Problems to be solved by the invention]
However, in a form in which authentication is performed by a home terminal, a home server, or the like, it is necessary to set an authentication application on each terminal. In other words, not only is it necessary to have expensive equipment and technical expertise to handle it, but it is also necessary for the user to perform ongoing maintenance such as upgrading to the latest version of the authentication application and updating the hardware in a short period of time. There is.
[0006]
The present invention has been made in view of the above problems, and the object of the present invention is to eliminate the need for authentication at a home terminal, a home server, etc., reduce the maintenance burden on the user, and perform authentication with a management device. The goal is to strengthen security through integrated implementation and management.
[0007]
[Means for Solving the Problems]
In order to achieve the above object, as an invention according to claim 1, an authentication means for determining whether or not an access to these terminals is possible based on authentication requests from the first access terminal and the second access terminal, and the authentication means If the access by the first access terminal is permitted as a result of the determination by the first access terminal, a first virtual logical path setting means for constructing a first virtual logical path with the first access terminal, If access by the second access terminal is permitted as a result of the determination by the authentication means, second virtual logical path 2 setting means for constructing a second virtual logical path with the second access terminal. And a management device having the first access terminal and the second access terminal to enable layer 2 communication or layer 3 communication configured by one subnet. The communication system characterized is provided.
[0008]
As a second aspect of the present invention, the first access terminal has a function of bridge-connecting a physical path between the third terminal and the first virtual logical path between the management devices. The function further enables layer 2 communication or layer 3 communication configured by one subnet between the third terminal and the second access terminal. Is provided.
[0009]
Furthermore, the invention according to claim 3 is characterized in that encrypted data is communicated in at least part of the layer 2 communication or the layer 3 communication configured by one subnet. A communication system according to any of the above is provided.
[0010]
The invention according to claim 4 is further characterized in that the physical path between the third terminal and the first access terminal is always connected. A communication system is provided.
[0011]
The invention according to claim 5 is characterized in that the first virtual logical path is always connected as long as the power of the first access terminal is on. Is provided.
[0012]
Furthermore, as an invention according to claim 6, based on authentication requests from the first access terminal and the second access terminal, authentication means for determining whether or not these terminals can be accessed, and a result of determination by the authentication means, When both access by a 1st access terminal and a 2nd access terminal is permitted, it instruct | indicates to construct | assemble a virtual logical path between the said 1st access terminal and the said 2nd access terminal Enabling a layer 2 communication or a layer 3 communication configured by one subnet between the first access terminal and the second access terminal by a management device having a virtual logical path setting instruction unit; A communication system is provided.
[0013]
As a seventh aspect of the present invention, the first access terminal has a function of bridge-connecting a physical path between the third terminal and a virtual logical path between the second access terminal. The function further enables layer 3 communication between the third terminal and the second access terminal or layer 3 communication configured by one subnet. A communication system according to item 6 is provided.
[0014]
The invention according to claim 8 is characterized in that encrypted data is communicated in at least a part of the layer 2 communication or the layer 3 communication configured by one subnet. A communication system according to any of the above is provided.
[0015]
The invention according to claim 9 is characterized in that the physical path between the third terminal and the first access terminal is always connected. A communication system is provided.
[0016]
In addition, as a tenth aspect of the present invention, there is provided the communication system according to any one of the first to ninth aspects, wherein the layer 2 communication means Ethernet or fast Ethernet.
[0017]
As an invention according to claim 11, based on authentication requests from the first access terminal and the second access terminal, an authentication means for determining whether or not these terminals can be accessed, and a result of the determination by the authentication means, the first When the access by the access terminal is permitted, a virtual logical path setting means for constructing a virtual logical path with the first access terminal, and the first access terminal and the second access terminal And a proxy unit that relays data using a proxy function in data communication between the first access terminal and the second access terminal, and enables data communication between the first access terminal and the second access terminal. A communication system is provided.
[0018]
The invention according to claim 12 includes a plurality of terminals of the same type as the first access terminal, wherein the proxy means includes an identifier determination function for determining an identifier assigned to a virtual logical path, and the second The communication system according to claim 11, further comprising a virtual logical path selection function for recognizing an identifier based on URL information added to data from an access terminal and selecting a virtual logical path.
[0019]
Further, as an invention according to claim 13, the first access terminal has a function of bridge-connecting a physical path between the third terminal and a virtual logical path between the management devices, 12. The communication system according to claim 11, further comprising data communication between the third terminal and the second access terminal by the function.
[0020]
According to a fourteenth aspect of the present invention, there are provided a plurality of terminals of the same type as the first access terminal, and the proxy means includes an identifier determination function for determining an identifier assigned to a virtual logical path, and the first A virtual logical path selection function for recognizing an identifier based on URL information added to data from the second access terminal and selecting a virtual logical path, and the URL information added to data from the second access terminal. The communication system according to claim 13, further comprising a third terminal selection function for selecting a third terminal.
[0021]
Further, as an invention according to claim 15, data communication between the first access terminal and the management apparatus, or between the third terminal and the management apparatus is configured by layer 2 communication or one subnet. 15. The communication system according to claim 11, further comprising layer 3 communication.
[0022]
According to a sixteenth aspect of the present invention, on the basis of authentication requests from the first access terminal and the second access terminal, an authentication unit that determines whether or not these terminals can be accessed, and a result of the determination by the authentication unit, When permitting access by the first access terminal, the first virtual logical path setting means for constructing the first virtual logical path with the first access terminal and the result of determination by the authentication means And, when permitting access by the second access terminal, has a second virtual logical path 2 setting means for constructing a second virtual logical path with the second access terminal, At least a part of data communication enables layer 2 communication or layer 3 communication constituted by one subnet between the first access terminal and the second access terminal. That management apparatus is provided.
[0023]
As an invention according to claim 17, on the basis of authentication requests from the first access terminal and the second access terminal, authentication means for determining whether or not these terminals can be accessed, and as a result of determination by the authentication means, the first A virtual logic that instructs to establish a virtual logical path between the first access terminal and the second access terminal when both access by the access terminal and the second access terminal are permitted. Path setting instruction means, and at least a part of the data communication is capable of layer 2 communication or layer 3 communication composed of one subnet between the first access terminal and the second access terminal. A management device characterized by the above is provided.
[0024]
Furthermore, as an invention according to claim 18, based on authentication requests from the first access terminal and the second access terminal, an authentication unit that determines whether or not these terminals can be accessed, and a result of the determination by the authentication unit, When permitting access by the first access terminal, virtual logical path setting means for establishing a virtual logical path with the first access terminal, the first access terminal, and the second access terminal Proxy means for relaying data by a proxy function in data communication between the first access terminal and the second access terminal, wherein at least a part of the data communication is performed between the first access terminal and the second access terminal. There is provided a management device characterized in that it enables.
[0025]
According to a nineteenth aspect of the present invention, in the case where communication is possible with a plurality of terminals of the same type as the first access terminal, the proxy means has an identifier determination function for determining an identifier assigned to the virtual logical path; 19. The management according to claim 18, further comprising a virtual logical path selection function for recognizing an identifier based on URL information added to data from the second access terminal and selecting a virtual logical path. An apparatus is provided.
[0026]
As an invention according to claim 20, in the case where communication is possible with a plurality of terminals of the same type as the first access terminal, the proxy means includes an identifier determination function for determining an identifier assigned to the virtual logical path; A virtual logical path selection function for recognizing an identifier based on URL information added to data from the second access terminal and selecting a virtual logical path; and URL information added to data from the second access terminal The management apparatus according to claim 18, further comprising a third terminal selection function for selecting the third terminal based on the first terminal.
[0027]
Furthermore, in the invention according to claim 21, data communication between the first access terminal and the management apparatus or between the third terminal and the management apparatus is configured by layer 2 communication or one subnet. 21. The management device according to claim 18, further comprising layer 3 communication.
[0028]
Further, as a twenty-second aspect of the present invention, there is provided the management device according to any one of the sixteenth to twenty-first aspects, wherein the layer 2 communication means Ethernet or fast Ethernet.
[0029]
The invention according to claim 23 is further characterized in that encrypted data is communicated in at least a part of the layer 2 communication or the layer 3 communication configured by one subnet. A management device according to any of the above is provided.
[0030]
DETAILED DESCRIPTION OF THE INVENTION
Embodiments of the present invention will be described below with reference to the drawings.
[0031]
(First embodiment)
FIG. 1 shows and describes the configuration of a management apparatus according to a first embodiment of the present invention and a communication system using the management apparatus. As shown in FIG. 1, an in-network system 1, a home connection terminal 2, and an external connection terminal 4 as management devices are connected via a layer 3 network 5 so as to be communicable. The in-home connection terminal 2 is further connected to the in-home terminal 3 through a layer 2 segment 6 so as to be communicable. As the home connection terminal 2, for example, a gateway device can be employed. However, the home connection terminal 2 may not include an authentication server. Further, the physical path between the home terminal 3 and the home connection terminal 2 may be always connected.
[0032]
Detailed configurations of the terminals 2 to 4 and the in-network system 1 will be described later.
[0033]
In such a configuration, when authentication requests are sequentially made from the in-home connection terminal 2 or the external connection terminal 4, the in-network system 1 receives the request and determines whether the in-home connection terminal 2 or the external connection terminal 4 is accessible. To do. Then, when permitting access, the in-network system 1 constructs a virtual logical path between the in-home connection terminal 2 and the external connection terminal 4, respectively. Thereby, the layer 2 communication between the in-home connection terminal 2 and the external connection terminal 4 or the layer 3 communication configured by one subnet is enabled.
[0034]
Hereinafter, with reference to the flowchart of FIG. 2, the flow of the layer 2 communication among the in-home connection terminal 2, the in-network system 1, and the external connection terminal 4 in the communication system according to the first embodiment of the present invention will be described in detail. explain.
[0035]
When the in-home connection terminal 2 is turned on (step S1) and an authentication request is made to the in-network system 1 (step S2), the in-network system 1 receives the authentication request and determines whether or not the in-home connection terminal 2 can access. If it is determined and access is permitted, a message to that effect is returned to the home connection terminal 2 (step S3). Thus, information relating to the virtual path is exchanged between the in-home connection terminal 2 and the in-network system 1 (step S4), the virtual path is set in both (steps S5 and S6), and the in-home connection terminal 2 and the in-network system are set. A virtual logical path (virtual layer 2 (<1>)) is established with the first.
[0036]
This completes the communication process related to advance preparation.
[0037]
After the above preparation, when the access button is clicked on the external connection terminal 4 (step S7) and an authentication request is made to the in-network system 1 (step S8), the in-network system 1 receives the authentication request. Then, it is determined whether or not access by the external connection terminal 4 is possible, and when the access is permitted, the fact is returned to the external connection terminal 4 (step S9). In this way, information relating to the virtual path is exchanged between the external connection terminal 4 and the in-network system 1 (step S10), and the virtual path is set in both (steps S11 and S12). A virtual logical path (virtual layer 2 ({circle around (2))}) is established with 1.
[0038]
Next, the in-network system 1 performs bridge setting (step S13), and constructs a virtual logical path (virtual layer 2 ((1) + (2))) between the in-home connection terminal 2 and the external connection terminal 4. . This completes the communication process for external connection.
[0039]
Here, the “authentication”, “information exchange regarding virtual path”, and “virtual path setting” will be described in more detail with reference to the flowchart of FIG.
[0040]
The following description is also common to preparation procedures for authentication and packet transmission when constructing a virtual logical path for layer 3 communication configured with layer 2 or one subnet in other embodiments. Yes.
[0041]
In “authentication” by the in-home connection terminal 2 (step S20), the in-home connection terminal 2 transmits a user ID and a password to the in-network system 1 (step S20a). When receiving the user ID and password, the in-network system 1 refers to the user management DB, performs user authentication (step S20b), and permits access by the in-home connection terminal 2 to the in-home connection terminal 2 to that effect. Is returned (step S20c).
[0042]
Further, in the “information exchange regarding virtual path” between the in-home connection terminal 2 and the in-network system 1 (step S21), the in-home connection terminal 2 receives the information related to the IP address (165.0.2. 1) etc. are transmitted to the in-network system 1 (step S21a). Upon receiving the information related to the IP address, the in-network system 1 adds the IP address of the home connection terminal 2 to the VPN-related table (step S21b).
[0043]
Thereafter, the in-network system 1 recognizes, from 165.0.2.1, for example, that the EtherIP packet for user_b is transmitted from the table regarding VPN.
[0044]
Next, the in-network system 1 transmits information related to the IP address of the system itself (169.100.0.1 in this example) to the home connection terminal 2 (step S21d).
[0045]
However, information regarding this IP address is not always necessary, and it is needless to say that only security information may be exchanged.
[0046]
When encryption processing is included, encryption information exchange is included in “information exchange regarding virtual path”. The information to be exchanged is not limited to the above, but includes, for example, the collection of protocol information (encapsulated data handling conditions, private IP address assignment, encryption information, etc.).
[0047]
In this way, when the home connection terminal 2 receives the information related to the IP address of the in-network system 1, it performs “virtual path setting”, and after this setting, the local network data is encapsulated by, for example, EtherIP, It is recognized that it is transmitted to one IP address (step S22).
[0048]
As described above, in the first embodiment of the present invention, since the access directions by the in-home connection terminal 2 and the external connection terminal 4 are all directed to the in-network system 1, the in-home connection terminal 2 needs to have a server function. There is no. More specifically, in the communication according to the prior art, the in-home connection terminal 2 is a server and accepts access from the outside, but according to the first embodiment, the in-home connection terminal is a client for the in-network system. Therefore, it is not necessary to manage security holes, etc., reducing the maintenance burden and enhancing security. In the first embodiment, the external connection terminal 4 and the home connection terminal 2 are in the same segment.
[0049]
(Second Embodiment)
The communication system according to the second embodiment is characterized in that the external connection terminal 4 and the home terminal 3 become the same segment by performing bridge setting in the home connection terminal 2. That is, the in-home connection terminal 2 has a function of bridging a physical path between the in-home terminal 3 and a virtual logical path between the in-network system 1 and between the in-home terminal 3 and the external connection terminal 4. Thus, it is possible to perform layer 2 communication or layer 3 communication composed of one subnet.
[0050]
Further, in the communication system according to the second embodiment, encrypted data can be communicated in at least a part of the layer 2 communication or the layer 3 communication configured by one subnet.
[0051]
Since the system configuration is the same as that in FIG. 1, the same reference numerals are used for the same configurations, and redundant descriptions are omitted.
[0052]
Hereinafter, referring to the flowchart of FIG. 4, the layer 2 communication between the home terminal 3, the home connection terminal 2, the network system 1, and the external connection terminal 4 in the communication system according to the second embodiment of the present invention. The flow will be described in detail.
[0053]
In this example, it is assumed that a physical path (layer 2 (<3>)) is established between the in-home terminal 3 and the in-home connection terminal 2 so that communication is possible.
[0054]
When the power of the home connection terminal 2 is turned on (step S30) and an authentication request is made to the in-network system 1 (step S31), the in-network system 1 receives the authentication request and the access by the home connection terminal 2 is performed. Judgment is made. If access is permitted, a message to that effect is returned to the home connection terminal 2 (step S32).
[0055]
Thus, information relating to the virtual path is exchanged between the in-home connection terminal 2 and the in-network system 1 (step S33), the virtual path is set in both (steps S34 and S35), and the in-home connection terminal 2 and the in-network system are set. A virtual logical path (virtual layer 2 (<1>)) is established with the first. The in-home connection terminal 2 performs bridge setting (step S36), and constructs a virtual logical path (virtual layer 2 ((1) + (3))) between the in-home connection terminal 2 and the in-home terminal 3. This completes the communication process related to advance preparation.
[0056]
After the above preparation, when the access button is clicked on the external connection terminal 4 (step S37) and an authentication request is made to the in-network system 1 (step S38), the in-network system 1 receives the authentication request, It is determined whether or not access by the external connection terminal 4 is possible, and when access is permitted, the fact is returned to the external connection terminal 4 (step S39). Information regarding the virtual path is exchanged between the external connection terminal 4 and the in-network system 1 (step S40), and the virtual path is set in both (steps S41 and S42), thus the external connection terminal 4 and the in-network system 1 A virtual logical path (virtual layer 2 (<2>)) is constructed between
[0057]
Next, the in-network system 1 performs bridge setting (step S43), and a virtual logical path (virtual layer 2 (1) +2) +3) between the home terminal 3 and the external connection terminal 4 Build up. This completes the communication process for external connection.
[0058]
Here, in FIG. 5, each configuration of the in-network system 1, the in-home connection terminal 2, and the external connection terminal 4 configuring the communication system according to the second embodiment is shown and described in detail.
[0059]
The following description is also common to authentication and packet transmission procedures when constructing a virtual logical path for layer 3 communication configured by layer 2 or one subnet in other embodiments.
[0060]
As shown in FIG. 5, the in-network system 1 includes an authentication function (server) and a packet distribution function. Each of the in-home connection terminal 2 and the external connection terminal 4 has an authentication function (client) and an access conversion processing function. In FIG. 5, the flow of data related to authentication is indicated by a thick line arrow, and the flow of data transmission / reception is indicated by a thin line arrow.
[0061]
Authentication includes authentication from the home connection terminal 2 to the in-network system 1 and authentication from the external connection terminal 4 to the in-network system 1. Data transmitted from the authentication client unit 21 of the in-home connection terminal 2 is transmitted from the external interface 22 and transmitted to the in-network system 1 via the layer 3 network 5.
[0062]
When authentication is performed by the authentication function in the in-network system 1, information on the virtual logical path between the in-home connection terminal 2 and the in-network system 1 is registered in the VPN-related table 13 in the packet distribution function. In this table 13, the IP address of the source destination for encapsulation is registered.
[0063]
That is, in the authentication function of the intra-network system 1, authentication is performed with reference to the user DB 11 by the PKI authentication confirmation and IPsec / VPN registration function 12, and information related to the virtual logical path is registered in the table 13 related to VPN.
[0064]
The security policy and security association are registered in SAD (Security Policy Database), SPD (Security Association Database) (hereinafter collectively referred to as IPsec database) 14. A security policy refers to processing setting information for an IP packet, and a security association refers to information related to an IPsec connection. The database 14 stores information for encryption / decryption.
[0065]
The behavior in the external connection terminal 4 is the same as above.
[0066]
On the other hand, the data is sent to the EtherIP encapsulation unit 44 through the virtual interface 43 under the control of the OS 42, encapsulated by the EtherIP encapsulation unit 44, and then encrypted by the IPsec encryption unit 45. And sent out via the interface 46. The packet transmitted from the external connection terminal 4 is transmitted to the in-network system 1 via the interface 46 and received via the interface 18.
[0067]
This packet is decrypted by the IPsec encryption / decryption unit 17, decapsulated by the EtherIP capsule / decapsulation unit 16, and the destination is sent while the bridge transfer unit 15 refers to the VPN table 13. It is determined. The data is encapsulated by the EtherIP capsule / decapsulator 16, encrypted by the IPsec encryption / decryption unit 17, and transmitted to the in-home connection terminal 2 via the interface 18 and the layer 3 network 5.
[0068]
In the in-home connection terminal 2, the packet is received via the external interface 22, decrypted by the IPsec decryption unit 24, decapsulated by the EtherIP decapsulation unit 25, and then received by the bridge delivery unit 26. And transmitted to the home terminal 3 via the home interface 27.
[0069]
The transmission process from the home connection terminal 2 to the external connection terminal 4 shows the reverse behavior.
[0070]
In the system excluding encryption, the IPsec encryption unit 45, the IPsec decryption unit 24, the IPsec encryption / decryption unit 17, and the SAD, SPD (IPsec database) 14 are excluded from the above configuration. In the above example, IPsec, which is a protocol for providing a TCP / IP IP with a security function, is used. However, the present invention is not limited to this.
[0071]
Here, a specific packet transfer will be described in detail with reference to FIG.
[0072]
In FIG. 6, the numerical value described below each terminal or system indicates the address of each terminal or system. More specifically, the upper row shows a VPN address (private IP), the middle row shows an address on the Internet (global IP), and the lower row shows a physical (MAC) address (on VPN).
[0073]
In this example, EtherIP is used for the tunneling method. The Ethernet protocol is generally used for tunneling two different Ethernet segments over IP, and an IP packet for tunneling includes an Ethernet or IEEE 802.3 frame to be transmitted.
[0074]
The packet transmitted from the external connection terminal 4 reaches the in-network system 1 based on the transmission destination address (210.169.143.148) of the IP packet header. Further, the packet transmitted from the in-network system 1 reaches the in-home connection terminal 2 based on the transmission destination address (143.90.135.123) of the IP packet header. In the home connection terminal 2, for example, Fast Ethernet is defined in the physical layer of the packet. The packet transmitted from the home connection terminal 2 reaches the home terminal 3 based on the transmission destination address (01 23 45 67 89 AB) of the Ether frame header.
[0075]
As described above, even in the communication system according to the second embodiment of the present invention, since the access directions by the in-home connection terminal 2 and the external connection terminal 4 are all directed to the in-network system 1, the in-home connection terminal 2 is the server. It is not necessary to have a function. Furthermore, in the second embodiment, by realizing a bridge in the home connection terminal 2, the external connection terminal 4 and the home terminal 3 can be made the same segment.
[0076]
That is, according to the second embodiment, in addition to the effects of the first embodiment described above, it is possible to access not only the in-home connection terminal 2 but also the in-home terminal 3. Since this access is performed via the same subnet, the security measures for the home terminal 3 are the security measures on the same subnet (physically from the security measures on the world level). Will be mitigated to a limited level of security measures).
[0077]
(Third embodiment)
In the communication system according to the third embodiment, the virtual logical path does not pass through the in-network system 1, but both the in-home connection terminal 2 and the external connection terminal 4 are clients. . The in-home connection terminal 2 and the external connection terminal 4 realize the exchange of information related to the connection by relaying the in-network system 1 after the authentication.
[0078]
Since the system configuration is the same as that in FIG. 1, the same reference numerals are used for the same configurations, and redundant descriptions are omitted.
[0079]
More specifically, in the communication system according to the third embodiment, the in-network system 1 determines whether or not the terminal can be accessed based on the authentication request from the in-home connection terminal 2 and the external connection terminal 4, and the access is permitted. In this case, a virtual logical path is constructed between the in-home connection terminal 2 and the external connection terminal 4, and the layer 2 communication or one of the ones is not performed between the in-home connection terminal 2 and the external connection terminal 4 via the in-network system 1. Layer 3 communication configured by subnet is enabled.
[0080]
Hereinafter, with reference to the flowchart of FIG. 7, the flow of layer 2 communication among the in-home connection terminal 2, the in-network system 1, and the external connection terminal 4 in the communication system according to the third embodiment of the present invention will be described in detail. explain.
[0081]
After the in-home connection terminal 2 is turned on (step S50) and an authentication request is made to the in-network system 1 (step S51), the in-network system 1 receives the authentication request and determines whether the in-home connection terminal 2 can access. If it is determined and access is permitted, a message to that effect is returned to the home connection terminal 2 (step S52). Thus, information relating to the virtual path is exchanged between the home connection terminal 2 and the in-network system 1 (step S53). However, here, a virtual logical path is not established between the in-home connection terminal 2 and the in-network system 1. This completes the communication process related to advance preparation.
[0082]
After the above preparation, when the access button is clicked on the external connection terminal 4 (step S54) and an authentication request is made to the in-network system 1 (step S55), the in-network system 1 receives the authentication request, It is determined whether or not access by the external connection terminal 4 is possible. Then, the network system 1 replies to the external connection terminal 4 when permitting access (step S56). Further, the home connection terminal 2 is notified that access is permitted (step S57).
[0083]
Next, information related to the virtual path is exchanged between the in-network system 1 and the external connection terminal 4 and between the in-network system 1 and the in-home connection terminal 2 (step S58), and the in-home connection terminal 2 and the external connection terminal 4 is set (steps S59 and S60), and based on the instruction from the in-network system 1, the virtual logical path (virtual layer 2 (2)) between the home connection terminal 2 and the external connection terminal 4 is set. ) Build.
[0084]
As described above, even in the communication system according to the third embodiment of the present invention, since the directions of authentication access by the in-home connection terminal 2 and the external connection terminal 4 are all directed to the in-network system 1, the in-home connection terminal 2 It is not necessary to provide a server function.
[0085]
Further, in addition to the effects of the first embodiment described above, since data communication does not have to go through the in-network system 1, the load on the in-network system 1 is reduced and access through the shortest path is possible. Become.
[0086]
(Fourth embodiment)
In the communication system according to the fourth embodiment, the virtual logical path does not pass through the in-network system 1, but both the in-home connection terminal 2 and the external connection terminal 4 take the position of a client. . Since the system configuration is the same as that in FIG. 1, the same reference numerals are used for the same configurations, and redundant descriptions are omitted.
[0087]
More specifically, in the fourth embodiment, the in-home connection terminal 2 has a function of bridge-connecting a physical path between the external connection terminal 4 and a virtual logical path between the external connection terminal. Thus, it is possible to perform layer 2 communication or layer 3 communication constituted by one subnet between the external connection terminal 4 and the home terminal 3.
[0088]
Hereinafter, referring to the flowchart of FIG. 8, the layer 2 communication between the home terminal 3, home connection terminal 2, network system 1, and external connection terminal 4 in the communication system according to the fourth embodiment of the present invention. The flow will be described in detail.
[0089]
In this example, it is assumed that a physical path (layer 2 (<3>)) is established between the in-home terminal 3 and the in-home connection terminal 2 so that communication is possible.
[0090]
When the power of the home connection terminal 2 is turned on (step S61) and an authentication request is made to the in-network system 1 (step S62), the in-network system 1 receives the authentication request and the access by the home connection terminal 2 is performed. When permission is determined and access is permitted, a message to that effect is returned to the home connection terminal 2 (step S63). In this way, information relating to the virtual path is exchanged between the home connection terminal 2 and the in-network system 1 (step S64). However, at this stage, a virtual logical path is not established between the home connection terminal 2 and the in-network system 1. This completes the communication process related to advance preparation.
[0091]
After the above preparation, when the access button is clicked on the external connection terminal 4 (step S65) and an authentication request is made to the in-network system 1 (step S66), the in-network system 1 receives the authentication request, It is determined whether or not access by the external connection terminal 4 is possible. Then, the network system 1 replies to the external connection terminal 4 when permitting access (step S67). At the same time, the home connection terminal 2 is notified that access is permitted (step S68). Next, information related to the virtual path is exchanged between the external connection terminal 4 and the in-network system 1 and between the in-home connection terminal 2 and the in-network system 1 (step S69), and the in-home connection terminal 2 and the external connection terminal 4 are exchanged. In step S70 and S71, a virtual logical path (virtual layer 2 (4)) is established between the in-home connection terminal 2 and the external connection terminal 4 based on an instruction from the in-network system 1 in this way. Build up.
[0092]
Next, the in-home connection terminal 2 performs bridge setting (step S42), and constructs a virtual logical path (virtual layer 2 ((3) + (4))) between the in-home terminal 3 and the external connection terminal 4. This completes the communication process for external connection.
[0093]
As described above, even in the communication system according to the fourth embodiment of the present invention, the directions of authentication access by the in-home connection terminal 2 and the external connection terminal 4 are all directed to the in-network system 1, so that the in-home connection terminal 2 It is not necessary to provide a server function.
[0094]
Furthermore, according to the fourth embodiment, in addition to the effects of the third embodiment described above, not only the home connection terminal 2 but also the home terminal 3 can be accessed. Since this access is carried out via the same subnet, the security measures for the home terminal 3 are from the security measures on the Internet (security measures for the whole world) to the security measures on the same subnet (for specific access). To a limited level of security measures).
[0095]
(Fifth embodiment)
FIG. 9 shows and describes the configuration of a management device according to the fifth embodiment of the present invention and a communication system using the same.
[0096]
As shown in FIG. 9, an in-network system 1, an in-home connection terminal 2, and a WEB terminal 7 as management devices are connected via a layer 3 network 5 so as to be communicable. The in-home connection terminal 2 is further connected to the in-home terminal 3 through a layer 2 segment 6 so as to be communicable. As this in-home connection terminal 2, for example, a gateway device can be adopted. The physical path between the home terminal 3 and the home connection terminal 2 may be always connected. The WEB terminal 7 is assumed to be a mobile phone or a WEB terminal in an in-house intranet, but is not limited to this.
[0097]
In such a configuration, when the communication system receives an authentication request from the home connection terminal 2 or the WEB terminal 7, the communication system determines whether access is permitted. Data communication between the in-home connection terminal 2 and the WEB terminal is enabled by constructing a virtual logical path and relaying data by the proxy function in the data communication between the in-home connection terminal 2 and the WEB terminal 7 .
[0098]
That is, in the communication system according to the fifth embodiment, the in-network system 1 has a function as a proxy server. This in-network system 1 supports both forward proxy (for example, proxy access) and reverse proxy (for example, proxy response) by a proxy function, and further performs filtering according to the type of access as well as packet relay. It also has functions.
[0099]
10 shows that the in-network system 1 has a plurality of home connection terminals 2a, 2b, 2c..., A plurality of external connection terminals 4a, 4b, 4c... (Or WEB terminals 7a, 7b, 7c.・ ・） Shows how it is connected. As described above, the in-network system 1 connected to a plurality of in-home connection terminals in a communicable manner recognizes the identifier based on the URL information added to the data from the in-home connection terminal 2 by the proxy function, and the identifier A virtual logical path corresponding to is selected and layer 2 communication between the home connection terminal 2 and the in-network system 1 or between the WEB terminal 7 and the in-network system 1 or layer 3 communication configured by one subnet is realized. To do. That is, the in-network system 1 first selects a virtual logical path through which a packet should pass from a plurality of virtual logical paths, and secondly, the in-home connected to each of the in-home connection terminals 2a, 2b, 2c. It is determined to which home terminal of the terminal the packet is to be transmitted.
[0100]
Hereinafter, with reference to the flowchart of FIG. 11, the flow of the layer 2 communication among the home connection terminal 2, the in-network system 1, and the WEB terminal 7 in the communication system according to the fifth embodiment of the present invention will be described in detail. To do.
[0101]
Note that the communication process related to the advance preparation in steps S80 to S85 is the same as that in steps S1 to S6 in FIG.
[0102]
After the advance preparation, when the access button is clicked on the WEB terminal 7 (step S86) and an authentication request is made to the in-network system 1 (step S87), the in-network system 1 receives the authentication request and receives the WEB terminal. 7 determines whether or not access is permitted, and if the access is permitted, the fact is returned to the WEB terminal 7 (step S88). Next, when WEB access is made from the WEB terminal 7, the in-network system 1 performs proxy conversion (step S90), and the WEB using the virtual logical path (virtual layer (2)) is connected to the in-home connection terminal 2 by the forward proxy. Access is performed (step S91). When the WEB response using the virtual logical path (virtual layer (2)) is made from the home connection terminal 2 (step S92), proxy conversion is performed (step S93), and the WEB response is sent to the WEB terminal 7 by the reverse proxy. Is performed (step S94). This completes the communication process for external connection.
[0103]
Here, the proxy conversion will be described in more detail with reference to FIG.
[0104]
In FIG. 12, the terminal-side converter 8 means a general proxy server used by a terminal that does not have an Internet global address to refer to the Internet HTTP. The HTTP packet transmitted from the WEB terminal 7 arrives at the in-network system 1 based on the host part (alg.odn.ne.jp in this example) in the URL of the transmission destination. The in-network system 1 selects a home connection terminal 2 to be transmitted with reference to transmission destination VPN information (userid in this example) in the HTTP header from a plurality of home connection terminals 2a, 2b, 2c,. Further, a virtual logical path related to the in-home connection terminal is specified. The intra-network system 1 creates a new HTTP header based on the directory information in the HTTP header. The created HTTP header is transmitted to the destination address (in this example, 10.0.0.1) included in the directory information via the virtual logical path determined as described above. .
[0105]
As described above, even in the communication system according to the fifth embodiment of the present invention, all the directions of access by the in-home connection terminal 2 and the WEB terminal 4 are directed to the in-network system 1, so that the in-home connection terminal 2 has the server function. It is not necessary to have. Furthermore, it also has a proxy (forward proxy, reverse proxy, etc.) function.
[0106]
That is, in the fifth embodiment, as in the first embodiment described above, in the communication according to the prior art, the home connection terminal 2 is a server and accepts access from the outside. Since 2 is a client for the in-network system 1, it is not necessary to manage security holes and the like, which reduces the maintenance burden and enhances security. In addition, according to the fifth embodiment, the home terminal 2 can be accessed from the WEB terminal 4.
[0107]
(Sixth embodiment)
The sixth embodiment is different from the fifth embodiment in that the end point of data communication is the home terminal 3. The in-home connection terminal 2 has a function of bridge-connecting a physical path between the in-home terminal 3 and a virtual logical path between the in-network system 1 and between the in-home terminal 3 and the WEB terminal 7. Enables data communication.
[0108]
Since the system configuration is the same as that in FIG. 9, the same reference numerals are used for the same configurations, and redundant descriptions are omitted.
[0109]
More specifically, the communication system according to the sixth embodiment has a plurality of in-home connection terminals 2a, 2b, 2c,..., And receives data from the WEB terminal 7 by the proxy function of the in-network system 1. The identifier is recognized based on the added URL information, a virtual logical path is selected, and the home end 3 is selected based on the URL information added to the data from the WEB terminal 7.
[0110]
Hereinafter, referring to the flowchart of FIG. 13, the flow of the layer 2 communication between the home terminal 3, the home connection terminal 2, the network system 1, and the WEB terminal 7 in the communication system according to the sixth embodiment of the present invention. Will be described in detail.
[0111]
Note that the communication process related to the advance preparation in steps S100 to S106 is the same as steps S30 to S35 in FIG.
[0112]
After the advance preparation, when the access button is clicked on the WEB terminal 7 (step S107) and an authentication request is made to the in-network system 1 (step S108), the in-network system 1 receives the authentication request and receives the WEB terminal. 7 determines whether or not access is permitted, and if access is permitted, the fact is returned to the WEB terminal 7 (step S109). Next, when WEB access is made from the WEB terminal 7 (step S110), the in-network system 1 performs proxy conversion (step S111), and a virtual logical path (virtual layer (1) + ▲) is sent to the home terminal 3 by the forward proxy. WEB access using 3 ▼) is performed (step S112). When a WEB response using a virtual logical path (virtual layer (1) + (3)) is made from the home terminal 3 (step S113), proxy conversion is performed (step S114), and the WEB terminal 7 is reverse-proxyed. Executes a WEB response (step S115).
[0113]
This completes the communication process for external connection.
[0114]
Here, the proxy conversion will be described in more detail with reference to FIG.
[0115]
Explaining only the parts different from FIG. 12, in this sixth embodiment, since the end point of data communication is the home terminal 3, the in-network system 1 can send the destination VPN information in the HTTP header (in this example, , Userid), the home connection terminal 2 to be transmitted is selected from a plurality of home connection terminals 2a, 2b, 2c... And a virtual logical path related to the home connection terminal is specified. Further, the home terminal 3 which is an end point of data communication is specified, and a header such as Ethernet is created. The HTTP header created in this way is transmitted to the in-home terminal 3 through the determined virtual logical path based on the header information such as Ethernet.
[0116]
As described above, even in the communication system according to the sixth embodiment of the present invention, all the directions of access by the in-home connection terminal 2 and the WEB terminal 4 are directed to the in-network system 1, so that the in-home connection terminal 2 has the server function. It is not necessary to have. Furthermore, it also has a proxy (forward proxy, reverse proxy, etc.) function.
[0117]
That is, in the sixth embodiment, in addition to the effects of the fifth embodiment described above, it is possible to access not only the home connection terminal 2 but also the home terminal 3. Since this access is performed via the same subnet managed by the system 1 in the network, the security measures for the in-home terminal 3 are based on the security measures on the Internet (security measures for the world level) on the same subnet. Security measures (security measures limited to specific access).
[0118]
As described above, according to the management device and the communication system according to the first to sixth embodiments of the present invention, authentication at a home terminal, a home server, or the like is not required, and the maintenance burden on the user is reduced. In addition, security management can be enhanced by the management of the management apparatus that manages the authentication function by a professional contractor such as a telecommunications carrier.
[0119]
For example, even when 64-bit authentication is upgraded to 128-bit authentication, it can be handled only by the in-network system.
[0120]
In the communication systems according to the first to sixth embodiments, since the in-network system performs the authentication, the home connection terminal does not need to have a function as a so-called server, and the processing load related to the authentication Is also reduced. Further, since authentication is performed in an integrated manner with an in-network system intervening, it is not necessary for the in-home connection terminal to have a plurality of ports corresponding to a plurality of external connection terminals.
[0121]
Further, since the home connection terminal does not need to have a function as a server, it may have a simple configuration and does not necessarily have high specifications. For example, when the WEB terminal is a mobile phone and the in-home terminal is an air conditioner, the operation of the air conditioner in the home can be controlled from a remote place by a mobile phone. Will be able to.
[0122]
The first access terminal described in the claims corresponds to, for example, the in-home connection terminal 2, the second access terminal corresponds to, for example, the external connection terminal 4 or the WEB terminal 7, and the third terminal refers to, for example, in-home It corresponds to the terminal 3. Further, the authentication means described in the claims corresponds to, for example, the authentication function of the in-network system 1, and the (first and second) virtual logical path setting means includes, for example, the authentication function of the in-network system 1, the packet distribution function, etc. Equivalent to. Further, in the claims, a part of the in-home terminal 3, the in-home connection terminal 2, the in-network system 1, the external connection terminal 4, and the WEB terminal 7 are appropriately combined to form a communication system.
[0123]
However, it is not limited to these relationships.
[0124]
The embodiment of the present invention has been described above, but the present invention is not limited to this, and various improvements and changes can be made without departing from the spirit of the present invention.
[0125]
For example, as an encapsulation technique, an example in which IPsec, EtherIP, or the like is applied in the above-described embodiment has been described. However, the present invention is not limited to this, and PPTP, L2TP, Layer 2 Various protocols such as MPLS, which is the third tunneling protocol, can be employed.
[0126]
It should be noted that the present invention includes a method, a computer program, and an invention as a recording medium on which the program is recorded, relating to the operation of the communication system according to the first to sixth embodiments, which is performed by the in-network system. Of course.
[0127]
【The invention's effect】
As described above in detail, according to the present invention, authentication at a home terminal, home server, etc. is unnecessary, the maintenance burden on the user is reduced, and authentication is performed and managed by the management device. Thus, it is possible to provide a management device and a communication system capable of enhancing security.
[Brief description of the drawings]
FIG. 1 is a diagram showing a configuration of a management device and a communication system using the same according to a first embodiment of the present invention.
FIG. 2 is a flowchart showing a flow of layer 2 communication in the communication system according to the first embodiment of the present invention.
FIG. 3 is a flowchart for explaining in more detail the “authentication”, “information exchange regarding virtual path”, and “virtual path setting” in FIG. 2;
FIG. 4 is a flowchart showing a flow of layer 2 communication in the communication system according to the second embodiment of the present invention.
FIG. 5 is a diagram showing a configuration of a communication system according to a second embodiment of the present invention.
FIG. 6 is a diagram for explaining specific packet transfer;
FIG. 7 is a flowchart for explaining in detail the flow of layer 2 communication by the communication system according to the third embodiment of the present invention;
FIG. 8 is a flowchart for explaining in detail the flow of layer 2 communication by the communication system according to the fourth embodiment of the present invention;
FIG. 9 is a diagram illustrating a configuration of a management device and a communication system using the same according to a fifth embodiment of the present invention.
FIG. 10 is a diagram showing a state in which the in-network system 1 is connected to a plurality of home connection terminals 2a, 2b, 2c... And a plurality of external connection terminals 4a, 4b, 4c.
FIG. 11 is a flowchart illustrating in detail a flow of layer 2 communication by the communication system according to the fifth embodiment of the present invention.
FIG. 12 is a diagram for explaining proxy conversion in detail.
FIG. 13 is a flowchart for explaining in detail the flow of layer 2 communication by the communication system according to the sixth embodiment of the present invention;
FIG. 14 is a diagram for explaining proxy conversion in detail.
[Explanation of symbols]
DESCRIPTION OF SYMBOLS 1 ... In-network system, 2 ... In-home connection terminal, 3 ... In-home terminal, 4 ... External connection terminal, 5 ... Layer 3 network, 6 ... Layer 2 segment, 7 ... -WEB terminal, 8 ... terminal side converter.

Claims (23)

Authentication means for determining whether or not the terminals can be accessed based on authentication requests from the first access terminal and the second access terminal;
If access by the first access terminal is permitted as a result of the determination by the authentication means, first virtual logical path setting means for constructing a first virtual logical path with the first access terminal When,
If the access by the second access terminal is permitted as a result of the determination by the authentication means, the second virtual logical path 2 setting for constructing the second virtual logical path with the second access terminal Means,
By a management device having
Enabling layer 2 communication or layer 3 communication configured with one subnet between the first access terminal and the second access terminal;
A communication system characterized by the above. The first access terminal has a function of bridge-connecting the physical path between the third terminal and the first virtual logical path between the management devices,
The function further enables layer 2 communication or layer 3 communication configured by one subnet between the third terminal and the second access terminal. Communication system. 3. The communication system according to claim 1, wherein encrypted data is communicated in at least a part of the layer 2 communication or the layer 3 communication configured by one subnet. 4. The communication system according to claim 2, wherein a physical path between the third terminal and the first access terminal is always connected. 5. 5. The communication system according to claim 1, wherein the first virtual logical path is always connected as long as the power of the first access terminal is on. 6. Authentication means for determining whether or not the terminals can be accessed based on authentication requests from the first access terminal and the second access terminal;
As a result of the determination by the authentication means, when both the access by the first access terminal and the second access terminal are permitted, a virtual logic is generated between the first access terminal and the second access terminal. Virtual logical path setting instruction means for instructing to construct a path;
By a management device having
Enabling layer 2 communication or layer 3 communication configured with one subnet between the first access terminal and the second access terminal;
A communication system characterized by the above. The first access terminal has a function of bridge-connecting a physical path to the third terminal and a virtual logical path to the second access terminal. 7. The communication system according to claim 6, further comprising: enabling layer 2 communication or layer 3 communication configured with one subnet between the third terminal and the second access terminal. 8. The communication system according to claim 6, further comprising communicating encrypted data in at least a part of the layer 2 communication or the layer 3 communication configured by one subnet. 9. The communication system according to claim 6, further comprising a physical path that is always connected between the third terminal and the first access terminal. 10. The communication system according to claim 1, wherein the layer 2 communication means an Ethernet or a fast Ethernet. Authentication means for determining whether or not the terminals can be accessed based on authentication requests from the first access terminal and the second access terminal;
As a result of the determination by the authentication means, when the access by the first access terminal is permitted, a virtual logical path setting means for constructing a virtual logical path with the first access terminal;
Proxy means for relaying data by a proxy function in data communication between the first access terminal and the second access terminal;
By a management device having
A communication system, wherein data communication is enabled between the first access terminal and the second access terminal. A plurality of terminals of the same type as the first access terminal,
The proxy means recognizes an identifier based on an identifier discriminating function for discriminating an identifier assigned to a virtual logical path and URL information added to data from the second access terminal, and selects a virtual logical path. The communication system according to claim 11, further comprising a path selection function. The first access terminal has a function of bridge-connecting a physical path to the third terminal and a virtual logical path to the management apparatus, and the function allows the first access terminal to The communication system according to claim 11, further comprising enabling data communication with the second access terminal. A plurality of terminals of the same type as the first access terminal,
The proxy means recognizes an identifier based on an identifier discriminating function for discriminating an identifier assigned to a virtual logical path and URL information added to data from the second access terminal, and selects a virtual logical path. A path selection function, and a third terminal selection function for selecting the third terminal based on URL information added to data from the second access terminal.
14. The communication system according to claim 13, further characterized by: Further, the data communication between the first access terminal and the management apparatus or between the third terminal and the management apparatus is layer 2 communication or layer 3 communication configured by one subnet. The communication system according to any one of claims 11 to 14. Authentication means for determining whether or not the terminals can be accessed based on authentication requests from the first access terminal and the second access terminal;
If access by the first access terminal is permitted as a result of the determination by the authentication means, first virtual logical path setting means for constructing a first virtual logical path with the first access terminal When,
If the access by the second access terminal is permitted as a result of the determination by the authentication means, the second virtual logical path 2 setting for constructing the second virtual logical path with the second access terminal Means,
And at least a part of data communication enables layer 2 communication or layer 3 communication configured by one subnet between the first access terminal and the second access terminal. Management device. Authentication means for determining whether or not the terminals can be accessed based on authentication requests from the first access terminal and the second access terminal;
As a result of the determination by the authentication means, when both the access by the first access terminal and the second access terminal are permitted, a virtual logic is generated between the first access terminal and the second access terminal. Virtual logical path setting instruction means for instructing to construct a path;
And at least a part of data communication enables layer 2 communication or layer 3 communication configured by one subnet between the first access terminal and the second access terminal. Management device. Authentication means for determining whether or not the terminals can be accessed based on authentication requests from the first access terminal and the second access terminal;
As a result of the determination by the authentication means, when the access by the first access terminal is permitted, a virtual logical path setting means for constructing a virtual logical path with the first access terminal;
Proxy means for relaying data by a proxy function in data communication between the first access terminal and the second access terminal;
And at least a part of the data communication enables data communication between the first access terminal and the second access terminal. In the case where communication with a plurality of terminals of the same type as the first access terminal is possible, the proxy means includes an identifier determination function for determining an identifier assigned to a virtual logical path, and data from the second access terminal. 19. The management apparatus according to claim 18, further comprising a virtual logical path selection function for recognizing an identifier based on the URL information added to and selecting a virtual logical path. In the case where communication with a plurality of terminals of the same type as the first access terminal is possible, the proxy means includes an identifier determination function for determining an identifier assigned to a virtual logical path, and data from the second access terminal. A virtual logical path selection function for recognizing an identifier based on URL information added to the URL and selecting a virtual logical path, and selecting the third terminal based on URL information added to data from the second access terminal. The management apparatus according to claim 18, further comprising a third terminal selection function. Further, the data communication between the first access terminal and the management apparatus or between the third terminal and the management apparatus is layer 2 communication or layer 3 communication configured by one subnet. The management apparatus according to any one of claims 18 to 20. The management apparatus according to any one of claims 16 to 21, wherein the layer 2 communication means Ethernet or fast Ethernet. The management apparatus according to any one of claims 16 to 21, wherein encrypted data is communicated in at least a part of the layer 2 communication or the layer 3 communication configured by one subnet.

Images