JP2005244964A - Session information management method and session information management apparatus - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To prevent session resources from being exhausted, at a low cost while ensuring stable communications over a virtual private network connecting a client and a server. <P>SOLUTION: If a novel session connection request exceeds the number of total allowable setting sessions, a security gateway 110 reads, from a session information storage section 116, session information corresponding to a user ID included in this session setting request. An IP address included in the read session information is then used to confirm a situation wherein a session corresponding to the session information is still alive or not. If no response is obtained, the session is judged as a "dead" session and the corresponding session information is deleted. Namely, if the same mobile terminal 411 tries to set sessions after the second one while the number of total sessions is exceeded, the connection status is confirmed with regard to a former session and if the connection is not normal, setting of the former session is deleted. <P>COPYRIGHT: (C)2005,JPO&NCIPI

Description

  The present invention relates to a session information management method and session information management apparatus for managing session information in a virtual private network connecting a client and a server.

  Conventionally, a communication terminal device (client) is connected to the nearest Internet connection point via a telephone network (so-called dial-up connection), and further connected to a server side network (for example, a corporate LAN (Local Area Network)) via the Internet. When connecting, a so-called dial-up VPN is known that constructs a virtual private network (VPN) to pass safely over the Internet. A virtual private network is a technology that realizes communication having the same safety and convenience as a dedicated line on the Internet by using encryption technology, authentication technology, tunneling technology, and the like. A network component that realizes such a virtual private network function is called a security gateway (Security GateWay: SGW).

In a virtual private network, the communication partner is usually identified using an IP (Internet Protocol) address. By the way, the IP address may be fixed for each client, but when the client is making a dial-up connection, the IP address may be different every time the connection is made. Specifically, by making a connection request via the telephone network to an Internet connection point that secures a certain number of IP addresses to be assigned to the dial-up client, the dial-up client is appropriately assigned an available IP address. It is like that.
Therefore, in the dial-up VPN, when the client that terminates the virtual private network performs dial-up connection, the security gateway that is the other end of the virtual private network cannot identify the client from the IP address.

Therefore, the security gateway needs to authenticate the client with a protocol higher than IP, and generally performs authentication using information such as a combination of a user ID and a password, or information such as a digital signature. After performing such authentication, in order to perform communication between the client and the security gateway, negotiation such as information such as an IP address and a security policy in a virtual private network is performed. Both the client and the security gateway store the information in the negotiation as session information.
By connecting the client to the security gateway in this way, it is possible to connect to various servers in the company and use desired services in the same environment as in the corporate LAN.

From session setup to release of such a virtual private network,
(1) Connection from client to Internet connection point (2) Session setting between client and security gateway (3) Communication between client and server (4) Session disconnection between client and server (5) Session disconnection between client and security gateway (6 ) The usual procedure is to disconnect the client from the Internet connection point.
However, the connection between the client and the Internet connection point may be cut off, and the client may end without following normal procedures. For example, the case where the client power is cut off, the failure of the Internet connection point, or the case where the client connected to the Internet connection point via the wireless network has moved out of the service area can be considered. In the following explanation, the state where the connection point between the client and the Internet is connected is called a “live session”, and the state where the connection between the client and the Internet connection point is disconnected is called a “dead session”. Shall.

As described above, when the normal procedure is terminated, the following problems occur with respect to the session.
Since the client is connected to the Internet via the telephone network, the connection state between the client and the Internet connection point (session life or death) can be detected immediately, whereas the security gateway is connected to the Internet. Therefore, it is impossible to directly detect the connection state between the client and the Internet connection point.
If the connection between the client and the Internet connection point is cut off during the sequence of sending the packet from the server to the client, the packet does not reach the client, so the security gateway has lost the connection between the client and the Internet connection point The condition is detected indirectly by packet failure.

However, when packet non-delivery cannot be detected, for example, when a server is waiting for a request from a client, when a session between a client and a server is not established, or when a session is established. However, if it is not used, the security gateway cannot directly or indirectly detect the state where the connection between the client and the Internet connection point is broken.
As described above, since the security gateway cannot detect the connection between the client and the Internet connection point, if the security gateway keeps storing the “dead session”, there is a problem that the session resource is exhausted in the security gateway.
Or, if a client that has been disconnected from the Internet connection point is connected to the Internet connection point again due to the line status of the telephone network, etc., an IP address different from that used before is assigned. Therefore, when the client re-requests the virtual private network session setting from the security gateway, there is a problem that the setting of the new session is rejected because the previous session information is stored. This is because the security gateway restricts a client having the same user ID from setting a plurality of sessions at the same time for security reasons.
In order to solve such problems, it is possible to set the security gateway to automatically delete sessions that are not used for a certain period of time, but in such a case the client side does not communicate for a long time Has the inconvenience of deleting the session, which is inconvenient for the client.

Therefore, conventionally, the server sends a status confirmation packet (keep-alive packet) to the client at regular intervals, and when the client receives the keep-alive packet, it sends a response indicating that it is normal, and the server is within the specified time. If no response is returned, the client determines that the session has been stopped and deletes the session information.
However, when the telephone network to which the client is connected is a so-called packet switching type telephone network that charges for the amount of transmitted and received data, using such a keep-alive packet, packet switching is performed at regular intervals. There is a problem that the communication cost of the client-side user is increased because charging is performed for each keep-alive packet.
Alternatively, if packet transmission delay occurs due to temporary congestion of the telephone network or the Internet, the response to the keep-alive packet does not return within the specified time, so the session is alive even though it is alive. There was also a problem that information was deleted and stable communication could not be performed. As described above, in the conventional session management method, it is difficult to prevent the depletion of session resources at low cost while ensuring stable communication.

  The present invention has been made to solve the above-described problems, and provides a session information management method and a session information management apparatus capable of preventing session resource depletion at low cost while ensuring stable communication. The purpose is to do.

In order to solve the above-described problem, the invention described in claim 1 is a session information management method in a virtual private network for connecting a client and a server connected to different communication networks,
The client has a communication address assigned by the communication network to which the client is connected,
A session setting request step for receiving a session setting request including authentication information and communication address information of the client;
When the session setting request satisfies a predetermined condition, a session information storage step of storing authentication information and communication address information included in the session setting request in association with each other as session information;
When the session information to be generated based on the session setting request exceeds the total number of sessions that can be set on the server side, the stored session information corresponding to the authentication information included in the session setting request A selection stage to select
A connection status confirmation stage for confirming a connection status in the virtual private network with respect to the communication address included in the selected session information;
A session information deleting step of deleting the session information corresponding to the status confirmation when a response indicating that the connection status is normal is not obtained in response to the connection status confirmation.

The invention according to claim 2 is a session information management device for managing session information in a virtual private network that connects a client and a server connected to different communication networks,
The client has a communication address assigned by the communication network to which the client is connected,
Receiving means for receiving a session setting request including authentication information and communication address information of the client;
When the received session setting request satisfies a predetermined condition, session information storage means for storing authentication information and communication address information included in the session setting request in association with each other as session information;
When the session information to be generated based on the session setting request exceeds the total number of sessions that can be set on the server side, the stored session information corresponding to the authentication information included in the session setting request A selection means for selecting
Connection status confirmation means for confirming a connection status in the virtual private network with respect to a communication address included in the selected session information;
Session information deleting means for deleting the session information corresponding to the status confirmation when a response indicating that the connection status is normal cannot be obtained in response to the connection status confirmation.

  According to the present invention, in a virtual private network connecting a client and a server, it is possible to prevent the depletion of session resources at low cost while ensuring stable communication.

  Hereinafter, embodiments of the present invention will be described with reference to the drawings.

[1. Configuration of Embodiment]
[1-1. overall structure]
FIG. 1 is a diagram showing an overall configuration of the embodiment. As shown in FIG. 1, in this embodiment, mobile terminals 411, 412, 413, and the like are connected to a corporate LAN 100 via a virtual private network 210 and a mobile communication network 300 set in the Internet 200 with the security gateway 110 as a termination. 420 (referred to as a mobile terminal 400 if no specific specification is required) can be connected.

In the present embodiment, a PDC mobile packet communication system (Personal Digital Cellular-Packet: PDC-P) is used for the mobile communication network 300. The mobile communication network 300 includes a base station (BS) 310, a packet Base station modulation / demodulation equipment (P-MDE) 320, subscriber exchange (Mobile Local Switch: MLS) 330, packet subscriber processing equipment (Packet Processing Module: PPM) 340, mobile communication service control equipment ( A mobile service control point (M-SCP) 350 and a packet gateway (PGW) 360 are provided.
The base station 310 is connected to a packet base station modem 320 having a packet communication function, and provides a high-speed packet air interface to the mobile terminal 400.
The packet subscriber processing device 340 is opposed to the mobile terminal 400 via the base station 310 and transmits / receives packets, and performs assembly / disassembly, authentication, concealment, accounting, etc. of packets in the wireless section. In this embodiment, it functions as a charging point for downlink packets from the corporate LAN 100 to the mobile terminal 400, and charging is performed when an ACK (Acknowledge) indicating a response to the downlink packet is received from the mobile terminal 400.
The mobile communication service control device 350 includes an in-network database that stores service information of the area where the mobile terminal 400 exists and subscribers, and the packet gateway 360 moves when a packet arrives from another network such as the Internet 200 to the mobile terminal 400. The location information held by the communication service control device 350 is accessed, and the packet subscriber system processing device 340 that manages the area where the mobile terminal 400 exists is routed.

The packet gateway 360 has a function as an accounting point for an upstream packet from the mobile terminal 400 to the corporate LAN 100 as well as a function as an Internet connection point. The packet gateway 360 includes an IP address pool 361, and selectively assigns any one of IP addresses that can be used when a connection request is received from the mobile terminal 400.
When the mobile terminal 400 connects to the corporate LAN 100 via the virtual private network 210, the mobile terminal 400 connects to the packet gateway 360, which is an Internet connection point, and receives an IP address assignment each time the connection is made. Packets can be transmitted. The packet gateway 360 charges when a packet is transmitted to the interface 200.

In this embodiment, the mobile terminals 411, 412, and 413 (referred to as the mobile terminal 410 when specific is not required) are communication terminal devices used by a user having a legitimate authority for the corporate LAN 100, and the mobile terminal 420 Is a communication terminal device used by a person who does not have a legitimate access authority to the corporate LAN 100 (so-called hacker).
A unique user ID in the corporate LAN 100 is assigned to each user of the mobile terminal 410 having a legitimate authority. In this embodiment, a user ID “Client1” is assigned to the user of the mobile terminal 411, a user ID “Client2” is assigned to the user of the mobile terminal 412, and “Client3” is assigned to the user of the mobile terminal 413. User IDs are assigned, and these user IDs are managed as information for identifying the user of each mobile terminal 410 in the corporate LAN 100, as will be described in detail later.
Note that a user ID is not assigned to a hacker who is a user of the mobile terminal 420, and authentication information such as a user ID and a password is illegally obtained from a legitimate authorized person and a connection to the corporate LAN 100 is attempted.
In the present embodiment, when a session between the corporate LAN 100 and the mobile terminal 400 is set using information such as a user ID, a password, and an IP address, the security gateway 110 and the mobile terminal 400 will use the session information as will be described in detail later. Are stored in the virtual private network 210 stably, and unauthorized access by a third party is prevented.

[1-2. Security Gateway Configuration]
Next, the security gateway 110 will be described in more detail. FIG. 2 is a block diagram showing a functional configuration of the security gateway 110.
The security gateway 110 includes an Internet connection unit 111 that is an interface with the Internet 200, an authentication control unit 112 that controls authentication, a user information storage unit 113 that stores user authentication information such as a user ID and a password, and denies unauthorized access. An access denial information storage unit 114 that stores information on the session, a session control unit 115 that performs various control related to the session, a session information storage unit 116 that stores session information, and a LAN connection unit 117 that is an interface in the corporate LAN 100. Yes.

Here, the information stored in the session information 116, the user information storage unit 113, and the access denial information storage unit 114 will be described with reference to FIG.
The session information storage unit 116 stores session information in which a client IP address and a user ID are associated with each different session number. The rules for assigning session numbers will be described later.
The user information storage unit 113 stores user information in which a password set by each user is associated with each user ID assigned to each user who has access authority to the corporate LAN 100.
In addition, the access denial information storage unit 114 stores access denial information in which an IP address used for illegal access is associated with each user ID determined to be illegal access. The user ID indicated by the access denial information is a user ID illegally obtained by a hacker from a legitimate user, and the user ID itself is legitimate information stored in the user information storage unit 113. In the present embodiment, even when a user ID or password is obtained illegally, it is possible to determine whether or not the request is a valid session setting request using the IP address.

[2. Operation of the embodiment]
Next, as the operation of the present embodiment, the operation of the security gateway will be described with reference to the flowcharts shown in FIGS. 4 to 6, and then the entire specific operation will be described with reference to the sequences shown in FIGS. 7 to 9. explain.

[2-1. Security Gateway Operation]
[2-1-1. Operation when requesting session settings]
FIG. 4 is a flowchart showing the operation of the security gateway 110 when a session setting is requested.
Upon receiving the session setting request (S1), the security gateway 110 first authenticates the session request (S2). Here, the authentication control unit 112 determines whether or not the request is from a legitimate user based on the information (see FIG. 3) stored in the user information storage unit 113 and the access denial information storage unit 114 described above. To do.
If it is determined in step S2 that the request is not a valid session setting request from a valid user (S2; NG), the session setting request received in step S1 is rejected (S3).

On the other hand, if it is determined in the authentication in step S2 that the request is a session setting request from a valid user (S2; OK), then the number of simultaneous connection sessions is checked (S4). Checking the number of simultaneous connection sessions is a process for restricting simultaneous setting of sessions by clients having the same user ID. Specifically, if the session information corresponding to the same user ID as the user ID indicated by the client that made the session request is stored in the session information storage unit 116 at the time of the check, the number of simultaneous connection sessions is exceeded. It is determined that
If it is determined in step S4 that the number of simultaneously connected sessions has not been exceeded (S4; OK), a session setting process for the session setting request is performed (S5). The session setting process is a process for eliminating the depletion of session resources of the server-side security gateway 110, and will be described in detail later with reference to FIGS.
On the other hand, if it is determined in step S4 that the number of simultaneous connection sessions has been exceeded (S4; NG), unauthorized connection prevention processing is performed (S6). The unauthorized connection prevention process is a process for determining whether or not the session setting request indicating the same user ID as the user ID for which session information has already been stored is from a legitimate user. This will be described later with reference to FIGS.

[2-1-2. Session setting process]
Next, the session setting process (FIG. 4: S5) will be described with reference to the flowchart shown in FIG.
In the session setting process, the security gateway 110 first performs a total session number restriction check (S51). There is a limit in advance on the total number of sessions that can be stored in the session information storage unit 116, and when there is a session setting request exceeding this limit, the session resources on the server side are exhausted. Therefore, the session control unit 115 determines whether or not the number of sessions stored in the session information storage unit 116 at the time of the session setting request is within the limit range.

If it is determined in step S51 that the number of sessions is within the limit (S51; OK), the session control unit 115 performs session setting for the session setting request (S52).
On the other hand, when it is determined in the check in step S51 that the number of sessions is not within the limit range (S51; NG), the session control unit 115 selects from the session information stored in the session information storage unit 116. A candidate session to be deleted is selected (S53). There is a possibility that the “dead session” as described above may be included in the stored session information. By deleting such “dead session”, the depletion of session resources is resolved. can do.

In the present embodiment, a session that is highly likely to be deleted is selected using one of the following two types of algorithms.
(1) FIFO (First In First Out)
This algorithm deletes the oldest session created. When selecting a deletion session candidate using this algorithm, for example, the session control unit 115 generates session information so that session numbers are assigned in the order in which the sessions are created, and the session information storage unit 116 stores the session information. The stored session information having the smallest session number is selected as a deletion session candidate. In such a case, when newly generating session information, the largest session number may be assigned at that time.
(2) LRU (Last Recently Used)
An algorithm that deletes the oldest used session. In the case of selecting a deletion session candidate using this algorithm, for example, the session control unit 115 generates session information so that session numbers are assigned in the order in which sessions are used, and the session information storage unit 116 stores the session information. The stored session information having the smallest session number is selected as a deletion session candidate. In this case, every time communication is performed, the largest session number at that time may be assigned again.

When the deletion candidate session is selected in step S53, the session control unit 115 transmits a status confirmation message to the client corresponding to the selected deletion candidate session (S54), and whether or not there is a normal response from the client. Is determined (S55). Here, it is determined that there is no response from the client when there is no response from the client within a predetermined period, or when there is a response different from a predefined response or a response indicating an abnormality (abnormal response). .
If it is determined in step S55 that there is a response from the client (S55; yes), the session selected in step S53 is replaced with the end of the deletion candidate (S56), and the process proceeds to step S53 and again the deletion candidate. Perform session selection. For example, if the session information with the smallest session number is selected as a deletion candidate, the last session number of the deletion candidate is updated by updating the session number in the session information to the largest session number at that time. Replace with
On the other hand, if it is determined in step S55 that there is no response from the client (S55; none), the session selected in step S53 is deleted, and a session for the session request is set (S57).

[2-1-3. Unauthorized connection prevention process]
Next, the unauthorized connection prevention process (FIG. 4: S6) will be described with reference to the flowchart shown in FIG.
In the unauthorized connection prevention process, the security gateway 110 transmits a status confirmation message to the IP address of the old session (S61), and determines whether there is a response to the status confirmation message (S62). The session control unit 115 uses the session information stored in the session information storage unit 116 to obtain the IP address stored corresponding to the same user ID as the user ID of the client making the session setting request. An IP address is extracted, and a status confirmation message packet with the IP address as the destination is transmitted. The status confirmation message includes a message warning that there is a session setting request indicating the same user ID.

If there is no response to the status confirmation message in the determination in step S62 (S62; none), the session control unit 115 sends the mobile terminal 400 and the packet gateway 360 (Internet connection point) to which the IP address for which the status confirmation has been performed is assigned. ) Is disconnected, the old session corresponding to the IP address is dead, the old session is deleted, and a new session is set in response to the session setting request (S63).
More specifically, when a session corresponding to the IP address whose status has been confirmed is dead, there is a new session request indicating the same user ID. For some reason, the mobile terminal 400, the packet gateway 360, It is highly possible that a new IP address has been assigned to the mobile terminal 400 because the connection has been re-established after the connection is disconnected. Therefore, in such a case, the session control unit 115 determines that the session connection request is from a valid user. In addition, the old session is deleted from the session information storage unit in order to remove the restriction on the number of simultaneous sessions.
On the other hand, if it is determined in step S62 that there is a response to the status confirmation message (S62; present), the session corresponding to the IP address for which the status has been confirmed is alive, that is, the assignment of the IP address Although the mobile terminal 400 and the corporate LAN 100 are connected, it is determined that a third party is trying to connect illegally, and session setting is rejected (S64).

[2-2. Specific operation of the embodiment]
[2-2-1. When the total number of sessions exceeds the limit]
First, referring to FIG. 7, when three or more mobile terminals 400 each make a session setting request to the security gateway 110 with a total session number limit of 2, the total session number limit is exceeded. Will be described.
In FIG. 7, the mobile terminal 411 shown in FIG. 1 makes a session setting request with the user ID “Client1”, the mobile terminal 412 with the user ID “Client2”, and the mobile terminal 413 with the user ID “Client3”. In FIG. 7, information regarding the IP address assigned to each mobile terminal 400 is omitted.

The mobile terminal 411 makes a session setting request to the security gateway 110 as the user ID “Client1” (S101). At this time, the session control unit 115 refers to the session information stored in the session information storage unit 116, determines that the total number of sessions is within the range, and newly generates session information. The new session information is assigned the largest session number # 1 at this time.
When new session information is generated, the security gateway 110 responds to the mobile terminal 411 with a session setting (S102) so that the mobile terminal 411 and the corporate LAN 100 can communicate with each other via the virtual private network 210. become.

Next, the mobile terminal 412 makes a session setting request to the security gateway 110 as the user ID “Client2” (S103). At this time, the session control unit 115 refers to the session information stored in the session information storage unit 116, determines that the total number of sessions is within the range, and newly generates session information. The new session information is assigned the largest session number # 2 at this time.
When new session information is generated, the security gateway 110 responds to the mobile terminal 412 with a session setting (S104) so that the mobile terminal 412 and the corporate LAN 100 can communicate with each other via the virtual private network 210. become.

Since the total number of sessions in the security gateway 110 is 2, the session resource is exhausted at this point, and when the mobile terminal 413 subsequently makes a session setting request to the security gateway 110 as the user ID “Client3” (S105). ), The session control unit 115 refers to the session information stored in the session information storage unit 116 and determines that the total session number limit has been exceeded.
Therefore, the session control unit 115 selects the session information assigned the smallest session number # 1 at this time as a deletion candidate session having a high possibility of “dead”, and is stored corresponding to the session number # 1. A status confirmation message is transmitted to the mobile terminal 411 indicating the user ID “Client1” (S106).
When the mobile terminal 411 responds normally to the status confirmation message (S107), the session control unit 115 updates the session number # 1 of the selected session information to the largest session number # 3 at this time. By updating session number # 1 to session number # 3, the session information corresponding to “Client1” is replaced with the last candidate for deletion, and the smallest session number at this point is # 2.

By the way, the mobile terminal 412 has moved out of the service area after session setting (S108), and the connection with the packet gateway 360 has been disconnected. Therefore, the session assigned session number # 2 is in a “dead” state.
However, since the security gateway 110 has not detected that the connection between the mobile terminal 412 and the packet gateway 360 is disconnected, the session control unit 115 sets the session information assigned the session number # 2 as a deletion candidate. Then, a status confirmation message is transmitted to the mobile terminal 412 indicating the user ID “Client2” stored corresponding to the session number # 2 (S109).
Since the connection between the mobile terminal 412 and the packet gateway 360 is disconnected, this status confirmation message does not reach the mobile terminal 412, and no response is made to the security gateway 110, or an abnormal response is made. (S110). The session control unit 115 determines that the session with the session number # 2 is “dead”, deletes the session information, and generates session information for the session setting request made by the mobile terminal 413 as the user ID “Client3”. To do. The new session information is assigned the largest session number # 4 at this time.
When new session information is generated, the security gateway 110 responds to the mobile terminal 413 with a session setting (S111) so that the mobile terminal 413 and the corporate LAN 100 can communicate with each other via the virtual private network 210. become.

In this way, the security gateway 110 selects a deletion candidate session that is highly likely to be “dead” when the total session count limit is exceeded, and sequentially checks whether the session is alive, Since the “dead” session is deleted, the possibility of deletion mistakes can be extremely reduced.
Further, since a “dead” session can be deleted without using a keep alive packet, there is no charge for the keep alive packet, and the communication cost of the mobile terminal 400 can be reduced.

[2-2-2. When the same user requests session setting again]
Next, referring to FIG. 8, when the mobile terminal 411 disconnects from the packet gateway 360 once after setting the session and makes a session setting request after reconnection, the same user makes a session setting request again. Will be described.
In the example illustrated in FIG. 8, the IP address assigned when the mobile terminal 411 first connects to the packet gateway 360 is “123.456.78.9”, and the IP address assigned when the mobile terminal 411 is reconnected after disconnection is “223.456. 78.9 ”.

When the user ID and password are input from the user interface of the mobile terminal 411 (S201), the mobile terminal 411 makes a session setting request to the security gateway 110 as the user ID “Client1” (S202). At this time, the session control unit 115 refers to the session information stored in the session information storage unit 116, determines that it is within the range of the number of simultaneously connected sessions, and newly generates session information. The new session information is assigned the largest session number # 1 at this time.
When new session information is generated, the security gateway 110 responds to the mobile terminal 411 with a session setting (S203) so that the mobile terminal 411 and the corporate LAN 100 can communicate with each other via the virtual private network 210. become.

After that, when the connection between the mobile terminal 411 and the packet gateway 360 is disconnected, the session with the session number # 1 is in a “dead” state, but the security gateway 110 is connected to the mobile terminal 412 and the packet gateway 360. Since the disconnected state is not detected, the session information assigned with the session number # 1 is stored in the session information storage unit 116 as it is.
Then, the mobile terminal 411 reconnects to the packet gateway 360 and is assigned the IP address “223.456.78.9” (S205). Here, when a user ID and password are input from the user interface of the mobile terminal 411 (S206), the mobile terminal 411 makes a session setting request to the security gateway 110 as the user ID “Client1” (S207). At this time, the session control unit 115 refers to the session information stored in the session information storage unit 116 and detects that the concurrent connection session limit number has been exceeded, and the IP address “123.456.78.9 corresponding to the session information is detected. A status confirmation message with "" as the destination is transmitted (S208).

  Since the assignment of the IP address “123.456.78.9” to the mobile terminal 411 is released when the connection between the mobile terminal 411 and the packet gateway 360 is disconnected, a status confirmation message with the IP address “123.456.78.9” as the destination No response is made to (S209). Therefore, the session control unit 115 deletes the session information for which the status has been confirmed, and generates new session information (session number #n in the figure) for the session setting request in step S207. When new session information is generated, the security gateway 110 responds to the mobile terminal 411 with a session setting (S210), and communication between the mobile terminal 411 and the corporate LAN 100 via the virtual private network 210 is performed using the IP address “123.456”. .78.9 ”will be transferred to“ 223.456.78.9 ”and can be continued.

  As described above, when the mobile terminal 411 disconnects the connection with the packet gateway 360 once after setting the session and makes a session setting request after reconnecting, the “dead” session without waiting for the depletion of the session resources. Can be deleted at an early stage, so that the session state can be managed more accurately.

[2-2-3. To prevent unauthorized connections]
Next, referring to FIG. 9, an operation when the mobile terminal 411 sets a session with the user ID “Client1” and then a hacker requests a session setting with the user ID “Client1” from the mobile terminal 420 will be described.
In the example shown in FIG. 9, the IP address assigned when the mobile terminal 411 is connected to the packet gateway 360 is “123.456.78.9”, and the IP address assigned when the mobile terminal 420 is connected to the packet gateway 360 is “987.654.32.1”.

When the user ID and password are input from the user interface of the mobile terminal 411 (S301), the mobile terminal 411 makes a session setting request to the security gateway 110 as the user ID “Client1” (S302). At this time, the session control unit 115 refers to the session information stored in the session information storage unit 116, determines that it is within the range of the number of simultaneously connected sessions, and newly generates session information. The new session information is assigned the largest session number # 1 at this time.
When new session information is generated, the security gateway 110 sends a session setting response to the mobile terminal 411 (S303) so that the mobile terminal 411 and the corporate LAN 100 can communicate with each other via the virtual private network 210. become.

Next, using the user ID “Client1” and the password obtained illegally by the hacker, the mobile terminal 420 makes a session setting request to the security gateway 110 as the user ID “Client1” (S304). At this time, the session control unit 115 refers to the session information stored in the session information storage unit 116 and detects that the concurrent connection session limit number has been exceeded, and the IP address “123.456.78.9 corresponding to the session information is detected. A status confirmation message with "" as the destination is transmitted (S305). Since this message reaches the mobile terminal 411 to which the IP address “123.456.78.9” is still assigned, the mobile terminal 411 makes a normal response to the status confirmation message (S306) and warns the user interface. A message is displayed (S307).
Upon receiving the response, the security gateway 110 rejects the session setting request received in step S304 (S308), and associates the user ID “Client1” indicated by the rejected session setting request with the IP address 987.654.32.1 ”for access. Register as rejection information.

Thereafter, when a session setting request is received again from the mobile terminal 420 (S309), the security gateway 110 refers to the access denial information, so that even if the session setting request indicates the user ID “Client1”, the IP address If “987.654.32.1”, it can be determined that the request is from a hacker and the session setting can be rejected (S310).
Further, the user of the mobile terminal 411 recognizes the presence of the hacker by a warning message displayed on the user interface and takes measures such as changing the password.

  Thus, when a malicious third party (hacker) illegally obtains authentication information of a legitimate user and makes a session setting request, it has the same authentication information from the already stored session information. By sending a status confirmation message to the IP address, unauthorized connection by a hacker can be prevented.

[3. Modified example]
The present invention is not limited to the above-described embodiments, and various modifications as described below are possible.

In the above embodiment, the terminal device on the client side has been described by taking the mobile terminal 400 as an example. Similarly, in the above embodiment, the network on the server side has been described by taking the corporate LAN 100 as an example. However, any network can be used as long as it can be connected to the Internet. It does not matter if it is a network configured with.
Further, the communication network is not limited to the PDC packet communication network 300, and may be another communication network as long as it is charged for the amount of transmitted / received data. Of course, the Internet connection point is not limited to the packet gateway 360 but may be another provider.

  In the above-described embodiment, the user ID and the password have been described as examples of the authentication information included in the session setting request. Also, the address information is not limited to the IP address, but may be other information that identifies the client terminal.

  In the above embodiment, the predetermined rule for selecting the deletion candidate session information is FIFO or LRU, that is, the selected priority is long in the elapsed time from the generation or the elapsed time since the last use. However, the present invention is not limited to this, and other rules may be used as long as the possibility that the session is “dead” can be selected. In addition, in the above embodiment, the session number is used as the information indicating the elapsed time since the last generation or the time since the last use. However, the present invention is not limited to this. Information may be included, or other parameters may be used.

It is a figure which shows the whole structure of embodiment. It is a figure which shows the structure of a security gateway. It is a figure explaining the various information to memorize | store. It is a flowchart explaining operation | movement of a security gateway. It is a flowchart explaining a session setting process. It is a flowchart explaining an unauthorized access prevention process. It is a sequence explaining a specific operation when the total number of sessions limit is exceeded. It is a sequence explaining a specific operation when the same user makes a session setting request again. It is a sequence explaining a specific operation in the case of preventing unauthorized connection.

Explanation of symbols

100 ... Corporate LAN,
110: Security gateway,
200 ... Internet,
210 ... Virtual private network 300 ... Mobile communication network,
310 ... base station,
320 ... Packet base station modulation / demodulation device,
330 ... Subscriber exchange,
340 ... Packet subscriber processing unit,
350 ... mobile communication service control device,
360 ... packet gateway,
361 ... IP address pool,
411, 412, 413, 420 ... mobile terminals.

Claims (2)

A session information management method in a virtual private network for connecting a client and a server connected to different communication networks,
The client has a communication address assigned by the communication network to which the client is connected,
A session setting request step for receiving a session setting request including authentication information and communication address information of the client;
When the session setting request satisfies a predetermined condition, a session information storage step of storing authentication information and communication address information included in the session setting request in association with each other as session information;
When the session information to be generated based on the session setting request exceeds the total number of sessions that can be set on the server side, the stored session information corresponding to the authentication information included in the session setting request A selection stage to select
A connection status confirmation stage for confirming a connection status in the virtual private network with respect to the communication address included in the selected session information;
A session information deleting step for deleting the session information corresponding to the status confirmation when a response indicating that the connection status is normal cannot be obtained in response to the confirmation of the connection status. Information management method. A session information management device that manages session information in a virtual private network that connects a client and a server connected to different communication networks,
The client has a communication address assigned by the communication network to which the client is connected,
Receiving means for receiving a session setting request including authentication information and communication address information of the client;
When the received session setting request satisfies a predetermined condition, session information storage means for storing authentication information and communication address information included in the session setting request in association with each other as session information;
When the session information to be generated based on the session setting request exceeds the total number of sessions that can be set on the server side, the stored session information corresponding to the authentication information included in the session setting request A selection means for selecting
Connection status confirmation means for confirming a connection status in the virtual private network with respect to a communication address included in the selected session information;
A session information deleting means for deleting the session information corresponding to the status confirmation when a response indicating that the connection status is normal cannot be obtained in response to the confirmation of the connection status. Information management device.

Images