JP2006319873A - Vpn(virtual private network) connecting method, virtual private network connection apparatus utilizing the same, radio terminal and virtual private network system - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To easily build a VPN(virtual private network). <P>SOLUTION: VPN-connection apparatus 12 belonging to a VPN acquires information for accessing their own, and sends the information to radio terminals 14. The VPN-connection apparatus 12 inputs access information of a communication party group owned by the radio terminals 14 in common, and stores the information inside. The VPN-connection apparatus 12 capsulizes data to be sent, based on the stored access information and inverse-capsulizes received data. <P>COPYRIGHT: (C)2007,JPO&INPIT

Description

  The present invention relates to a virtual private network connection technique, and more particularly to a virtual private network connection method for connecting different local networks, a virtual private network connection device, a wireless terminal device, and a virtual private network system using the same.

There is a VPN (Virtual Private Network) as a technology for virtually connecting a local network between a home and a company while using a public network possessed by the Internet or a communication carrier. When the VPN transmits data to the Internet or a public network, the VPN encrypts or encapsulates the data. In order to execute encryption and encapsulation, the protocols in VPN include IPsec (IP security), SSL (Secure Sockets Layer), PPTP (Point to Point Tunneling Protocol), and L2TP (Layer 2 Tunneling Protocol). It is used (for example, refer nonpatent literature 1).
Network magazine editorial department clearly understood! VPN, ASCII Corporation, 2005, p. 2-13

  Under such circumstances, the present inventor has come to recognize the following problems. When a VPN is constructed by a network device, a keyboard, a liquid crystal screen, and the like are indispensable for a user to input access information such as an IP address. Therefore, complicated operations and procedures using a personal computer or the like are required, and it is difficult for a user who is unfamiliar with such operations and procedures in terms of usability. Further, when changing the settings of the network device according to the purpose of use, the same setting is required every time the change is made.

  In addition, a technique for constructing a VPN to a certain degree by introducing a dedicated application into a personal computer for constructing a VPN and connecting the application to a management server system on the Internet can be applied to a device that does not support the dedicated application. It becomes difficult to apply. In addition, installation and maintenance of the management server system is indispensable. Therefore, there are cases where costs related to the installation and maintenance of the management server system and load factors on the service provider related to the service maintenance responsibility may occur.

  The present invention has been made in view of such circumstances, and an object thereof is to provide a virtual private network connection technique for easily constructing a VPN.

  In order to solve the above problems, a virtual private network connection device according to an aspect of the present invention connects one end to a communication target virtual private network connection device and the other end to a local network via a virtual private network. A first communication unit, identification information corresponding to one end of the first communication unit, a storage unit storing identification information assigned in the virtual private network, identification information stored in the storage unit, and communication A second terminal that connects a wireless terminal device that is to communicate with a wireless terminal device corresponding to a communication target virtual private network connection device via a wireless network in order to exchange identification information corresponding to the target virtual private network connection device. Between the communication unit, the wireless terminal device connected to the second communication unit, and the storage unit There are, and a control unit to perform the exchange of identification information. The first communication unit encapsulates data received from the other end side, and transmits from one end side based on identification information corresponding to the virtual private network connection device to be communicated stored in the storage unit, and one end Means for transmitting data from the other end side while decapsulating the data received from the other side.

  According to this aspect, since the identification information for connecting the VPN is exchanged with the virtual private network connection device to be communicated via the wireless terminal device, the direct operation of the virtual private network connection device can be omitted. VPN can be constructed easily.

  The virtual private network is constructed on an IP network, and one end side of the first communication unit has a private IP address, and a virtual private network connection device to be communicated via a gateway having an IP masquerade function The global IP address and port number assigned to the gateway as identification information and corresponding to the private IP address at one end of the first communication unit are stored in the storage unit. May be stored. In this case, even in an environment provided with a gateway having an IP masquerade function in advance, a VPN can be easily constructed by connecting a virtual private network connection device to the gateway.

  The virtual private network is constructed on an IP network, and the first communication unit has an IP masquerade function for a global IP address and port number on one end side and a private IP address on the other end side, and a storage unit May store a global IP address and a port number assigned to one end of the first communication unit as identification information. In this case, since it has an IP masquerade function, a gateway can be made unnecessary.

  If the identification information acquired in the acquisition unit and the identification information acquired in the acquisition unit are different from the identification information stored in the storage unit via the one end side of the first communication unit, the identification information acquired in the acquisition unit An update unit that updates the identification information stored in the storage unit. The “identification information” may be identification information corresponding to its own virtual private network connection device, or may be identification information corresponding to a virtual private network connection device to be communicated. In this case, since the update of the identification information can be automatically detected, the update of the identification information can be handled.

  You may further provide the detection part which detects the connection of a 2nd communication part and a wireless terminal device. The control unit may exchange the identification information when the connection is detected by the detection unit. In this case, since the exchange of the identification information is automatically executed when the connection is detected, the convenience for the user can be improved.

  Another aspect of the present invention is a wireless terminal device. This device is connected to a virtual private network connection device that connects one end to a communication target virtual private network connection device and connects the other end to a local network via a virtual private network. A second communication unit connected via a wireless network to a wireless terminal device corresponding to a virtual private network connection device to be communicated to which the virtual private network connection device is to be connected via the virtual private network; The communication between the virtual private network connection device connected to the first communication unit and the virtual private network connection device to be communicated corresponds to each other while executing communication in the first communication unit and the second communication unit. Identification information and virtual And a control unit to achieve the sharing of the identification information provided in the sorbate network.

  According to this aspect, the VPN is connected between the virtual private network connection devices by connecting to the other wireless terminal devices via the wireless network while being connected to the virtual private network connection device via the wireless link. Since the identification information for exchange is exchanged, direct operation of the virtual private network connection device can be omitted, and a VPN can be easily constructed.

  You may further provide the memory | storage part which memorize | stores the list | wrist of the destination of the radio | wireless terminal apparatus which the 2nd communication part should connect, and the reception part which receives the instruction | indication for selecting either of the list | wrist memorize | stored in the memory | storage part. The control unit may cause the second communication unit to transmit the identification information to the wireless terminal device according to the instruction received by the reception unit. In this case, since the user selects a communication target from a list stored in advance, user convenience can be improved.

  Yet another aspect of the present invention is a virtual private network system. This virtual private network system has one end connected to a communication target virtual private network connection device and the other end connected to a local network via a virtual private network, and identification information corresponding to one end side. And a virtual private network connection device for storing identification information given in the virtual private network, means for connecting to the virtual private network connection device by a wireless link, and a communication target to be connected by the virtual private network connection device A wireless terminal device including means for connecting to a wireless terminal device corresponding to the virtual private network connection device via a wireless network. The wireless terminal device connects to the virtual private network connection device and the wireless terminal device corresponding to the virtual private network connection device to be communicated, thereby identifying information corresponding to the virtual private network connection device and the virtual private network to be communicated. The identification information corresponding to the connection device is exchanged, and the virtual private network connection device encapsulates the data received from the other end side, and transmits from one end side based on the identification information of the communication target virtual private network connection device. And means for transmitting from the other end side while decapsulating the data received from the one end side.

  According to this aspect, since the identification information for connecting the VPN is exchanged with the virtual private network connection device to be communicated via the wireless terminal device, the direct operation of the virtual private network connection device can be omitted. VPN can be constructed easily.

  Yet another aspect of the present invention is a virtual private network connection method. In this method, one end is connected to a communication target virtual private network connection device via the virtual private network, and the other end is connected to the local network. For a virtual private network connection device that stores identification information assigned in a private network, a step in which the wireless terminal device acquires the identification information via a wireless link, and a communication target to be connected by the virtual private network connection device A step in which the wireless terminal device transmits the acquired identification information to the wireless terminal device corresponding to the virtual private network connection device via the wireless network; and a wireless terminal device corresponding to the virtual private network connection device to be communicated From the wireless network The wireless terminal device receives the identification information corresponding to the communication target virtual private network connection device, and the wireless terminal device communicates with the virtual private network connection device via the wireless link via the wireless link. A step of notifying identification information corresponding to the virtual private network connection device; a step of executing communication between the virtual private network connection device and the virtual private network connection device to be communicated based on the identification information; .

  It should be noted that any combination of the above-described constituent elements and a conversion of the expression of the present invention between a method, an apparatus, a system, a recording medium, a computer program, etc. are also effective as an aspect of the present invention.

  According to the present invention, a VPN can be easily constructed.

  Before describing the present invention in detail, an outline will be described. An embodiment of the present invention relates to a VPN system in which a plurality of LANs installed in isolated locations are formed as one LAN by constructing a VPN on the Internet. A VPN connection device is connected to each LAN connected by VPN. Further, the VPN connection device is connected to the Internet via a GW (Gateway). As a result, a VPN is constructed on the Internet between at least two VPN connection devices, and at least two LANs connected to these VPN connection devices form one LAN. The VPN connection apparatus according to the present embodiment is configured as follows in order to simplify the VPN setting.

  A private IP address is assigned to the GW side (hereinafter referred to as “VPN side end”) of the VPN connection device, and the GW has an IP masquerade function. That is, the GW associates the global IP address and the port number with the private IP address of the VPN connection device (hereinafter, the global IP address and the port number are collectively referred to as “access information”). Further, the VPN connection device stores such access information. Further, the VPN connection device is provided with an interface for exchanging information with the wireless terminal device. For example, this interface is compatible with short-range wireless communication, and the wireless terminal device is compatible with a mobile phone. When the user brings the wireless terminal device closer to the VPN connection device, the wireless terminal device receives access information from the VPN connection device.

  Based on a user instruction, the wireless terminal device is a wireless terminal device (hereinafter referred to as “communication target wireless device”) corresponding to a VPN connection device (hereinafter referred to as “communication target VPN device”) to be connected to the VPN connection device. To send access information. The transmission is performed via a cellular network. The communication target wireless device notifies the communication target VPN device of the received access information and transmits the access information stored in the communication target VPN device (hereinafter referred to as “destination information”) to the wireless terminal device. . The wireless terminal device notifies the received destination information to the VPN connection device, and the VPN connection device stores the destination information. The VPN connection device transmits the encapsulated data to the communication target VPN device according to the destination information, so that a VPN is constructed between the VPN connection devices. As described above, a VPN is easily constructed by operating a wireless terminal device.

  FIG. 1 shows a configuration of a VPN system 100 according to an embodiment of the present invention. The VPN system 100 includes a first NW device 10a, a second NW device 10b, a third NW device 10c, a fourth NW device 10d, a first VPN connection device 12a, a first VPN connection device 12a, 2VPN connection device 12b, first wireless terminal device 14a, generally referred to as wireless terminal device 14, second wireless terminal device 14b, first GW 16a, generally referred to as GW 16, second GW 16b, Internet 18, cellular network 20, LAN 22 A first LAN 22a, a second LAN 22b, a third LAN 22c, and a fourth LAN 22d are included.

  The Internet 18 is realized by an IP protocol, and performs data communication based on a global IP address. The Internet 18 may be a predetermined public network and may be a network shared by many users. Further, the predetermined public network may not support the IP protocol but may support other protocols. The GW 16 connects the Internet 18 and the LAN 22. That is, the public network and the private network are connected. The GW 16 has an IP masquerade function, and performs conversion between a combination of a global IP address and a port number assigned in the Internet 18 and a private IP address assigned in the LAN 22. Therefore, the GW 16 stores the combination of the global IP address and port number and the private IP address in association with each other.

  The LAN 22 is realized by an IP protocol, and executes data communication based on a private IP address or a global IP address. Here, among the LANs 22, the first LAN 22a and the second LAN 22b are formed as one LAN by VPN. On the other hand, the third LAN 22c and the fourth LAN 22d are formed as separate LANs. That is, the broadcast signal transmitted in the first LAN 22a is also transmitted in the second LAN 22b, but is not transmitted to the third LAN 22c and the fourth LAN 22d.

  The VPN connection device 12 forms a VPN on the Internet 18 and constructs a single LAN based on the first LAN 22a and the second LAN 22b. Therefore, the VPN connection device 12 connects the VPN side end to the communication target VPN connection device 12 via the VPN constructed on the Internet 18 and the other end (hereinafter referred to as “LAN side end”) to the LAN 22. Connect. For example, the first VPN connection device 12a connects the VPN side end to the third LAN 22c, and connects the LAN side end to the first LAN 22a. The first VPN connection device 12a stores access information corresponding to the VPN side end, that is, access information stored in the first GW 16a and corresponding to the private IP address of the first VPN connection device 12a. . Such access information can be said to be access information given in VPN.

  Further, the VPN connection device 12 and the wireless terminal device 14 transmit / receive information to / from each other via short-range wireless communication, for example, NFC (Near Field Communication). In addition to NFC, Bluetooth (registered trademark) or a wireless LAN may be used. With the above configuration, the first VPN connection device 12a is connected to the first GW 16a via the third LAN 22c, and further connected to the second GW 16b via the Internet 18. On the other hand, the second VPN connection device 12b is connected to the second GW 16b via the fourth LAN 22d. Note that the communication target VPN device described above corresponds to the second VPN connection device 12b.

  The wireless terminal device 14 is connected to the VPN connection device 12 by a wireless link using NFC. For example, when the wireless terminal device 14 approaches the VPN connection device 12, communication is performed between the two. The wireless terminal devices 14 are connected to each other via the cellular network 20. That is, the first wireless terminal device 14a is connected to the second wireless terminal device 14b corresponding to the second VPN connection device 12b via the cellular network 20. Here, the above-described communication target wireless device corresponds to the second wireless terminal device 14b.

  The first wireless terminal device 14a connects to the first VPN connection device 12a and the second wireless terminal device 14b, thereby providing access information corresponding to the first VPN connection device 12a and access information corresponding to the second VPN connection device 12b. Let them exchange. That is, the first wireless terminal device 14a obtains access information corresponding to the first VPN connection device 12a by connecting to the first VPN connection device 12a. Further, the first wireless terminal device 14a transmits access information to the second wireless terminal device 14b. In addition, the first wireless terminal device 14a receives access information for the second VPN connection device 12b, that is, destination information, from the second wireless terminal device 14b. The first wireless terminal device 14a transmits the acquired destination information to the first VPN connection device 12a. On the other hand, the same operation is also performed in the second wireless terminal device 14b and the second VPN connection device 12b. As a result, the VPN connection device 12 stores the destination information for the communication target VPN device, that is, the destination information of the GW 16 connected to the communication target VPN.

  The NW device 10 corresponds to a personal computer or a network camera operated by a user. The first NW device 10a is connected to the first LAN 22a, and the second NW device 10b is connected to the second LAN 22b. As a result, the first NW device 10a and the second NW device 10b are included in one LAN by VPN. On the other hand, the third NW device 10c is connected to the third LAN 22c, and the fourth NW device 10d is connected to the fourth LAN 22d. As a result, the third NW device 10c and the fourth NW device 10d are included in different LANs.

  When data is transmitted from the first NW device 10a to the second NW device 10b, the first VPN connection device 12a encapsulates the data received at the LAN side end, and based on destination information corresponding to the second VPN connection device 12b, The encapsulated data is transmitted from the VPN side end. The encapsulated data is transmitted to the second GW 16b via the third LAN 22c and the Internet 18. The second GW 16b converts the access information into a private IP address, and then transmits data to the second VPN connection device 12b. The second VPN connection device 12b decapsulates the data received from the VPN side end. That is, the encapsulated data is returned to non-encapsulated data. Further, the second VPN connection device 12b transmits the decapsulated data from the LAN side end to the second NW device 10b via the second LAN 22b. On the other hand, the same processing is performed when data is transmitted from the second NW device 10b to the first NW device 10a. As described above, the shared first LAN 22a and second LAN 22b are constructed. As a result, the first NW device 10a and the second NW device 10b are connected to the shared LAN, so that their resources are shared as necessary.

  FIG. 2 shows the configuration of the first VPN connection device 12a. The first VPN connection device 12a includes a first communication unit 30, a control unit 32, a second communication unit 34, a storage unit 36, and an acquisition unit 38. The first communication unit 30 includes a LAN communication unit 40 and a VPN communication unit 42. The second VPN connection device 12b has the same configuration.

  The VPN communication unit 42 in the first communication unit 30 corresponds to the aforementioned VPN side end. The VPN communication unit 42 is connected to the third LAN 22c in FIG. 1, and is connected to the second GW 16b in FIG. 1 through the third LAN 22c and the Internet 18. The VPN communication unit 42 is connected to the Internet 18 in FIG. 18 via the first GW 16a having a private IP address and having an IP masquerade function. The first GW 16a performs conversion between a combination of a global IP address and a port number and a private IP address. The LAN communication unit 40 corresponds to the LAN side end described above. The first communication unit 30 is connected to the first LAN 22a in FIG.

  The storage unit 36 stores address information corresponding to the VPN communication unit 42 and assigned in the first GW 16a of FIG. As described above, the address information includes a global IP address and a port number, and a global IP address and a port number corresponding to the private IP address of the VPN communication unit 42. FIG. 3A shows the structure of data stored in the storage unit 36. As shown in the figure, a global IP address column 80 and a port number column 82 are provided. Here, “A” corresponds to the aforementioned global IP address, and “B” corresponds to the aforementioned port number.

  Returning to FIG. The second communication unit 34 is connected to a first wireless terminal device 14a (not shown). As described above, since the second communication unit 34 and the first wireless terminal device 14a are connected by NFC, when the first wireless terminal device 14a is brought close to the second communication unit 34, the second communication unit 34 is connected. Are connected to the first wireless terminal device 14a. By such connection, the second communication unit 34 exchanges access information stored in the storage unit 36 and access information corresponding to a communication target VPN device (not shown). The access information here may be the destination information described above. That is, the access information stored in the storage unit 36 is transmitted to the communication target VPN device via the second communication unit 34, the first wireless terminal device 14a, and the second wireless terminal device 14b. The access information for the communication target VPN device is transmitted to the second communication unit 34 via the second wireless terminal device 14b and the first wireless terminal device 14a. The storage unit 36 stores this.

  FIG. 3B shows the structure of data stored in the storage unit 36. As shown in the figure, a VPN communication target NW device name column 84, an NW device address column 86, a communication target VPN device address column 88, a communication target VPN device port number column 90, and an e-mail address column 92 are included. In the VPN communication target NW device name column 84, the name of the communication target VPN apparatus is entered. In the communication target VPN device address column 88 and the communication target VPN device port number column 90, a global IP address and a port number corresponding to the communication target VPN device are entered. In the NW device address column 86, a private IP address for the NW device 10 which is the NW device 10 connected to the communication target VPN apparatus and is the communication target is entered. In the e-mail address column 92, the e-mail address of the wireless device to be communicated is entered. FIG. 3B is an example, and it is sufficient that at least the communication target VPN device address column 88 and the communication target VPN device port number column 90 are included.

  Returning to FIG. The control unit 32 controls the second communication unit 34 and the storage unit 36 to exchange access information and destination information between the wireless terminal device 14 (not shown) and the storage unit 36. That is, the control unit 32 receives input of access information from the second communication unit 34 and executes management such as addition / change / deletion of access information in the storage unit 36. The control unit 32 automatically detects the connection between the second communication unit 34 and the wireless terminal device 14, and executes exchange of access information when the connection is detected. In addition, the control unit 32 acquires its own access information by executing protocol communication with the first GW 16a (not shown) via the VPN communication unit 42. Further, the control unit 32 stores the acquired access information in the storage unit 36. Here, an example of protocol communication is UPnP (Universal Plug and Play).

  When the LAN communication unit 40 receives data from the first LAN 22a (not shown), the VPN communication unit 42 encapsulates the received data. The VPN communication unit 42 adds destination information corresponding to the communication target VPN device stored in the storage unit 36 to the encapsulated data. Finally, the VPN communication unit 42 transmits the encapsulated data to the third LAN 22c (not shown). On the other hand, when the VPN communication unit 42 receives data from the third LAN 22c (not shown), the VPN communication unit 42 decapsulates the received data. The LAN communication unit 40 transmits the decapsulated data to the first LAN 22a (not shown).

  The acquisition unit 38 acquires the address information corresponding to the communication target VPN device and the address information given to the first GW 16a via the VPN communication unit 42 after the VPN connection. That is, the acquisition unit 38 acquires the latest values such as the global IP address corresponding to the communication target VPN apparatus and the global IP address assigned to the first GW 16a by periodically performing protocol communication. If the address information acquired in the acquisition unit 38 is different from the access information stored in the storage unit 36, the control unit 32 updates the access information stored in the storage unit 36 with the access information acquired in the acquisition unit 38. . That is, the control unit 32 detects the update of the access information by comparing the access information stored in the storage unit 36 with the acquired access information. When an update is detected, the control unit 32 writes new access information in the storage unit 36. Furthermore, the control unit 32 also accesses the communication target VPN device via the VPN communication unit 42 and instructs to update the access information.

  This configuration can be realized in terms of hardware by a CPU, memory, or other LSI of any computer, and in terms of software, it is realized by a program having a communication function loaded in the memory. Describes functional blocks realized by collaboration. Accordingly, those skilled in the art will understand that these functional blocks can be realized in various forms by hardware only, software only, or a combination thereof.

  FIG. 4 shows the configuration of the first wireless terminal device 14a. The first wireless terminal device 14a includes a control unit 50, a first communication unit 52, a second communication unit 54, a reception unit 56, a display unit 58, and a storage unit 60. The second wireless terminal device 14b has the same configuration.

  The 1st communication part 52 connects with the 1st VPN connection apparatus 12a which is not shown in figure. As described above, the connection is realized by NFC, and access information is transmitted to and received from the first VPN connection device 12a. The control unit 50 controls communication in the first communication unit 52. The control unit 50 causes the first communication unit 52 to receive access information from the first VPN connection device 12a. Thereafter, the control unit 50 stores the received access information in the storage unit 60 described later. In addition, the control unit 50 causes the first communication unit 52 to transmit the access information stored in the storage unit 60 to the first VPN connection device 12a. At that time, the access information stored in the storage unit 60 includes access information of the communication target VPN device. Such access information of the communication target VPN device is acquired by the second communication unit 54 described later.

  The second communication unit 54 connects to the communication target wireless device via the cellular network 20 (not shown). The second communication unit 54 transmits access information to the communication target wireless device and receives the access information from the communication target wireless device. When transmitting the access information, the second communication unit 54 executes transmission based on the email address of the communication target device. Note that a software program installed in the first wireless terminal device 14a may be used for exchanging access information.

  The storage unit 60 stores a list of destinations of communication target wireless devices to be connected to the second communication unit 54, that is, a list of email addresses. FIG. 5 shows the structure of data stored in the storage unit 60. As shown, a group column 94 and a VPN communication target NW device name column 96 are included. In the group column 94, a combination of NW devices 10 for which a VPN is to be constructed is entered. In the VPN communication target NW device name column 96, the name of the NW device 10 belonging to a predetermined group is entered. In addition, in the VPN communication target NW device name column 96, the name of the user may be entered instead of the NW device 10. Here, data similar to that shown in FIG. 3B may be stored in the storage unit 60. As a result, the NW device 10 and the communication target VPN device are associated with the email addresses of the communication target wireless devices. Furthermore, the storage unit 60 also stores address information corresponding to the first VPN connection device 12a (not shown).

  Returning to FIG. The reception unit 56 includes buttons and receives instructions from the user. That is, the reception unit 56 corresponds to an interface for the user. The control unit 50 controls communication in the second communication unit 54 in addition to the processing described above. As the transmission process, the control unit 50 causes the second communication unit 54 to transmit access information to the communication target wireless device according to the instruction received by the reception unit 56. The access information corresponds to the access information received by the first communication unit 52. Here, the transmission process of access information will be specifically described. The reception unit 56 receives an instruction to start a predetermined application from the user. The control unit 50 causes the display unit 58 to display a list of communication targets stored in the storage unit 60 in accordance with the received instruction. The list of communication targets may be the name of the user or the name of the NW device 10.

  The list of communication targets is displayed in units of groups. The receiving unit 56 receives an instruction for selecting one of the lists from the user. This corresponds to an instruction to add or leave the communication target VPN device. The control unit 50 selects an email address stored in the storage unit 60 based on the selection instruction. Furthermore, the control unit 50 controls the second communication unit 54 to transmit the access information stored in the storage unit 60 with the selected e-mail address as the destination. The control unit 50 transmits access information and requests the communication target wireless device to transmit access information.

  On the other hand, as the reception process, the control unit 50 causes the second communication unit 54 to receive access information from the communication target wireless device, that is, destination information. Further, the control unit 50 stores the received access information in the storage unit 60. That is, the control unit 50 adds the obtained access information to the storage unit 60. The request for transmission of the access information here, the acquisition of the access information, and the sharing of the access information among the members of the group can be performed using, for example, an application on the wireless terminal device 14 and the cellular network 20.

  As described above, the control unit 50 controls communication between the first communication unit 52 and the second communication unit 54, while the first VPN connection device 12a connected to the first communication unit 52 and the communication target VPN device. And share access information corresponding to each. Further, when a new member is added from the accepting unit 56, the control unit 50 stores the access information newly obtained as described above and the NW device 10 in the storage unit 60 while associating them. On the other hand, when the member 50 is instructed to leave the NW device 10, the control unit 50 deletes the access information of the member from the storage unit 60. Furthermore, the control unit 50 notifies the communication target wireless devices of other members about the deleted contents via the second communication unit 54. Similar processing is executed in the communication target wireless devices of other members.

  FIG. 6 is a sequence diagram showing a VPN setting procedure in the VPN system 100. The first wireless terminal device 14a and the second wireless terminal device 14b communicate via the cellular network 20 (S10). Through this communication, the construction of the VPN between the first VPN connection device 12a and the second VPN connection device 12b is determined. Note that the communication may be voice communication, e-mail or a predetermined application. When the first wireless terminal device 14a is brought closer to the first VPN connection device 12a, a wireless link is established between them, and the first wireless terminal device 14a transmits an access information request to the first VPN connection device 12a (S12). . The first VPN connection device 12a transmits access information to the first wireless terminal device 14a (S14). The first wireless terminal device 14a transmits access information to the second wireless terminal device 14b (S16).

  When the second wireless terminal device 14b is brought close to the second VPN connection device 12b, a wireless link is established between them, and the second wireless terminal device 14b notifies the second VPN connection device 12b of the received access information. At the same time, an access information request is transmitted (S18). The second VPN connection device 12b stores the notified access information (S20). The second VPN connection device 12b transmits access information to the second wireless terminal device 14b (S22). The second wireless terminal device 14b transmits access information to the first wireless terminal device 14a (S24). The first wireless terminal device 14a notifies the received access information to the first VPN connection device 12a (S26). The first VPN connection device 12a stores the notified access information (S28).

  FIG. 7 is a sequence diagram showing a communication procedure in the VPN system 100. The first NW device 10a transmits data with the second NW device 10b as a destination (S50). The first VPN connection device 12a encapsulates the data (S52). The first VPN connection device 12a transmits the encapsulated data with the global IP address corresponding to the second GW 16b and the port number corresponding to the second VPN connection device 12b as destinations (S54). The second GW 16b converts the global IP address and port number added to the received data into a private IP address (S56). The private IP address corresponds to the private IP address assigned to the second VPN connection device 12b. The second GW 16b transmits data with the converted private IP address as the destination (S58). The second VPN connection device 12b decapsulates the received data (S60). Further, the second VPN connection device 12b transmits the decapsulated data to the second NW device 10b (S62).

  The second NW device 10b transmits data with the first NW device 10a as a destination (S64). The second VPN connection device 12b encapsulates the data (S66). The second VPN connection device 12b transmits the encapsulated data with the global IP address corresponding to the first GW 16a and the port number corresponding to the first VPN connection device 12a as destinations (S68). The first GW 16a converts the global IP address and port number added to the received data into a private IP address (S70). The first GW 16a transmits data with the converted private IP address as the destination (S72). The first VPN connection device 12a decapsulates the received data (S74). Further, the first VPN connection device 12a transmits the decapsulated data to the first NW device 10a (S76).

  FIG. 8 is a flowchart showing a procedure for updating access information in the VPN connection device 12 and the wireless terminal device 14. The control unit 32 detects the connection between the second communication unit 34 and the wireless terminal device 14 (S90). If the connection is detected (Y in S90), the control unit 32 updates the access information stored in the storage unit 36 and the wireless terminal device 14 to the latest information (S92). Further, the control unit 32 stores the latest access information in the storage unit 36. On the other hand, if the connection is not detected (N in S90), the first communication unit 30 ends the process.

  FIG. 9 is a flowchart showing a procedure for updating access information in the VPN connection device 12. The acquisition unit 38 acquires access information for the VPN connection device 12 via the VPN communication unit 42 (S100). Here, the access information includes its own access information and destination information of the communication target VPN device. The control unit 32 compares the access information acquired by the acquisition unit 38 with the access information stored in the storage unit 36 (S102). If they are different (Y in S104), the control unit 32 updates the access information stored in the storage unit 36 with the access information acquired by the acquisition unit 38 (S106). If they are not different (N in S104), the control unit 32 ends the process.

  The operation of the VPN system 100 configured as above will be described. The user consults with a member who wishes to communicate while establishing the VPN while using the wireless terminal device 14. This may be done by phone call, email, or by an application such as chat. The user activates an application in the wireless terminal device 14 in order to establish a VPN. FIG. 10 shows a screen for instructing connection with the VPN connection device 12 on the display unit 58. When the user activates the application, an instruction “Please touch the VPN connection device” is displayed on the display unit 58 as shown in FIG. The user causes the wireless terminal device 14 to touch the VPN connecting device 12 while bringing the wireless terminal device 14 close to the VPN connecting device 12. As a result, access information for the VPN connection device 12 is input to the wireless terminal device 14.

  The user designates a communication target wireless device to which access information should be transmitted while using an application in the wireless terminal device 14. This corresponds to the wireless terminal device 14 of the member who consulted the construction of the VPN described above. FIG. 11 shows a screen for displaying the member list on the display unit 58. As illustrated, names of members included in the group α are displayed on the display unit 58. The user selects “Mr. X” among the members while using the reception unit 56. FIG. 12 shows a screen for confirming transmission of access information on display unit 58. Since it is asked whether the access information is transmitted to the selected “Mr. X”, the user selects “OK” or “Cancel” while using the reception unit 56. Note that the user may select a wireless device to be communicated by performing a concept search on the address book or searching for an e-mail address. Further, a plurality of communication target wireless devices may be selected.

  When the wireless terminal device 14 receives an electronic mail from the communication target wireless device, the user opens the received mail in the wireless terminal device 14. The received mail includes a “designated portion” linked to access information for the communication target VPN device. FIG. 13 shows a screen for displaying the content of the received email on the display unit 58. “Access information” in the figure corresponds to “specified portion”. The user clicks the “designated part” in the received mail to link the access information to the application and store the access information in the storage unit 60 of the wireless terminal device 14. The user causes the wireless terminal device 14 to touch the VPN connecting device 12 while bringing the wireless terminal device 14 close to the VPN connecting device 12 again. As a result, access information for the communication target VPN device is input to the VPN connection device 12. Further, the user may group communication target VPN devices while using an application in the wireless terminal device 14.

  In addition, when participating in a VPN connection already established by another member, the user acquires the access information for the VPN connection device 12 as described above while using the wireless terminal device 14 and transmits it to the group member. . The recipient touches the recipient's VPN connection device 12 while adding to the group while operating the application in the recipient's wireless terminal device 14.

  When leaving the VPN connection, the user selects a leave button in the application while using the application in the wireless terminal device 14. At that time, a VPN connection member may be automatically notified by e-mail. The user causes the wireless terminal device 14 to touch the VPN connecting device 12 while bringing the wireless terminal device 14 close to the VPN connecting device 12. The VPN connection devices 12 automatically execute handles, and erase access information from the storage unit 36. Alternatively, each member of the VPN connection selects an object to be removed by an application in the wireless terminal device 14, and touches the wireless terminal device 14 on the VPN connection device 12, thereby erasing access information for the person to be removed. May be.

  When the VPN connection is finally released, the user selects a group in the application in the wireless terminal device 14 and then selects a batch delete button. Further, the user causes the wireless terminal device 14 to touch the VPN connecting device 12 while bringing the wireless terminal device 14 close to the VPN connecting device 12. As a result, the access information in the wireless terminal device 14 is deleted. The wireless terminal device 14 may be provided with an LED, there may be no access information, and lighting may be performed according to the completion of the change.

  A modification of this embodiment will be described. Up to now, each user has independently performed VPN connection, but here, a case will be described in which VPN connection is made based on an instruction from an administrator. In the phase where the VPN connection is consulted and accepted, the manager designates the connection time for each member. Each member understands this. For this purpose, the administrator creates a group by an application in the wireless terminal device 14 and broadcasts the designation of the connection time to each member included in the group. At that time, a return of access information is requested. Upon receiving the access information return request from the administrator, each member activates an application in the wireless terminal device 14 and touches the VPN connection device 12 to access the wireless terminal device 14. Read information.

  Each member transmits the read access information from the respective wireless terminal device 14 to the administrator's wireless terminal device 14. The administrator groups the access information by the application in the wireless terminal device 14. Further, the administrator opens the received mail and clicks “designated portion” to store the access information in the wireless terminal device 14. When the access information of the target member is obtained, the administrator transmits this as group information to the wireless terminal device 14 of each member. Each member writes group information by an application in the wireless terminal device 14. Finally, the manager and each member touch the wireless terminal device 14 on the VPN connection device 12 to write the grouped access information to each VPN connection device 12.

  In addition, when participating in a VPN connection already established by another member, the user acquires the access information for his VPN connection device 12 as described above while using the wireless terminal device 14 and transmits it to the administrator. . The administrator creates a new group list by an application in the wireless terminal device 14 and transmits the new group list to the wireless terminal device 14 of each member. Each member and administrator touch the wireless terminal device 14 on the VPN connection device 12.

  When leaving the VPN connection, the user selects a leave button in the application while using the application in the wireless terminal device 14. At that time, the manager may be automatically notified by e-mail. The administrator creates a new group list by an application in the wireless terminal device 14 and transmits the new group list to the wireless terminal device 14 of each member. Each member and administrator touch the wireless terminal device 14 on the VPN connection device 12.

  According to the embodiment of the present invention, access information for connecting the VPN is exchanged between the VPN connection devices via the wireless terminal device, so that the direct operation of the VPN connection device by the user can be omitted and simplified. VPN can be built. Further, a VPN can be constructed between VPN connection devices based on access information to the VPN connection device to be communicated. In addition, a VPN can be easily constructed by specifying a communication partner by an application such as a familiar wireless terminal device without requiring a complicated operation / procedure by a personal computer or the like. When short-range wireless communication is used for communication between the wireless terminal device and the VPN connection device, the wireless terminal device can be simply “touched” on the VPN connection device, depending on the time, place, communication partner, and device. VPN can be flexibly constructed. Also, it is not necessary to install a server system on the network for managing the access information of the VPN connection device, and the VPN becomes unusable due to a failure of the server system or an intentional service stop due to the circumstances of the maintenance manager. Etc. can be solved.

  Further, even in an environment in which a GW having an IP masquerade function is provided in advance, a VPN can be easily constructed by connecting a virtual private network connection device to the GW. Moreover, since the update of access information can be detected automatically, it can respond to the update of access information. In addition, when the access information in the GW is changed, the latest access information of the entire VPN is autonomously associated therewith, so that useless access traffic due to invalid access information can be reduced. Further, when the connection between the wireless terminal device and the VPN connection device is detected, the exchange of access information is automatically executed, so that the convenience for the user can be improved. Further, in the wireless terminal device, the user can be selected from a list stored in advance, so that the convenience of the user can be improved. Further, since access information for each VPN connection device belonging to the group member is acquired and shared among the members, it is possible to manage participation in and withdrawal from the VPN connection. Moreover, the convenience of the user who participates in a VPN connection can be improved because an administrator performs management of a group.

  In the above, this invention was demonstrated based on the Example. This embodiment is an exemplification, and it will be understood by those skilled in the art that various modifications can be made to the combination of each component and each processing process, and such modifications are also within the scope of the present invention. .

  In the embodiment of the present invention, the VPN connection device 12 and the GW 16 are configured as separate devices. However, the present invention is not limited to this. For example, the VPN connection device 12 and the GW 16 may be configured integrally. That is, the VPN communication unit 42 of the VPN connection device 12 may have an IP masquerade function. At this time, the storage unit 36 stores the global IP address and port number assigned to the VPN communication unit 42 as access information. According to this modification, another installation of the GW 16 can be made unnecessary. That is, the global IP address and the private IP address need only be converted.

It is a figure which shows the structure of the VPN system which concerns on the Example of this invention. It is a figure which shows the structure of the 1st VPN connection apparatus of FIG. FIGS. 3A and 3B are diagrams showing the structure of data stored in the storage unit of FIG. It is a figure which shows the structure of the 1st radio | wireless terminal apparatus of FIG. It is a figure which shows the structure of the data memorize | stored in the memory | storage part of FIG. It is a sequence diagram which shows the procedure of the setting of VPN in the VPN system of FIG. It is a sequence diagram which shows the procedure of communication in the VPN system of FIG. 3 is a flowchart showing a procedure for updating access information in the VPN connection device and the wireless terminal device of FIG. 1. It is a flowchart which shows the procedure of the update of the access information in the VPN connection apparatus of FIG. FIG. 5 is a diagram showing a screen for instructing a connection with a VPN connection device on the display unit of FIG. 4. FIG. 5 is a diagram showing a screen for displaying a member list on the display unit of FIG. 4. FIG. 5 is a diagram showing a screen for confirming transmission of access information on the display unit of FIG. 4. FIG. 5 is a diagram showing a screen for displaying the content of a received email on the display unit of FIG.

Explanation of symbols

10 NW equipment, 12 VPN connection device, 14 wireless terminal device, 16 GW, 18 Internet, 20 cellular network, 22 LAN, 30 first communication unit, 32 control unit, 34 second communication unit, 36 storage unit, 38 acquisition unit , 40 LAN communication unit, 42 VPN communication unit, 100 VPN system.

Claims (9)

A first communication unit that connects one end to a local private network while connecting one end to a virtual private network connection device to be communicated via a virtual private network;
A storage unit that stores identification information that corresponds to one end of the first communication unit and that is assigned in the virtual private network;
In order to exchange the identification information stored in the storage unit and the identification information corresponding to the virtual private network connection device to be communicated, a wireless terminal device corresponding to the virtual private network connection device to be communicated via the wireless network; A second communication unit for connecting a wireless terminal device to communicate;
A wireless terminal device connected to the second communication unit, and a control unit that exchanges identification information between the storage unit,
The first communication unit encapsulates data received from the other end side, and transmits from one end side based on identification information corresponding to the virtual private network connection device to be communicated stored in the storage unit; And a means for decapsulating data received from one end side and transmitting the data from the other end side. The virtual private network is built on an IP network;
One end side of the first communication unit has a private IP address and is connected to a virtual private network connection device to be communicated through a gateway having an IP masquerade function,
The storage unit stores, as identification information, a global IP address and a port number assigned to the gateway, and a global IP address and a port number corresponding to a private IP address on one end of the first communication unit. The virtual private network connection device according to claim 1, wherein: The virtual private network is built on an IP network;
The first communication unit has an IP masquerade function for a global IP address and port number on one end side, and a private IP address on the other end side,
The virtual private network connection device according to claim 1, wherein the storage unit stores a global IP address and a port number assigned to one end of the first communication unit as identification information. An acquisition unit for acquiring identification information via one end of the first communication unit;
If the identification information acquired in the acquisition unit is different from the identification information stored in the storage unit, an update unit that updates the identification information stored in the storage unit with the identification information acquired in the acquisition unit;
The virtual private network connection device according to claim 1, further comprising: A detection unit for detecting a connection between the second communication unit and the wireless terminal device;
The virtual private network connection device according to claim 1, wherein when the connection is detected by the detection unit, the control unit exchanges identification information. A first communication unit connected by a wireless link to a virtual private network connection device that connects one end to a local private network while connecting one end to a communication target virtual private network connection device via a virtual private network;
A second communication unit for connecting via a wireless network to a wireless terminal device corresponding to a virtual private network connecting device to be communicated to which the virtual private network connecting device is to be connected via the virtual private network;
While performing communication in the first communication unit and the second communication unit, between the virtual private network connection device connected to the first communication unit and the virtual private network connection device to be communicated, respectively A control unit that corresponds to the identification information and shares the identification information given in the virtual private network;
A wireless terminal device comprising: A storage unit for storing a list of destinations of wireless terminal devices to which the second communication unit is to be connected;
A reception unit that receives an instruction to select any of the lists stored in the storage unit;
The wireless terminal device according to claim 6, wherein the control unit causes the second communication unit to transmit identification information to a wireless terminal device according to an instruction received by the reception unit. Via the virtual private network, one end is connected to the virtual private network connection device to be communicated, and the other end is connected to the local network, and identification information corresponding to the one end is provided in the virtual private network. A virtual private network connection device for storing the obtained identification information;
A means for connecting to a virtual private network connection device via a wireless link and a wireless terminal device corresponding to a virtual private network connection device to be connected to which the virtual private network connection device is connected via a wireless network A wireless terminal device including means for performing
The wireless terminal device is connected to a virtual private network connection device and a wireless terminal device corresponding to the virtual private network connection device to be communicated, thereby identifying information corresponding to the virtual private network connection device and a virtual private network to be communicated. Exchange identification information corresponding to the network connection device,
The virtual private network connection device encapsulates the data received from the other end side, and transmits from one end side based on the identification information of the virtual private network connection device to be communicated, and the data received from the one end side And a means for transmitting from the other end side while decapsulating the virtual private network system. Via the virtual private network, one end is connected to the virtual private network connection device to be communicated, and the other end is connected to the local network, and identification information corresponding to the one end is provided in the virtual private network. A wireless terminal device acquiring identification information via a wireless link for a virtual private network connection device that stores the identified information;
The wireless terminal device transmits the acquired identification information via the wireless network to the wireless terminal device corresponding to the communication target virtual private network connecting device to be connected to the virtual private network connecting device;
The wireless terminal device receives identification information corresponding to the virtual private network connection device to be communicated from the wireless terminal device corresponding to the virtual private network connection device to be communicated via the wireless network;
The wireless terminal device notifying the virtual private network connection device of identification information corresponding to the virtual private network connection device to be communicated via a wireless link;
A step of performing communication between the virtual private network connection device and the virtual private network connection device to be communicated based on the identification information;
A virtual private network connection method comprising:

Images