JP2007049499A - Communication method and apparatus - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To provide a communication method and apparatus for ensuring a communication path in the case that a NAT function is installed for IP communication between a terminal in a LAN being a closed network configured by private addresses and a terminal at the outside of the LAN. <P>SOLUTION: The communication apparatus connected to a network device with the NAT function and terminals in a LAN includes: a means for setting the private address; a means for allocating a virtual IP address to the terminal; and a means that converts the virtual IP address written in a sender address of an IP packet received from the terminal into the private address set to the communication apparatus itself, and converts the virtual IP address of a destination terminal written in the destination address of the IP packet into a global address set to the network device for providing the NAT function to the destination terminal. <P>COPYRIGHT: (C)2007,JPO&INPIT

Description

  The present invention relates to a communication method and apparatus, and more specifically, a NAT function is implemented in IP communication between a terminal in a LAN, which is a closed network configured using a private address, and a terminal outside the LAN. The present invention relates to a communication method and apparatus for securing a communication path when there is an error.

  In recent years, due to the increase in computers connected to the Internet, the problem of lack of IP addresses has become prominent. Therefore, a NAT (Network Address Translator) function is used as one method for solving the shortage of IP addresses. The NAT function performs address conversion in order to perform communication between a client having a private address in a LAN, which is a closed network, and a host computer having a global address in the Internet.

  FIG. 1 shows a network connection diagram for explaining the NAT function. A private address A and a global address M are assigned to the client 11. The router 13 has a NAT function and stores a conversion table for converting a private address to a global address. Here, the IP packet is transmitted from the client 11 to the host 12 (global address N) in the Internet via the routers 13 and 14. In the header of the IP packet transmitted from the client 11, “N” is written as the destination address 21 and “A” is written as the source address 22, and “200” is set as the destination port number 23 in the TCP header. “100” is written as the number 24. The router 13 refers to the conversion table, converts the private address A of the source address 22 to the global address M, and transmits the packet to the router 14.

  Next, an IP packet is transmitted from the host 12 to the client 11 via the routers 14 and 13. “M” as the destination address 31 and “N” as the source address 32 are written in the header of the IP packet transmitted from the host 12, and “100” is set as the destination port number 33 in the TCP header. “200” is written as the number 34. The router 13 refers to the conversion table, converts the global address M of the destination address 31 to the private address A, and transmits the packet toward the client 11 in the LAN.

JP 2005-117487 A

  When the NAT function is implemented in IP communication with a client (terminal) in a LAN that is a closed network configured using a private address, the client (terminal) from the (terminal) such as a host computer outside the LAN There was a problem that could not be connected to.

  The present invention has been made in view of such problems, and its object is to provide IP communication between a terminal in a LAN, which is a closed network configured using a private address, and a terminal outside the LAN. The present invention provides a communication method and apparatus for securing a communication path when a NAT function is implemented.

  In order to achieve such an object, the present invention provides a network system configured using a private address, wherein the invention is connected to a network device having a NAT function and a terminal. In a communication apparatus for securing a communication path for IP communication with respect to a terminal outside the network, means for setting the private address, means for assigning a virtual IP address to the terminal, and IP received from the terminal The virtual IP address assigned to the terminal written in the source address of the packet is converted into the private address set in the communication device, and the destination terminal written in the destination address of the IP packet received from the terminal Of the virtual IP address of the network providing the NAT function to the destination terminal. Characterized by comprising a means for converting the set global address to the click device.

  The invention described in claim 3 is connected to a network device having a NAT function and a terminal in a network configured using a private address, and a communication path for IP communication between the terminal and the outside of the network. In the communication method for securing, the step of setting the private address, the step of assigning a virtual IP address to the terminal, and the terminal assigned to the source address of the IP packet received from the terminal The virtual IP address is converted into the private address set in the communication device, and the destination terminal's virtual IP address written in the destination address of the IP packet received from the terminal is provided with the NAT function to the destination terminal. To the global address set for the network device Characterized in that it comprises the step of conversion.

  According to a sixth aspect of the present invention, there is provided a terminal connected to a network device having a NAT function in a network configured using a private address, the means for setting the private address and the virtual IP address, The virtual IP address assigned to the terminal written in the source address of the IP packet transmitted from the application is converted into the private address set in the terminal, and the destination address of the IP packet received from the application And a means for converting the written virtual IP address of the destination terminal into a global address set in a network device that provides a NAT function to the destination terminal.

  According to the seventh aspect of the invention, in a terminal connected to a network device having a NAT function in a network configured using a private address, a communication path for IP communication with respect to the outside of the network for the terminal is secured. In the communication method, the step of setting the private address and virtual IP address, and the virtual IP address assigned to the terminal written in the source address of the IP packet transmitted from the application of the terminal, The virtual IP address of the destination terminal that is converted into the private address set in the terminal and written in the destination address of the IP packet received from the application is the global IP set in the network device that provides the NAT function to the destination terminal. Convert to address Characterized in that it comprises a step.

  As described above, according to the present invention, when the NAT function is implemented in IP communication between a terminal in a LAN, which is a closed network configured using a private address, and a terminal outside the LAN. A communication method and apparatus for securing a communication path can be provided.

Hereinafter, embodiments of the present invention will be described in detail with reference to the drawings.
In the drawings described below, components having the same function are denoted by the same reference numerals, and repeated description thereof is omitted.
A communication apparatus according to an embodiment of the present invention (hereinafter also referred to as a VPN (Virtual Private Network) forming apparatus) is connected to a terminal in a LAN and a network device such as a router that provides a NAT function.

  The VPN forming apparatus assigns a communication IP address (hereinafter also referred to as a virtual IP address) to a terminal in the LAN. In one embodiment, the virtual IP address is assigned to the terminal in the LAN by the VPN forming device using DHCP (Dynamic Host Configuration Protocol).

  The VPN forming device provides a routing function for IP packets related to the virtual IP address.

  In one embodiment, the range of virtual IP addresses that the VPN forming device assigns to the terminals in the LAN can be determined in advance for each VPN forming device and stored in the storage device in the device. In other words, the VPN forming device can assign and reassign virtual IP addresses to terminals in the LAN within the range of virtual IP addresses stored in the storage device.

  In another embodiment, the VPN forming device can be configured to query the session management server for a virtual IP address to be assigned to a terminal in the LAN. That is, the VPN forming device can assign a virtual IP address determined by the session management server to a terminal in the LAN. In yet another embodiment, the session management server may determine a range of virtual IP addresses and notify the VPN forming apparatus. In other words, the session management server can determine the range of virtual IP addresses that the VPN forming device assigns to the terminals in the LAN according to the scale of the LAN. A virtual IP address can be assigned to each terminal.

  Further, in another embodiment, the VPN forming device can inquire other VPN forming devices about the virtual IP address to be assigned to the terminal in the LAN.

  Furthermore, the function of the VPN forming apparatus can be implemented as a communication module (VPN forming module) that implements software.

(First embodiment)
FIG. 2 shows a network to which the communication apparatus (VPN forming apparatus) according to the first embodiment of the present invention is applied.

  A network 200 shown in FIG. 2 includes a session management server 210, a router 241, and a router 242, each connected to a WAN that is a wide area communication network, and a VPN forming device 221 connected to the router 241, the terminal 231, and the terminal 232, A VPN forming apparatus 222 connected to the router 242 and the terminal 233 is included. A VPN is formed between the terminal 231 and the terminal 232 and the terminal 233, that is, a communication path is secured.

  Router 241, terminals 231 and 232, and VPN forming device 221 form a LAN (hereinafter also referred to as LAN 1). Similarly, the router 242, the terminal 233, and the VPN forming device 222 form a LAN (hereinafter also referred to as LAN2).

  The router 241 is installed at the boundary between the WAN (Internet) and the LAN 1 and has a global IP address x. x. x. x and private address 192.168.0.1 are set. Similarly, the router 241 is installed at the boundary between the WAN (Internet) and the LAN 2 and has a global IP address y. y. y. y and private address 192.168.1.1 are set.

  The routers 241 and 242 provide DHCP services for assigning private addresses to the terminals forming the LAN1 and LAN2, respectively. The routers 241 and 242 provide the NAT function described above to the terminals forming the LAN1 and the LAN2, respectively.

  The VPN forming device 221 is set with a private address 192.168.0.2 assigned by the DHCP service provided by the router 241. However, the private address 192.168.0.2 may be set in the VPN forming apparatus 221 by a method other than the DHCP service provided by the router 241. Therefore, the VPN forming device 221 is positioned as one terminal device in the LAN 1 for the router 241.

  The VPN forming device 221 provides a DHCP service to the terminals 231 and 232 and assigns a virtual IP address.

  Furthermore, the VPN forming device 221 has a routing function for IP packets in IP communication with the terminal 231 or 232 using a virtual IP address.

  Similarly, in the VPN forming apparatus 222, a private address 192.168.1.2 assigned by the DHCP service provided by the router 242 is set. Therefore, for the router 242, the VPN forming device 222 is positioned as one terminal device in the LAN2.

  The VPN forming apparatus 222 provides a DHCP service to the terminal 233, assigns a virtual IP address, and has a function of routing an IP packet in IP communication with the terminal 233 using the virtual IP address.

  The session management server 210 manages the virtual IP address assigned to the terminal in the LAN by the VPN forming device and information related to routing between the terminals set with the virtual IP address. For example, a virtual IP address that can be assigned to a terminal in the LAN by the VPN forming apparatus can be answered in response to an inquiry from the VPN forming apparatus. In addition, the session management server 210 provides information relating to routing between terminals set with virtual IP addresses in different LANs to the VPN forming apparatus.

  Therefore, information regarding routing between terminals set with virtual IP addresses can be obtained from the session management server 210, and the VPN forming apparatus can generate a routing table. Alternatively, the session management server 210 provides a routing table as information regarding routing between terminals to which virtual IP addresses are set, and the VPN forming apparatus holds part or all of the routing table provided from the session management server 210. You may do it.

  A virtual IP address space assigned to a terminal in the LAN and a routing table of IP packets using these virtual IP addresses may be set in advance in the VPN forming apparatus.

  The terminal 231 exemplifies NAS (Network Attached Storage), and the virtual IP address 10.0.0.1 assigned by the VPN forming device 221 is set. The terminal 232 exemplifies a personal computer (PC), and a virtual IP address 10.0.0.2 assigned by the VPN forming device 221 is set. The terminal 233 exemplifies a personal computer (PC), and a virtual IP address 10.0.0.3 assigned by the VPN forming device 222 is set.

Here, the assignment of the virtual IP address will be described using the VPN forming apparatus 221 as an example.
When a virtual IP address preset in a setting file in the VPN forming device 221 is acquired and assigned to the terminal 232, the VPN forming device 221 uses the virtual IP address “10.0. 0.2 ”is acquired and assigned to the terminal 232. Next, the VPN forming device 221 acquires the port number “100” and the global address “XX.X.X” set in the conversion table of the inquiry router from the router 241 and stores them in the RAM. Then, the VPN forming device 221 transmits the socket (port number “100” + virtual IP address “10.0.0.2” + global address “XX.X”) to the session management server 210 and stores it. .

  When acquiring the virtual IP address from the session management server 210 and assigning it to the terminal 232, the VPN forming device 221 acquires its own port number “100” set in the conversion table of the inquiry router from the router 241, and the RAM To store. The VPN forming device 221 requests the session management server 210 to allocate a virtual IP address for the port number “100”. The VPN forming device 221 then has a socket (port number “100” + virtual IP address “10.0.0.2” + global address “XX.X.X”) stored in the session management server 210 in advance. To get. The VPN forming device 221 acquires the virtual IP address “10.0.0.2” and the global address “XX.X.X” from the acquired socket, and stores them in the RAM. The VPN forming device 221 assigns the acquired virtual IP address “10.0.0.2” to the terminal 232.

  When a virtual IP address is acquired by communication between VPN forming apparatuses and assigned to the terminal 232, the VPN forming apparatus 221 recognizes a free virtual IP address in a predetermined virtual IP address space. When the VPN forming apparatuses communicate with each other, a virtual IP address may be assigned to the VPN forming apparatus, and communication may be performed by designating the virtual IP address. By doing in this way, for example, the VPN forming device 221 can handle the communication between the VPN forming devices in the same way as the communication between the terminal 232 and the terminal 233 described below. Communication between virtual IP addresses is performed by setting up a session over NAT and firewall over a commercially available SDK or the like and tunneling packets over the session. The VPN forming device 221 acquires the youngest virtual IP address (in this example, “10.0.0.2”) among the free virtual IP addresses and stores it in the RAM. Then, the VPN forming device 221 acquires the port number “100” and the global address “XX.X.X” set in the conversion table of the inquiry router from the router 241 and stores them in the RAM. The VPN forming device 221 transmits the socket (port number “100” + virtual IP address “10.0.0.2” + global address “XX.X”) to the session management server 210 and stores it.

Next, IP communication between the terminal 232 and the terminal 233 shown in FIG. 2 will be described with reference to FIG.
As shown in FIG. 3A, the terminals 232 and 233 are assigned a virtual IP address SA (10.0.0.2) and a virtual IP address DA (10.0.0.3), respectively. .

  A private address SB (192.168.0.2) and a private address DB (192.168.1.2) are assigned to the VPN forming apparatuses 221 and 222, respectively. The VPN forming apparatuses 221 and 222 store routing tables for routing IP packets related to the virtual IP address, respectively. In the routing table, for example, communication with the virtual IP address SA (10.0.0.2) and the virtual IP address DA (10.0.0.3) may be set individually, that is, for each virtual IP address. It can also be set using the network address part of the virtual IP address.

  The routers 241 and 242 are assigned a global address SM (xx.x.x) and a global address DM (y.y.y.y), respectively. The routers 241 and 242 have a NAT function and store conversion tables for converting private addresses to global addresses.

  Here, an IP packet is transmitted from the terminal 232 in the LAN 1 to the terminal 233 in the LAN 2 via the VPN forming device 221, the routers 241, 242, and the VPN forming device 222.

  As shown in FIG. 3B, “DA” is written as the destination address 21 and “SA” is written as the source address 22 in the header of the IP packet transmitted from the terminal 232, and the destination port is written in the TCP header. “200” is written as the number 23, and “100” is written as the source port number 24.

  When the VPN forming apparatus 221 detects reception of a packet, the VPN forming apparatus 221 determines whether the received packet is a packet addressed to a terminal for which a virtual IP address is set. In other words, the VPN forming device 221 determines that the IP address in the network segment unique to the virtual IP address (eg, 10.0.0.0/8) is set as the destination address of the IP header of the received packet. The IP address is determined to be a virtual IP address, and the received packet is determined to be a packet addressed to the terminal for which the virtual IP address is set.

  The VPN forming device 221 refers to the routing table, converts the virtual IP address SA of the source address 22 to the private address SB, converts the virtual IP address DA of the destination address 21 to the global address DM, and sends it to the router 241. Send the packet.

  The router 241 refers to the conversion table, converts the private address SB of the transmission source address 22 to the global address SM, and transmits the packet toward the router 242.

  The router 242 refers to the conversion table, converts the global address DM of the destination address 21 into the private address DB, and transmits the packet toward the VPN forming device 222.

  The VPN forming device 222 refers to the routing table, converts the global address SM of the source address 22 into the virtual IP address SA, converts the private address DB of the destination address 21 into the virtual IP address DA, and sends it to the terminal 233. Send the packet.

  Next, an IP packet is transmitted from the terminal 233 to the terminal 232 via the VPN forming device 222, the routers 242 and 241, and the VPN forming device 221.

  As shown in FIG. 3C, “SA” is written as the destination address 31 and “DA” is written as the source address 32 in the header of the IP packet transmitted from the terminal 233, and the destination port is written in the TCP header. “200” is written as the number 33, and “100” is written as the source port number 34.

  The VPN forming device 222 refers to the routing table, converts the SA of the destination address 31 to the global address SM, converts the DA of the source address 32 to the private address DB, and transmits it to the router 242.

  The router 242 refers to the conversion table, converts the global address DB of the source address 32 to the global address DM, and transmits the packet to the router 241.

  The router 241 converts the SM at the destination address 31 into the private address SB, and transmits the packet toward the VPN forming device 221.

  The VPN forming device 221 converts the SB of the destination address 31 into the virtual IP address SA, converts the DM of the transmission source address 32 into the virtual IP address DA, and transmits the packet toward the terminal 232.

  As described above, the VPN forming device is positioned as one terminal device in the LAN for the router. Therefore, an IP packet transmitted from the terminal 232 to a terminal such as a server or a host having a global address in the Internet is transmitted to the router via the VPN forming apparatus, and is processed by the NAT function of the router in the conventional manner.

  Here, a NAT traversal function that is desirably provided in the VPN forming apparatus will be described (an example in which the technique disclosed in Patent Document 1 is applied). In order to realize a P2P application in a connection environment using the NAT function, it is necessary to always open a predetermined port in the router from the start to the end of communication. A method for opening a port at the beginning of communication with reference to FIG. 4 and a method for maintaining a port once opened with reference to FIG.

  Referring to FIG. 4, when performing P2P communication between terminals, avoid blocking by ICMP (Internet Control Message Protocol) packet (destination unreachable message), and first open the router port used in the session. It is necessary to keep. Therefore, the number of hops to the router 241 is checked, and a UDP packet for opening a port is transmitted.

  More specifically, the VPN forming apparatus 221 generates an ICMP echo packet and transmits it with TTL (Time To Live) = 1. Sequentially increasing TTL = 2.3... And transmitting a plurality of echo packets. When the echo packet 51 whose TTL value is equal to the number of hops of the router 241 is transmitted, the echo packet 52 is returned from the router 241 to the VPN forming device 221. The VPN forming device 221 can know the number of hops to the router 241 from the returned echo packet 52.

  Next, the VPN forming device 221 sets a value α obtained by adding 1 to the number of hops of the router 241 to TTL, and transmits a port setting packet 53 having a transmission source port number “100”. As a result, the port of the transmission source port number “100” of the router 241 is opened. Since the port setting packet 53 is deleted at the next hop of the router 241, it does not affect other communications.

  With such a configuration, communication between the NNMs using the packets 54 and 55 can be performed by opening the port of the transmission source port number “100” of the router 241. At this time, if the router 242 also has a function of blocking by the ICMP packet, the VPN forming apparatus 222 performs the same processing.

  Next, referring to FIG. 5, while the packet transmission / reception is interrupted in the same session, it is necessary to maintain the opened port so that the router does not clear the conversion table. Therefore, keep-alive packets are transmitted at regular time intervals while packet transmission / reception is interrupted. For example, the number of hops to the router 241 is checked in advance using the ICMP echo packet described above. The VPN forming device 221 sets a value α obtained by adding 1 to the number of hops of the router 241 to the TTL, and transmits the UDP packet 61 having the transmission source port number “100”. As a result, the contents of the conversion table stored in the router 241 are not deleted, and packets with the same port number set can be transmitted thereafter.

  In the embodiment shown in FIGS. 4 and 5, it may be transmitted only to a router having a function of blocking by an ICMP packet. This is because some routers have a function of discarding a packet and closing a port when the TTL setting value is α.

  When the port setting packet and the keep alive packet reach other VPN forming apparatuses, communication disruption is prevented. For example, as shown in FIG. 5, flags 63 and 64 are added to the head of all packets, and “1” is set for a keep-alive packet and “0” is set for a normal packet. In this way, even when the VPN forming device receives the keep-alive packet, it can be identified and discarded.

  In this embodiment, the destination port number and the source port number are written in the TCP header. The destination port number and the source port number may be written in the UDP header.

For example, if a firewall is connected to the communication path, communication using TCP or UDP may not be possible. Therefore, the VPN forming apparatus may determine a usable protocol using the method described below.
(1) Method for determining whether UDP is usable The VPN forming device sets the destination port number in the UDP header of the IP packet to “n” (n: other than well-known port numbers such as HTTP and POP3), and manages the session. Send to server port number n.

  When the packet reaches the standby port number n of the session management server, it is determined that UDP can be used.

  If the packet does not reach the standby port number n on the session management server side, set the destination port number in the UDP header of the IP packet to “443” (port number used by HTTPS), and set the port of the session management server It transmits to the number 443. When the packet arrives at the standby port number 443 on the session management server side, it is determined that the UDP addressed to the port 443 can be used.

  If the packet does not reach the standby port number 443 on the session management server side, the destination port number of the UDP header of the IP packet is set to “80” (port number used by HTTP), and the port of the session management server Send to number 80. When the packet arrives at the standby port number 80 on the session management server side, it is determined that the UDP addressed to the port 80 can be used.

  If the packet does not reach the standby port number 80 on the session management server side, it is determined that UDP cannot be used.

(2) Method for determining whether TCP is usable The VPN forming apparatus sets the destination port number of the TCP header of the IP packet to “n” (n: other than well-known port numbers such as HTTP and POP3), and manages the session. Send to server port number n.

  When the packet arrives at the standby port number n of the session management server, it is determined that TCP can be used.

  If the packet does not reach the standby port number n on the session management server side, set the destination port number of the TCP header of the IP packet to “443” (port number used by HTTPS), and set the port of the session management server It transmits to the number 443. When the packet arrives at the standby port number 443 on the session management server side, it is determined that TCP addressed to the port 443 can be used.

  If the packet does not reach the standby port number 443 on the session management server side, the destination port number of the TCP header of the IP packet is set to “80” (port number used by HTTP), and the port of the session management server Send to number 80. When the packet reaches the standby port number 80 on the session management server side, it is determined that TCP addressed to the port 80 can be used.

  If the packet does not reach the standby port number 80 on the session management server side, it is determined that TCP cannot be used.

  The session management server collects a set of protocols and port numbers such as UDP and TCP that can be used for communication with the VPN forming device from the IP packet transmitted from the VPN forming device, and provides them to the VPN forming device. Can do.

(3) Various communication methods By the above method, for example, when UDP is determined to be unusable, when performing UDP communication, the UDP data is encapsulated with TCP, or only the UDP payload is replaced with TCP. The VPN forming apparatus may be configured to perform communication. In this case, it is necessary to enable the destination communication stack to restore the original UDP.

  Alternatively, if it is determined by the above method that the UDP addressed to port number n is unusable, the VPN forming apparatus is configured to perform UDP communication by setting the destination port number of the UDP header to 443 or 80. May be. In this case, the destination terminal must wait at the UDP port 443 or port 80. Also, when the destination terminal has a plurality of connections (sessions), each session is identified by providing a field for identifying a communication channel (session) in the header of UDP data communicated between the terminals. There is a need for.

  Similarly, if TCP is determined to be unusable by the above method, UDP communication is performed, or if it is determined that TCP addressed to port number n is unusable, the destination port of the TCP header The VPN forming apparatus may be configured to perform TCP communication with the number set to 443 or 80.

  As described above, according to the present invention, the router 241 and 242 and the terminals 231, 232, and 233 constituting the LAN are not changed, and the private network can be obtained by simply connecting the VPN forming apparatus between the router and the terminal. When the NAT function (routers 241 and 242) is implemented in IP communication between the terminals 231 and 232 in the LAN 1, which is a closed network configured using addresses, and the terminal 233 in the LAN 2 outside the LAN 1 A VPN can be formed between the terminals 231 and 232 in the LAN 1 and the terminal 233 in the LAN 2 outside the LAN 1.

  In the present embodiment, the terminals 232 and 233 are illustrated as personal computers and the terminal 231 is illustrated as a NAS (Network Attached Storage) (FIG. 2). However, the terminals are not limited to this, and a camera device (network network) having a network port is illustrated. It can be set as the apparatus which can perform IP communication, such as a camera), household appliances (information household appliance), and an IP telephone.

(Second Embodiment)
FIG. 6 shows a network to which the communication module (VPN forming module) according to the second embodiment of the present invention is applied. The VPN forming module implements the functions of the VPN forming apparatus described in the first embodiment as software.

  A network 400 shown in FIG. 6 includes a session management server 210, a router 241, and a router 242, each connected to a WAN, which is a wide area communication network, a terminal 410 connected to the router 241, and a terminal 420 connected to the router 242. including.

  The terminals 410 and 420 exemplify personal computers (PCs), and have application programs (411, 421), VPN formation modules (412, 422), and network interfaces (413, 423), respectively.

  In the terminal 410, the private address SB assigned by the router 241 and the virtual IP address SA assigned by the session management server 210 are set.

  In the terminal 420, the private address DB assigned by the router 242 and the virtual IP address DA assigned from the session management server 210 are set.

  In response to a request for communication using the virtual IP address from the application program (for example, communication from the application program 411 in the terminal 410 to the application program 421 in the terminal 420), the VPN formation module communicates with the terminal 231 or 232. IP packet routing function in IP communication. That is, the VPN formation module has a routing table for routing IP packets related to the virtual IP address.

  Next, communication from the application program 411 in the terminal 410 to the application program 421 in the terminal 420 will be described with reference to FIG.

  In the header of the IP packet transmitted from the application program 411, “DA” as the destination address 21 and “SA” as the source address 22 are written, and “200” as the destination port number 23 in the TCP header. “100” is written as the port number 24.

  The VPN formation module 412 refers to the routing table, converts the virtual IP address SA of the source address 22 to the private address SB, converts the virtual IP address DA of the destination address 21 to the global address DM, and sends it to the router 241. The packet is transmitted through the network interface 413.

  The router 241 refers to the conversion table, converts the private address SB of the transmission source address 22 to the global address SM, and transmits the packet toward the router 242.

  The router 242 refers to the conversion table, converts the global address DM of the destination address 21 into the private address DB, and transmits the packet toward the terminal 420.

  The VPN formation module 422 of the terminal 420 processes the packet from the router 242. The VPN formation module 422 refers to the routing table, converts the global address SM of the source address 22 to the virtual IP address SA, converts the private address DB of the destination address 21 to the virtual IP address DA, and sends it to the application program 421. Send packets to

  Next, communication from the application program 421 in the terminal 420 to the application program 411 in the terminal 410 will be described. In the header of the IP packet transmitted from the application program 421, “SA” as the destination address 31 and “DA” as the source address 32 are written, and “200” as the destination port number 33 in the TCP header. “100” is written as the port number 34.

  The VPN formation module 422 refers to the routing table, converts the SA of the destination address 31 to the global address SM, converts the DA of the transmission source address 32 to the private address DB, and transmits it to the router 242.

  The router 242 refers to the conversion table, converts the global address DB of the source address 32 to the global address DM, and transmits the packet toward the router 241.

  The router 241 converts the SM at the destination address 31 into the private address SB and transmits the packet to the terminal 410.

  The VPN formation module 412 of the terminal 410 processes the packet from the router 241. The VPN formation module 412 converts the SB of the destination address 31 into the virtual IP address SA, converts the DM of the transmission source address 32 into the virtual IP address DA, and transmits the packet toward the application program 411.

It is a network connection diagram for demonstrating a NAT function. It is a network connection diagram for demonstrating the communication apparatus (VPN formation apparatus) which concerns on the 1st Embodiment of this invention. 3A is a diagram showing a part of the network connection diagram of FIG. 2, FIG. 3B is a diagram for explaining the flow of IP packets from the terminal 232 to the terminal 233 of FIG. 3 (c) is a diagram for explaining the flow of an IP packet from the terminal 233 to the terminal 232 in FIG. 3 (a). It is explanatory drawing of the NAT traversal function of the communication apparatus (VPN formation apparatus) which concerns on the 1st Embodiment of this invention. It is explanatory drawing of the NAT traversal function of the communication apparatus (VPN formation apparatus) which concerns on the 1st Embodiment of this invention. It is a network connection diagram for demonstrating the communication module (VPN formation module) which concerns on the 2nd Embodiment of this invention.

Explanation of symbols

11 Client 12 Server 13, 14, 241, 242 Router 200, 400 Network 210 Session management server 231 Terminal (NAS)
232, 233, 411, 420 Terminal (PC)
221 and 222 VPN forming devices 411 and 421 Application programs 412 and 422 VPN forming modules 413 and 423 Network interfaces

Claims (8)

In a communication device for securing a communication path for IP communication between a network device having a NAT function and a terminal in a network configured using a private address and the outside of the network for the terminal,
Means for setting the private address;
Means for assigning a virtual IP address to the terminal;
The virtual IP address assigned to the terminal written in the source address of the IP packet received from the terminal is converted into the private address set in the communication device, and the destination address of the IP packet received from the terminal And a means for converting the virtual IP address of the destination terminal written in to a global address set in a network device that provides the destination terminal with a NAT function.   The communication apparatus according to claim 1, further comprising means for inquiring a virtual IP address to be assigned to the terminal. In a communication method for securing a communication path for IP communication between a network device having a NAT function and a terminal in a network configured using a private address and the outside of the network for the terminal,
Setting the private address;
Assigning a virtual IP address to the terminal;
The virtual IP address assigned to the terminal written in the source address of the IP packet received from the terminal is converted into the private address set in the communication device, and the destination address of the IP packet received from the terminal Converting the virtual IP address of the destination terminal written in to a global address set in a network device that provides a NAT function to the destination terminal.   The communication method according to claim 3, further comprising a step of inquiring a virtual IP address to be assigned to the terminal.   The program for making a computer perform the step of Claim 3 or 4. In a terminal connected to a network device having a NAT function in a network configured using a private address,
Means for setting the private address and virtual IP address;
The virtual IP address assigned to the terminal written in the source address of the IP packet transmitted from the application of the terminal is converted into the private address set in the terminal, and the IP packet received from the application Means for converting a virtual IP address of a destination terminal written in the destination address into a global address set in a network device that provides a NAT function to the destination terminal. In a communication method for securing a communication path for IP communication with the outside of the network for a terminal connected to a network device having a NAT function in a network configured using a private address,
Setting the private address and virtual IP address;
The virtual IP address assigned to the terminal written in the source address of the IP packet transmitted from the application of the terminal is converted into the private address set in the terminal, and the IP packet received from the application Converting the virtual IP address of the destination terminal written in the destination address into a global address set in a network device that provides a NAT function to the destination terminal. The program for making a computer perform the step of Claim 7.

Images