JP2007104438A - Outdoor access system, server, and communication method - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To provide an outdoor access system capable of starting a communication with an indoor apparatus 201 at a desired timing from an outdoor apparatus 202. <P>SOLUTION: An indoor apparatus 201 registers its own global IP (Internet Protocol) address and a port number in a server 205 (step 103), and periodically sends packets to a dummy address in order to maintain an NAPT (Network Address Port Translation) table of a router 203 (step S105). The router 203 periodically receives the packets destined to the dummy address from an indoor apparatus 201, thereby mainlining NAT (Network Address Translation) slots to the indoor apparatus 201 from the server 205. Upon receipt of a connection request from the outdoor apparatus 202 to the indoor apparatus 201, the server 205 changes the sending source to the dummy address to send packets of the connection request to the indoor apparatus 201 (step S109). <P>COPYRIGHT: (C)2007,JPO&INPIT

Description

  More specifically, the present invention relates to a remote access system, a server used in the remote access system, and a communication method. More specifically, communication from a device on an external network to a LAN connection device can be started at a desired timing. The present invention relates to an access system and a remote access system, a server that mediates communication between a device on an external network and a LAN connection device, and a communication method used in the remote access system.

  With the recent spread of networks such as the Internet (hereinafter referred to as external networks), services via networks such as e-mail and electronic commerce are increasing, and the number of devices that can be connected to the network is increasing in the home. As home appliances that can be connected to this network, so-called “net home appliances”, for example, there are white goods such as air conditioners and microwave ovens. These white goods are also connected to the network, and services that control the air conditioner from outside the house or upgrade the program from the center have been proposed.

[What is an external access system?]
Usually, communication devices in a home or company are connected to a local area network (hereinafter referred to as “LAN”), and a unique private IP address is assigned only within a LAN within the home or company. Communication devices in the LAN are connected to an external network via a router equipped with a NAT (Network Address Translation) or NAPT (Network Address Port Translation) function (hereinafter, connectable to an external network via the router). The device is referred to as “LAN connection device”). When a LAN connection device transmits / receives a packet, the private IP address / port number of the LAN connection device is converted by the router into a global IP address / port number that can be used in an external network.

Considering the service of Internet home appliances, it is necessary to be able to start communication via an external network from a “communication device connected to another network” to a LAN connection device. Such communication systems are collectively referred to as “external access system”. For example, an out-of-home access system includes the following two systems.
(1) Remote control system:
For example, a system that controls devices (such as recording reservations for recorders) by accessing devices at home via an external network from devices outside the home (such as mobile phones). Communication is always started on the side of the out-of-home device (device that controls the in-home device), and the in-home device always waits for access from the out-of-home device. In some cases, a global IP address is assigned to an external device (that is, the external device may not need to be connected to an external network via a router).
(2) P2P connection system:
A system in which client devices between different LANs perform one-to-one interconnection, such as data exchange between individual users and competitive network games. When sending and receiving data, communication can be started from either client device without going through the server. In many cases, both client devices are connected to an external network via a router (that is, both client devices can be LAN connection devices).

  Hereinafter, in the description assuming the remote control system, the term “outside equipment” is used for communication equipment outside the home, and the “home equipment” is used for communication equipment connected to the LAN. Assume that a device having a global IP address (not a LAN connection device) and a home device are assumed to be LAN connection devices. Further, in the description assuming a P2P connection system, the terms “client A” and “client B” are used as client devices, and it is assumed that both client devices are LAN connection devices.

[Difficulty of connection in outside access system]
When connecting to a server having a global IP address outside the home, the home device can be easily connected via a router. Specifically, when the home device sends a packet to a server outside the home, the private IP address / port number of the home device is assigned to the packet source, but the router automatically sends it to the external device. This is because it converts it into a global IP address and port number that can be interpreted on the network. When the router changes the address and port for the packet transmitted from the home device, the router stores the conversion rule in the NAPT table on the router.

  When the response packet addressed to the home device arrives from the server, the router searches the NAPT table for a conversion rule corresponding to the global IP address / port number set as the destination of the response packet. Then, the router rewrites the global IP address / port number set as the destination of the response packet based on the search result into a private IP address / port number by reverse conversion, and relays it to the home device. However, the outside device cannot be freely connected to the home device at a desired timing for the following reason.

  First, since there is no means for knowing the global IP address of the in-home device from the out-of-home device, the destination for packet transmission to the in-home device is unknown. In particular, when a global IP address of a home device is assigned by DHCP, PPP, or the like, there is a possibility that it will always change. Therefore, this address cannot be notified to the outside device in advance.

  Second, even if the global IP address of the home device is known, there is a problem regarding the firewall function of the router. The conversion rule on the NAPT table of the router is dynamically generated when a packet transmitted from the LAN side device (including the home device) to the external network side is relayed. However, when relaying a packet in the reverse direction, a router normally does not generate a new conversion rule from the viewpoint of preventing intrusion from the outside (when relaying a packet in the reverse direction, it uses an existing conversion rule). Only reverse conversion). Therefore, when a connection request packet is transmitted from an out-of-home device to the in-home device, since the conversion rule is not registered in the NAPT table, the router does not know to which device in the LAN the packet should be transferred. The request packet is discarded.

  Third, there is a problem when using the static NAT function. If the router setting is operated in advance, a desired conversion rule can be added to the NAPT table even if packet relay does not occur (static NAT). Specifically, for packets whose source is the global IP address / port number of the external device and whose destination is the global IP address / port number of the home device, the destination is converted into the private IP address / port number of the home device. If such a rule is set, the second problem can be prevented. However, this method requires a user to set a static NAT conversion rule in the router in advance, and there is a problem that the setting contents are difficult for an end user who does not have knowledge about the network.

  In order to solve the above-described problem, a method for connecting between an out-of-home device and an in-home device (or client A and client B) using a server has been conventionally proposed in an out-of-home access system (for example, , See Patent Document 1). FIG. 15 is a diagram for explaining a connection method of a conventional outside-home access system. FIG. 15 shows a processing sequence of the network system in which the client A 802 and the client B 801 are P2P connected. In FIG. 15, a client A 802 is connected to an external network 804 via a router A 803, and a client B 801 is connected to an external network 804 via a router B 806. The lobby server 805 is a server that plays a role of notifying the client A 802 and the client B 801 of destinations (transmission destination address and transmission destination port number) of each other at the beginning of the P2P connection. It is connected to the.

  In the registration phase (step S810), the client A 802 and the client B 801 register their own global address information (global IP address: T-IP, port number: T-Port) in the lobby server 805, respectively. Specifically, the client A 802 and the client B 801 each transmit a login request packet to the lobby server 805 (steps S811 and S814). The lobby server 805 registers the global address information (T-IP, T-Port) of the client A 802 and the client B 801 in its own database (steps S812 and S815), and transmits a login response packet to the client A 802 and the client B 801 ( Steps S813 and S816).

  Here, the relationship between the packet relayed by the router B 806 and the NAPT table will be described with reference to FIGS. FIG. 16 is a diagram illustrating a state of the NAPT table of the router B 806. FIG. 16A shows the NAPT table in the initial state. FIG. 16B shows the NATP table immediately after step S814 (that is, the client B 801 transmits a login request packet to the lobby server 805). Referring to FIG. 16, an entry (conversion rule) is registered in the NAPT table in which nothing is registered in the initial state by router B 806 relaying the login request packet.

  FIG. 17 is a diagram illustrating a login request packet transmitted from the client B 801. FIG. 17A shows a login request packet immediately after being transmitted from the client B 801. FIG. 17B shows a login request packet immediately after being relayed by the router B 806. Referring to FIG. 17, the login request packet transmitted from client B 801 is relayed by router B 806, so that the source address (S-IP) and source port number (D-Port) are private IP addresses. (IPca_P, Pca_P) to global IP address (IPca_G, Pca_G).

  FIG. 18 is a diagram illustrating a login response packet transmitted from the lobby server 805. FIG. 18A shows a login response packet immediately after being transmitted from the lobby server 805. FIG. 18B shows a login response packet immediately after being relayed by the router B 806. Referring to FIG. 18, since the login response packet transmitted from lobby server 805 corresponds to the entry (NAT_B1) in the NAPT table of router B 806, the destination address (D-IP) and the source port number (D- Port) is reversely converted from the global IP address (IPs_G, Ps_G) to the private IP address (IPs_P, Ps_P) and relayed to the client B 801.

  Returning to the description of the connection request phase (step S820) in FIG. In the connection request phase (step S820), when the client A 802 desires the P2P connection with the client B 801, the client A 802 transmits a packet requesting the P2P connection with the client B 801 to the lobby server 805 (step S821). Upon receiving this packet from the client A 802, the lobby server 805 transmits a packet requesting a P2P connection from the client A 802 to the client B 801 (step S822). At this time, the lobby server 805 detects the global address information of the client A 802 based on the packet received from the client A 802 and transmits it to the client B 801.

  When the client B 801 approves the P2P connection request from the client A 802, the client B 801 transmits a response packet indicating that the connection is accepted to the lobby server 805 (step S823). Upon receiving this response packet, the lobby server 805 transmits a response packet indicating that the connection request is successful to the client A 802 (step S824). At this time, the lobby server 805 detects the global address information of the client B 801 based on the packet received from the client B 801 and transmits it to the client A 802 as in step S822. In this way, the client A 802 and the client B 801 can exchange global address information with each other via the lobby server 805.

  In step S822, the lobby server 805 transmits a packet having the same header as the login response packet shown in FIG. Since this packet conforms to the NAPT table entry (NAT_B1) of the router B 806, the packet is correctly relayed to the client B 801 via the router B 806. In other words, in the conventional method, the client A 802 uses the existing NAPT table entry between the lobby server 805 and the client to set up a device (client B 801) in the LAN without setting a static NAT. A connection request can be sent.

  The process of FIG. 15 further continues to the Port conversion prediction phase (step S830). The Port conversion prediction phase (step S830) is a process that is specially required in the P2P connection system. In the case of P2P connection, the global address information of the communication partner obtained from the lobby server 805 is not directly usable for communication between clients. This is because the global IP address can be used as it is, but the port number can only be used for communication with the lobby server 805. Therefore, the client A 802 and the client B 801 predict a global IP address / port number combination that can be used for communication between clients by transmitting a plurality of packets. Since this prediction method is not directly related to the present invention, description thereof is omitted here.

  When a port number that allows direct communication between clients is found in the Port conversion prediction phase S830, P2P communication between the client A 802 and the client B 801 becomes possible (P2P communication phase: step S840).

  Although the P2P connection system has been described with reference to FIG. 15, the procedure for resolving the global IP address and the NAPT table using the server is the same for the remote control system. Specifically, in FIG. 15, when the client B 801 is replaced with an in-home device and the client A 802 and the router A 803 are replaced with an external device to form a remote control system, the registration processing for the client A in steps S 811 to S 813, Port The conversion prediction phase S830 becomes unnecessary. Also, the P2P communication phase in step S840 is replaced with communication processing between the home device and the external device.

As described above, in the conventional method, the global IP address and the port number of the LAN connection device are registered and resolved using the server. In addition, regarding the NAPT table problem when a connection request is made to a LAN connection device from a device outside the LAN, the generated NAPT conversion rule can be used by mediating the server. Therefore, communication in the outside access system can be started without setting static NAT in the router.
JP 2004-180003 A

  However, a normal timeout period is set for the entry in the NAPT table of the router B 806, and when the packet communication corresponding to the entry is interrupted, the entry is deleted after a predetermined time. Therefore, for example, the NAT_B1 entry generated on the router B 806 in the registration phase (step S810 in FIG. 15) may be deleted when the client A 802 issues a P2P connection request. Therefore, there is a possibility that the client A 802 cannot issue a connection request to the client B 801 depending on the timing.

  In order not to delete the entry in the NAPT table, a packet is periodically transmitted from the client B 801 to the lobby server 805 (in the case of FIG. 15, the packet is periodically transmitted between the registration phase S810 and the connection request phase S820). Can be considered). However, in the conventional method, the following problem occurs in the lobby server 805.

[First issue: Lobby server processing load]
Packets periodically transmitted by a plurality of client devices arrive at the lobby server 805 in a concentrated manner. Since the lobby server 805 has to process a packet received from a client device, the processing load increases as the number of connected client devices increases.

[Second issue: Lobby servers are likely to be exposed to DoS attacks]
For a malicious third party (attacker) who wants to attack by a DoS attack or the like, if the address, protocol, and port number on which the lobby server 805 is waiting are found, the attack becomes easy. When a large amount of packets are transmitted from the client device to the lobby server 805 as in the conventional method, an attacker who has purchased a legitimate client device simply analyzes the transmitted packet of the client device, and the lobby server 805 The address, protocol, and port number are easily identified. Therefore, the conventional method has a problem that the lobby server 805 is easily exposed to a DoS attack.

  Therefore, an object of the present invention is to provide a remote access system and a server used in the remote access system that reduce the processing load on the server and reduce the possibility of Dos attack from an attacker.

  The present invention mediates communication between a first communication device connected to a local area network via a router and a second communication device connected to a second network different from the local area network in an external network. Is directed to the server. In order to achieve the above object, the server of the present invention includes a dummy address storage unit, a home device information DB, a home device registration processing unit, a connection request mediation unit, and a transmission source information change unit.

  The dummy address storage unit stores information related to the dummy address using a destination address of a packet that is different from its own address and periodically transmitted by the first communication device as a dummy address. The in-home device information DB is a database for storing transmission source information of packets periodically transmitted by the first communication device as first in-home device information. The in-home device registration processing unit obtains the first in-home device information from the first communication device in response to reception of a registration packet transmitted by the first communication device to register its own address information. Register in the device information DB. When receiving a packet requesting connection from the second communication device to the first communication device, the connection request mediation unit addresses the first communication device based on the information stored in the home device information DB. Send a connection request packet to. The transmission source information changing unit changes the transmission source information of the connection request packet transmitted from the connection request mediation unit to information related to the dummy address based on the information stored in the dummy address storage unit.

  Preferably, the second network is a local area network different from the local area network to which the first communication device is connected. In this case, the first communication device and the second communication device perform a one-to-one mutual connection. Further, the dummy address storage unit is an address different from its own address, and information related to the dummy address is set with the destination address of the packet periodically transmitted by the first communication device and the second communication device as a dummy address. Save. The in-home device information DB uses the transmission source information of the packet periodically transmitted by the first communication device as the first in-home device information, and the second transmission source information of the packet periodically transmitted by the second communication device. It is a database for storing as home appliance information. The in-home device registration processing unit further acquires second in-home device information from the second communication device in response to reception of a registration packet transmitted by the second communication device to register its own address information. And register in the home appliance information DB. The connection request mediation unit further receives the second communication based on the information stored in the home device information DB when receiving a packet requesting connection from the first communication device to the second communication device. A connection request packet is transmitted to the device.

  Further, a server-side firewall that distributes packets addressed to the dummy address based on a predetermined rule may be provided between the server and the external network. In this case, a dummy address is set as the destination of the registration packet transmitted by the first communication device. The server-side firewall distributes the registration packet to the server based on a predetermined rule, and discards the packet that the first communication device periodically transmits to the dummy address. Upon receiving the registration packet transmitted by the first communication device for registering its own address information through the server-side firewall, the home device registration processing unit receives the first home device information from the first communication device. Acquire and register in the home appliance information DB.

  The first home device information includes a transmission source address and a transmission source port number of a packet that the first communication device periodically transmits to the dummy address. The in-home device registration processing unit further transmits a plurality of packets in which the dummy address is set as the transmission source address to the first communication device while changing the destination port number, and the transmission source of the first in-home device information Estimate the port number.

  Packets periodically transmitted by the first communication device are transmitted at a time interval at which the entry does not disappear from the router's NAPT table.

  The present invention also provides a first communication device connected to the local area network via a router, a second communication device connected to a second network different from the local area network, and an external network. The present invention is also directed to an outside access system including a server that mediates communication between one communication device and a second communication device. And in order to achieve the said objective, the 1st communication apparatus is provided with a dummy address storage part, a periodic packet transmission part, and a connection request packet process part in the remote access system of this invention. The dummy address storage unit stores information related to the dummy address using an address that is different from the address of the server and that is shared with the server as a dummy address. The registration packet processing unit transmits a registration packet to the server in order to register its address information. The periodic packet transmission unit periodically transmits packets to the dummy address. The connection request packet processing unit receives a packet requesting connection transmitted from another communication device via the server.

  Further, the second communication device transmits a packet requesting connection to the first communication device. The server also includes a dummy address storage unit, a home device information DB, a home device registration processing unit, a connection request mediation unit, and a transmission source information change unit. The dummy address storage unit stores information related to the dummy address using a destination address of a packet that is different from its own address and periodically transmitted by the first communication device as a dummy address. The in-home device information DB is a database for storing transmission source information of packets periodically transmitted by the first communication device as first in-home device information. The in-home device registration processing unit obtains the first in-home device information from the first communication device in response to reception of a registration packet transmitted by the first communication device to register its own address information. Register in the device information DB. When receiving a packet requesting connection from the second communication device to the first communication device, the connection request mediation unit addresses the first communication device based on the information stored in the home device information DB. Send a connection request packet to. The transmission source information changing unit changes the transmission source information of the connection request packet transmitted from the connection request mediation unit to information related to the dummy address based on the information stored in the dummy address storage unit.

  The present invention also provides predetermined communication with other communication devices connected to a network different from the local area network through a server connected to the local area network via a router and connected to an external network. It is also directed to communication equipment that realizes In order to achieve the above object, a communication device of the present invention includes a server address storage unit, a dummy address storage unit, a registration packet processing unit, a periodic packet transmission unit, and a connection request packet processing unit. Prepare. The server address storage unit stores information related to the server address. The dummy address storage unit stores information related to the dummy address using an address that is different from the address of the server and that is shared with the server as a dummy address. The registration packet processing unit transmits a registration packet to the server in order to register its address information. The periodic packet transmission unit periodically transmits packets to the dummy address. The connection request packet processing unit receives a packet requesting connection transmitted from another communication device via the server.

  The present invention also provides a server that mediates communication between a first communication device connected to a local area network via a router and a second communication device connected to a second network different from the local area network. Is also directed to the communication method executed. In order to achieve the above object, the server of the present invention is triggered by the step of receiving the registration packet transmitted by the first communication device for registering its own address information and the reception of the registration packet. An acquisition step of acquiring transmission source information of a packet periodically transmitted by the first communication device as the first in-home device information, and a packet for requesting connection from the second communication device to the first communication device. And a connection request mediation step of transmitting a connection request packet to the first communication device based on the first home device information acquired in the acquisition step, and an address different from its own address, The destination address of the packet periodically transmitted by the first communication device is used as a dummy address, and the transmission source address of the connection request packet is changed to a dummy address. And a source information changing step.

  According to the present invention, a first communication device connected to a local area network via a router is connected to a second network different from the local area network via a server connected to an external network. It is also directed to a communication method for communicating with two communication devices. In this case, the first communication device transmits a registration packet to the server for registering its own address information, and the address that is different from the server address and is shared with the server as a dummy address. , Periodically transmitting packets addressed to the dummy address, and receiving a connection request packet transmitted from the second communication device via the server.

  As described above, according to the present invention, a packet periodically transmitted by a home device is directed to a dummy address that is an address different from the server address. Therefore, the number of packets that reach the server is reduced, and the processing load on the server can be reduced. Even if the server does not receive a packet from the home device, the NAT hole in the home router is maintained by a packet that the home device periodically transmits to the dummy address. Therefore, it is possible to reduce only the processing load of the server while securing a route for transmitting the connection request packet from the server to the home device. Furthermore, since the packet transmitted / received by the in-home device 201 does not include the address of the server 205, the risk that an attacker knows the server's standby port is reduced. Also, even if an attacker performs a DoS attack addressed to a dummy address, the server does not fall into an unprocessable state because the packet does not reach the server.

  Hereinafter, embodiments of the present invention will be described with reference to the drawings.

(First embodiment)
FIG. 1 is a block diagram showing an example of a network configuration of an out-of-home access system according to the first embodiment of the present invention. In FIG. 1, the external access system according to the first embodiment realizes communication between an in-home device 201 connected to a LAN 206 and an external device 202 on an external network 204 such as the Internet. .

  In FIG. 1, the outside access system according to the first embodiment of the present invention includes an in-home device 201, an out-of-home device 202, a router 203, and a server 205. As the outside device 202 on the external network 204, a communication device such as a mobile phone or a personal computer is assumed. The home device 201 connected to the LAN 206 is assumed to be a communication device such as an Internet home appliance (DVD recorder or the like) installed in the home.

  The server 205 is connected to the external network 204 and mediates communication between the outside device 202 and the inside device 201. The router 203 is installed in the home and connects the LAN 206 and the external network 204. The in-home device 201 communicates with an out-of-home device 202 on the external network 204 via the router 203.

  The router 203 has a NAPT function. An address on the external network 204 side of the router 203 (that is, a global IP address) is IPi_G. For convenience of explanation, it is assumed that the router 203 has only one global IP address. Note that the global IP address of the router 203 may change dynamically when it is assigned by a protocol such as DHCP or PPP from an Internet service provider or the like, and IPi_G is a global IP address assigned at a certain point in time. To do. Further, the address (private IP address) of the in-home device 201 is IPi_P, the address of the server 205 (global IP address) is IPs_G, and the address of the outside device 202 (global IP address) is IPo_G.

[Communication Method of the Present Invention]
FIG. 2 is a sequence diagram showing a communication method of the outside access system according to the first embodiment of the present invention. Referring to FIG. 2, as an initial state, in-home device 201 and server 205 share the dummy address related information in advance by some method. Here, the dummy address is an address that waits for a packet that the home device 201 periodically transmits, and is an address different from the address (IPs_G) of the server 205.

  For example, the home device 201 and the server 205 share the dummy address related information by being directly set by the user or by transmitting and receiving a message including the dummy address related information. In addition, in the home device 201 and the server 205, related information of dummy addresses may be set at the time of factory shipment. A device having a dummy address need not actually exist. The related information of the dummy address includes a dummy address (IPd_G) and a port number (Pd_G). The in-home device 201 and the server 205 hold the information itself or information (such as a URL) that can resolve the information.

Subsequently, the four processing phases of the communication method of the present invention, namely:
(1) Home appliance registration phase (step S101)
(2) Periodic transmission phase (step S104)
(3) Connection request phase (step S106)
(4) In-home device-external device communication phase (step S110)
Will be described.

(1) The home appliance registration phase (step S101) will be described.
The in-home device registration phase (step S101) is a phase for notifying that the in-home device 201 has accessed the server 205 and is ready to accept a connection request from the out-of-home device 202. Specifically, the home device 201 transmits a registration packet to the server 205. The server 205 acquires global address information (global IP address: IPi_G, port number: Pi_G) of the home device 201 using the registration packet received from the home device 201 as a trigger (step S102). The server 205 registers the acquired global address information of the home device 201 in the database (step S103). Here, the global address information registered in the database is used for periodic packet transmission in the next periodic transmission phase (step S104). Since the home appliance registration phase (step S101) has a plurality of variations, the details will be described in this embodiment and other embodiments.

(2) The periodic transmission phase (step S104) will be described.
The periodic transmission phase (step S104) is a phase for maintaining NAPT table entries on the router 203. Specifically, the home device 201 periodically transmits a packet (hereinafter referred to as a periodic transmission packet) toward a dummy address (address: IPd_G, port number: Pd_G) (step S105). The time interval at which the periodic transmission packet is transmitted is a time interval in which the entry is not deleted from the NAPT table on the router 203 (that is, the entry is maintained). This time interval may be determined by any method, and the present invention does not depend on this time interval determination method.

  FIG. 3 is a diagram illustrating a configuration of a periodic transmission packet. FIG. 3A shows a periodic transmission packet transmitted by the home device 201. FIG. 3B shows a periodic transmission packet relayed by the router 203. The periodic transmission packet transmitted to the dummy address is finally discarded when there is no communication device to receive. By relaying this periodic transmission packet, the router 203 can maintain the NAPT table entry (NAT_D1). In the entry (NAT_D1) of the NAPT table, the address (IPi_G) and port number (Pi_G) after conversion into the global IP address of the home device 201, the transmission destination address (IPd_G) and the port number (Pd_G) which are dummy addresses are registered. (See FIG. 4).

(3) The connection request phase (step S106) will be described.
The connection request phase (step S106) is a phase for requesting connection from the out-of-home device 202 to the in-home device 201. Specifically, the out-of-home device 202 transmits a connection request packet to the in-home device 201 to the server 205 (step S107). Upon receiving this connection request packet, the server 205 transmits a connection request packet to the home device 201 (step S109). FIG. 5 is a diagram illustrating a configuration of a connection request packet. FIG. 5A shows a connection request packet transmitted by the outside device 202. FIG. 5B shows a connection request packet transmitted by the server 205. Referring to FIG. 5, server 205 is based on the information registered in the database for the destination of the connection request packet received from outside device 202 (that is, destination address: D_IP and destination port number: D_Port). The global IP address (IPi_G, Pi_G) of the home device 201 is set. Further, the server 205 changes the source of the connection request packet (that is, the source address: S_IP and the source port number: S_Port) to the related information (IPd_G, Pd_G) of the dummy address instead of the address of the server 205 itself. (Step S108). The connection request packet (FIG. 5B) transmitted from the server 205 matches the NAPT table entry (NAT_D1) on the router 203, and is thus correctly transferred to the home device 201 via the router 203. The server 205 may add the global address information (address: IPo_G, port number: Po_G) of the out-of-home device 202 to the payload portion of the connection request packet and notify the in-home device 201.

(4) The communication phase between the home device and the external device (step S110) will be described.
The in-home device-external device communication phase (step S110) is a phase for direct communication between the in-home device 201 and the out-of-home device 202. Specifically, the in-home device 201 directly connects to the out-of-home device 202 based on the global address information of the out-of-home device 202 acquired in step S109 (if the out-of-home device 202 is not a LAN connection device, the in-home device 201 can be easily connected to the external device 201). Remote control information or the like from the outside device 202 to the inside device 201 is transmitted / received through communication established between the inside device 201 and the outside device 202.

  In this embodiment, the procedure for establishing a direct communication path between the in-home device 201 and the out-of-home device 202 after the in-home device 201 has received the connection request packet from the out-of-home device 202 has been described. There is no need to limit. The processing procedure after transmitting the connection request packet in step S109 to the in-home device 201 can vary depending on the system and the device. For example, a mechanism in which the server 205 relays communication between the in-home device 201 and the out-of-home device 202 may be provided.

  As described above, in the communication method according to the first embodiment of the present invention, since the packet periodically transmitted by the home device 201 does not arrive at the server 205 at all, the processing load on the server 205 is reduced. Further, since the packet transmitted in the periodic transmission phase (step S104) includes only the information related to the dummy address, the information (global IP address and port number) of the server 205 is not found even if the packet is analyzed. . Therefore, the possibility of DoS attack from an attacker can be reduced.

[Details of home device registration phase]
Next, the details of the home appliance registration phase (step S101) described in FIG. 2 will be described. FIG. 6 is a diagram showing a specific processing sequence of the home appliance registration phase (step S101). In FIG. 6, the home device 201 transmits a registration request packet to the server 205 (step S401). The registration request packet is different from the packet (see FIG. 3) transmitted in the periodic transmission phase (step S104), and the address (IPs_G, Ps_G) of the server 205 is set in the transmission destination address (D-IP, D-Port). (See FIG. 7). The registration request packet transmitted from the home device 201 is relayed by the router 203 and received by the server 205. When the server 205 receives the registration request packet from the home device 201, the server 205 determines whether or not the home device 201 can be registered. If registration is allowed, the global IP address (= IPi_G) and port number (= Pi_G) of the home device 201 are extracted from the registration request packet and registered in the database (step S402). When the server 205 registers the extracted information in the database, the server 205 transmits a response packet to the home device 201 (step S403).

  Note that an entry (NAT_i1) of the NAPT table is generated on the router 203 by transmitting the registration packet. FIG. 8A shows the NAPT table immediately after execution of step S401. However, since the address of the server 205 (= IPs_G) is registered as the transmission destination address in the NATP table, it does not match the entry in the NAPT table for the periodic transmission packet in the periodic transmission phase (step S104). That is, when the server 205 transmits a connection request packet to the home device 201 in the connection request phase (step S106), the server 205 does not know the port number on the home device side. Therefore, the server 205 and the home device 201 perform processing for estimating an entry in the NAPT table used in the periodic transmission phase (step S104) in the subsequent processing of S404 to S406.

  In FIG. 6, the in-home device 201 transmits the same packet as the periodic transmission packet transmitted in the periodic transmission phase (step S104), and creates a NAPT table entry on the router 203 (step S404). At this time, the NAPT table of the router 203 is in a state where an entry of NAT_i2 is added as shown in FIG. The server 205 transmits a plurality of investigation packets to which a port number having a possibility of T-Port is assigned in order to infer the converted port number (T-Port = Pi_G + x) of the NAT_i2 entry (step S405). For example, depending on the port conversion method of the router 203, the source port number (S-Port) and the destination port number (D-Port) may be the same, but only the destination IP address (D-IP) may be different. is there. In such a case, the converted port number (T-Port) may be the same as the source port number (S-Port).

  Also, depending on the port conversion method of the router 203, the converted port number (T-Port) may be determined by incrementing the port number used immediately before by a predetermined number. In such a case, the port number assigned to the packet transmitted immediately before by the home device 201 (for example, the port number (= Pi_G) of the home device 201 stored in step S402) is incremented by a predetermined number. There is a possibility that the port number (T-Port) after conversion is included. Therefore, the server 205 transmits a plurality of investigation packets in which the port number that may be the converted port number (T-Port) is set as the transmission destination port number. At that time, the server 205 sets the destination IP address of the investigation packet to “IPi_G”, the destination port number to “variable”, the source IP address to “IPd_G”, and the source port number to “Ps_G”. (Note that the source IP address is a dummy address). Furthermore, the port number set as the transmission destination port number is stored in the payload portion of the survey packet.

  If one of the survey packets transmitted by the server 205 matches the entry of NAT_i2, the survey packet reaches the home device 201 (step S406). Upon receipt of a survey packet in which a dummy address (that is, T-IP = IPd_G) is set as a transmission source address, the home device 201 transmits a survey response packet including the payload of the received survey packet to the server 205. (Step S407).

  When the server 205 receives the investigation response packet, the server 205 can confirm that the T-Port registered in the NAT_i2 entry of the router 203 is the port number stored in the payload of the investigation response packet. Therefore, after receiving the survey response packet, the server 205 registers the T-Port number in the database corresponding to the home device 201 (step S408).

  Note that the port number prediction method in the home appliance registration phase (step S101) in this embodiment is not limited to the method described above. For example, the method described in Patent Document 1 may be used.

[Configuration of Server 205]
Next, a specific configuration of the server 205 on which the communication method according to the first embodiment of the present invention is implemented will be described with reference to FIG. FIG. 9 is a block diagram illustrating a configuration example of the server 205 according to the first embodiment of the present invention. In FIG. 9, the server 205 includes a home device information DB 301, a dummy address storage unit 302, a home device registration processing unit 303, a connection request mediating unit 304, a transmission source information changing unit 305, and a communication processing unit 306.

  The communication processing unit 306 is a processing unit that performs general-purpose communication with respect to packets transmitted and received by the server 205. The communication processing unit 306 receives a packet transmission request from another processing unit, and delivers a packet received from another communication device to the corresponding processing unit. When a packet transmission request from another processing unit is accepted (or when a socket generation for transmission / reception is requested), unless otherwise specified, the server 205's own global IP address (IPs_G) is automatically transmitted. The packet is transmitted with the original address set.

The dummy address storage unit 302 stores information related to dummy addresses (address: IPd_G, port number: Pd_G). The home device information DB 301 is a database that stores home device communication information. Here, the home device communication information includes at least the following information for the home device 201 being registered (that is, the home device that has completed the home device registration phase (step S101)).
・ Information for identifying home devices (hereinafter referred to as device ID)
The global IP address of the home device. The transmission source port number of the packet periodically transmitted from the home device to the dummy address. In addition, information for authenticating the home device may be included.

  The home appliance registration processing unit 303 performs processing corresponding to the home appliance registration phase (step S101) of FIG. That is, a registration packet (packet a in FIG. 9) is received from the in-home device 201 to determine whether registration is possible. If registration is possible, the home device communication information is acquired and registered in the home device information DB 301. Acquisition of in-home device communication information may include one or more packet transmissions / receptions. Further, packet transmission / reception using the address of the server 205 itself may be performed. Note that a specific method for acquiring in-home device communication information will be described later.

  The connection request mediation unit 304 performs processing corresponding to the connection request phase (step S106) in FIG. That is, a connection request (packet b in FIG. 9) to the home device 201 is received from the outside device 202, and a connection request packet (packet c in FIG. 9) is transmitted to the home device 201 in response to the connection request. Here, the destination of the packet received from the outside device 202 is the address (IPs_G) of the server 205. Further, the address (IPi_P) of the home device 201 stored in the home device information DB 301 is set as the transmission destination of the packet to be transmitted to the home device.

  The transmission source information changing unit 305 is a processing unit that rewrites transmission source information for a connection request packet that the connection request mediating unit 304 intends to transmit to the home device 201. The dummy address related information is read from the dummy address storage unit 302, and the transmission source information (S-IP, S_Port) of the connection request packet is changed to the dummy address related information (IPd_G, Pd_G).

[Configuration of home device 201]
Next, a specific configuration of the home device 201 in which the communication method according to the first embodiment of the present invention is implemented will be described using FIG. FIG. 10 is a block diagram illustrating a configuration example of the home device 201 according to the first embodiment of the present invention. In FIG. 10, a home device 201 includes a server address storage unit 401, a dummy address storage unit 402, a communication processing unit 403, a registration packet processing unit 404, a periodic packet transmission unit 405, a connection request packet processing unit 406, and a home device. -The communication processing part 407 between apparatuses outside a house is provided.

  The server address storage unit 401 stores related information (address: IPs_G, port number: Ps_G) of the server 205 address. The dummy address storage unit 402 stores information related to dummy addresses (address: IPd_G, port number: Pd_G). The communication processing unit 403 is a processing unit that performs general-purpose communication with respect to packets transmitted and received by the home device 201. The registration packet processing unit 404 is a processing unit that performs processing corresponding to the home appliance registration phase (step S101) of FIG. That is, the registration packet processing unit 404 performs processing such as transmitting a registration packet to the server 205 in order to register its own address information. The periodic packet transmission unit 405 is a processing unit that performs processing corresponding to the periodic transmission phase (step S104) in FIG. That is, the periodic packet transmission unit 405 periodically transmits packets to the dummy address.

  The connection request packet processing unit 406 receives the connection request packet transmitted from the outside device 202 and requests the communication processing unit 407 between the in-home device and the outside device for communication processing. Note that the connection request packet processing unit 406 may return a response packet of the connection request packet to the server 205. The in-home device-external device communication processing unit 407 is a processing unit that performs processing corresponding to the in-home device-external device communication phase (step S110) in FIG. That is, the in-home device-external device communication processing unit 407 performs processing corresponding to the connection request from the external device 202. This specific process changes depending on the system. For example, the in-home device-outdoor device communication processing unit 407 may start the connection to the out-of-home device 202 by receiving the connection request packet, or does not start the connection to the out-of-home device 202. In addition, a predetermined process may be performed.

  Note that the periodic transmission packet in the home appliance registration phase (step S101) may be transmitted from the registration packet processing unit 404 or may be transmitted from the periodic packet transmission unit 405.

  As described above, the out-of-home access system according to the first embodiment of the present invention directs the packet periodically transmitted by the home device 201 to a dummy address that is an address different from the address of the server 205. Therefore, the number of packets that reach the server 205 is reduced, and the processing load on the server 205 can be reduced. Even if the server 205 does not receive a packet from the home device 201, the NAT hole in the home router 203 is maintained by a packet that the home device 201 periodically transmits to the dummy address. Therefore, it is possible to reduce only the processing load of the server 205 while securing a route for transmitting the connection request packet from the server 205 to the home device 201. Furthermore, since the packet transmitted / received by the in-home device 201 does not include the address of the server 205, the risk that an attacker knows the standby port of the server 205 is reduced. Further, even if the attacker performs a DoS attack addressed to the dummy address, the packet does not reach the server 205, so the server 205 does not fall out of processing.

  In the present embodiment, a single dummy address has been described. However, the home device 201 and the server 205 can have a plurality of dummy addresses. Further, the present invention does not depend on a dummy address determination method or a dummy address operation method. For example, when there are a plurality of dummy addresses and the combination of the home device 201 and the dummy address is fixed, the home device 201 records information related to the dummy address at the time of factory shipment. The server 205 changes the transmission source address of the connection request packet transmitted to the home device 201 to a dummy address corresponding to the home device 201 by holding a table indicating the correspondence between the home device 201 and the dummy address. Can do.

  For example, when there are a plurality of dummy addresses and the combination of the home device 201 and the dummy address is variable, the home device 201 selects the dummy address in the registration phase (step S101). The server 205 obtains the dummy address selected by the home device 201 by notifying the dummy address in a packet transmitted from the home device 201 to the server 205.

  By using a plurality of dummy addresses, the following advantages are produced in the home access system. For example, by using a plurality of dummy addresses, an attacker who performs a DoS attack or the like needs to examine a dummy address that is used for each attack, so that the attack becomes more difficult. Further, for example, in a system including the server side FW 507 (see FIG. 13), by setting a plurality of dummy addresses, packets addressed to different dummy addresses can be received by different FWs, and the load of the FW Can be dispersed.

  Further, the server 205 described in the present embodiment is not limited to one communication device. The processing of the server 205 described in the present embodiment may be realized by the entire server group in which a plurality of communication devices are collected.

  In the present embodiment, the processing sequence of the remote access system has been described by taking the network configuration of the remote control system (FIG. 2) as an example, but the same processing can be performed in the network configuration of the P2P connection system. FIG. 11 is a diagram illustrating an example of a network configuration when the out-of-home access system is a P2P connection system. In FIG. 11, the outside access system that is a P2P connection system realizes one-to-one communication between a home device 201a connected on the LAN 206a and a home device 201b connected on the LAN 206b. .

  FIG. 12 is a sequence diagram illustrating a communication method when the outside-home access system is a P2P connection system. Hereinafter, the operation different from the remote access system of the remote control system described above will be described for the remote access system that is a P2P connection system. Referring to FIG. 12, as an initial state, in-home device 201a, in-home device 201b, and server 205x share the related information of the dummy address in advance by some method.

  In the home device registration phase (step S101x), the home device 201a and the home device 201b transmit a registration packet to the server 205x. The server 205x uses the registration packet received from the home device 201a and the home device 201b as a trigger, and the global address information (global IP address: IPo_G, port number: Po_G) of the home device 201a and the global address information ( Global IP address: IPi_G, port number: Pi_G) is acquired (steps S102a and S102b). The server 205x registers the acquired global address information of the home device 201a and the home device 201b in the database (step S103x).

  In the periodic transmission phase (step S104x), the in-home device 201a and the in-home device 201b periodically transmit packets for dummy addresses (address: IPd_G, port number: Pd_G) (steps S105a, S105b). At this time, global address information of the home device 201a and the home device 201b registered in the server 205x in the home device registration phase (step S101x) is set as the transmission source information in the packet periodically transmitted. Specifically, global address information (global IP address: IPo_G, port number: Po_G) of the home device 201a is set as transmission source information in a packet periodically transmitted by the home device 201a. In addition, global address information (global IP address: IPi_G, port number: Pi_G) of the home device 201b is set as transmission source information in a packet periodically transmitted by the home device 201b. Further, the time interval at which this periodic transmission packet is transmitted is a time interval at which the entry is not deleted from the NAPT table on the router 203 (that is, the entry is maintained).

  The connection request phase (step S106x) is a phase for requesting connection from the home device 201a to the home device 201b or from the home device 201b to the home device 201a. In FIG. 12, only the case where a connection is requested from the in-home device 201a to the in-home device 201b is described. However, the in-home device 201b can also request a connection from the in-home device 201a.

  It should be noted that the out-of-home access system that is a P2P connection system may further include a Port prediction conversion phase as described with reference to FIG. 15 after the connection request phase. The Port conversion prediction phase is a process that is specially required in the P2P connection system. In the Port prediction conversion phase, the in-home device 201a and the in-home device 201b predict a global IP address / port number combination that can be used for communication between the devices, for example, by transmitting a plurality of packets.

(Second Embodiment)
Next, a communication method for remote access according to the second embodiment of the present invention will be described. In the first embodiment, the method of estimating the converted port number (T-Port) of the home device 201 has been described as the processing method of the home device registration phase (step S101). In this method, the in-home device 201 transmits a packet separately for the server 205 and the dummy address.

  In the second embodiment, another processing method in the home appliance registration phase (step S101) will be described. In the following second embodiment, the same equipment and configuration as those of the first embodiment are denoted by the same reference numerals and description thereof is omitted. FIG. 13 is a block diagram illustrating an example of a network configuration of an out-of-home access system according to the second embodiment of the present invention. The difference from the network configuration (FIG. 1) in the first embodiment is that a server-side firewall 507 and a server-side network 508 are added.

  In FIG. 13, the server 505 differs from the server 205 in the first embodiment in the processing in the home appliance registration phase. Similarly, the processing in the home device registration phase is different for the home device 501. The server side network 508 is a network including the server 505, and is connected to the external network 204 through the server side firewall 507. Although not shown in FIG. 13, in the present embodiment, it is assumed that the dummy address is an address belonging to the server-side network 508. That is, the packet addressed to the dummy address is assumed to reach the server side firewall 507 once.

  Next, the processing sequence of the communication method of the remote access system according to the second embodiment of the present invention will be described using FIG. FIG. 14 shows only the processing corresponding to the home appliance registration phase (step S101) and the periodic transmission phase (step S104) in FIG. 2, and the subsequent processing is the same as in the first embodiment. It shall be. In the second embodiment, the home appliance registration phase (step S601) is realized by the server-side firewall 507 switching the transfer destination of the packet addressed to the dummy address. Specifically, the in-home device 501 provides a field called CommandType in the payload of a packet transmitted to the dummy address, and sets the CommandType to “registration mode” when the in-home device 501 transmits a registration request packet. (Step S602). On the other hand, when transmitting the periodic transmission packet, the in-home device 501 sets CommandType to “periodic transmission” (S606).

  The server-side firewall 507 that has received the packet addressed to the dummy address switches the transfer destination by looking at the CommandType field. Specifically, when the destination address is a dummy address and the CommandType is “registration mode”, the packet is transferred to the server 505 (step S603). On the other hand, if the CommandType field is set to “periodic transmission”, the packet is discarded as it is (step S607).

  The server 505 can receive only the registration request packet transmitted from the home device 501 by this processing of the server side firewall 507, and is registered in the desired communication information of the home device 501 (the entry in the NAPT table of the periodic transmission packet). Information) can be obtained from the packet. Therefore, the server 505 can reduce the processing load. Further, in this embodiment, since the packet transmitted from the home device 501 does not include any server 505 address, the server address is not leaked to the attacker, and the possibility of a DoS attack or the like can be reduced.

  The outside access system of the present invention is useful when a communication device outside the home communicates with a communication device inside the home.

1 is a block diagram showing an example of a network configuration of an external access system according to a first embodiment of the present invention The sequence diagram which shows the communication method of the outside access system which concerns on the 1st Embodiment of this invention Diagram showing the structure of a periodic transmission packet The figure which shows an example of the NAPT table on the router 203 Diagram showing the structure of a connection request packet The figure which shows the specific process sequence of in-home apparatus registration phase (step S101) Diagram showing the structure of a registration request packet The figure which shows an example of the NAPT table on the router 203 FIG. 2 is a block diagram showing a configuration example of a server 205 according to the first embodiment of the present invention. The block diagram which shows the structural example of the household appliance 201 which concerns on the 1st Embodiment of this invention. The figure which shows an example of a network structure in case a remote access system is a P2P connection system Sequence diagram showing a communication method when the remote access system is a P2P connection system The block diagram which shows an example of the network configuration of the outside access system which concerns on the 2nd Embodiment of this invention The sequence diagram which shows the communication method of the remote access system which concerns on the 2nd Embodiment of this invention Diagram explaining the outline of the conventional method The figure which shows the state of the NAPT table of router B806 The figure which shows the login request packet transmitted from client B801. The figure which shows the login response packet transmitted from the lobby server 805

Explanation of symbols

201, 501 Home device 202 Outside device 203, 803, 806 Router 204, 804 External network 205, 505, 805 Server 206 LAN
301 Home appliance information DB
302 dummy address storage unit 303 home appliance registration processing unit 304 connection request mediation unit 305 transmission source information change unit 306 communication processing unit 401 server address storage unit 402 dummy address storage unit 403 communication processing unit 404 packet processing unit for registration 405 periodic packet Transmission unit 406 Connection request packet processing unit 407 In-home device-external device communication processing unit 507 Server-side firewall 508 Server-side network 801 Client B
802 Client A

Claims (9)

In an external network, a server that mediates communication between a first communication device connected to a local area network via a router and a second communication device connected to a second network different from the local area network There,
A dummy address storage unit that stores information related to the dummy address, using a destination address of a packet that is different from its own address and periodically transmitted by the first communication device as a dummy address;
In-home device information DB, which is a database for storing source information of packets periodically transmitted by the first communication device as first in-home device information;
The first communication device acquires the first home device information from the first communication device when receiving a registration packet transmitted to register the address information of the first communication device, and the home device information DB A home device registration processing unit to register with
When a packet requesting connection to the first communication device is received from the second communication device, connection is made to the first communication device based on information stored in the home device information DB A connection request mediation unit that transmits a request packet;
Based on the information stored in the dummy address storage unit, a transmission source information change unit that changes the transmission source information of the connection request packet transmitted from the connection request mediation unit to information related to the dummy address; Comprising a server. The second network is a local area network different from the local area network to which the first communication device is connected;
The first communication device and the second communication device perform a one-to-one interconnection,
The dummy address storage unit is an address different from its own address, and the destination address of a packet periodically transmitted by the first communication device and the second communication device is used as a dummy address and related to the dummy address. Save the information you want to
The in-home device information DB uses the transmission source information of a packet periodically transmitted by the first communication device as first in-home device information, and the transmission source information of a packet periodically transmitted by the second communication device. Is stored as second home device information,
The in-home device registration processing unit further receives the registration packet transmitted by the second communication device for registering its own address information, from the second communication device to the second in-home device. Information is acquired and registered in the home appliance information DB,
When the connection request mediation unit further receives a packet requesting connection from the first communication device to the second communication device, based on information stored in the in-home device information DB, The server according to claim 1, wherein the server transmits a connection request packet addressed to the second communication device. Between the server and the external network, there is a server-side firewall that distributes packets addressed to the dummy address based on a predetermined rule,
The dummy address is set in the destination of the registration packet transmitted by the first communication device,
The server-side firewall distributes the registration packet to the server based on the predetermined rule, discards the packet that the first communication device periodically transmits to the dummy address,
Upon receiving the registration packet transmitted from the first communication device for registering its own address information through the server-side firewall, the in-home device registration processing unit receives the first communication device from the first communication device. The server according to claim 1, wherein one home device information is acquired and registered in the home device information DB. The first in-home device information includes a source address and a source port number of a packet that the first communication device periodically transmits to the dummy address,
The in-home device registration processing unit further transmits a plurality of packets in which the dummy address is set as a transmission source address to the first communication device while changing a destination port number, and the first in-home device The server according to claim 1, wherein a server port number of information is estimated.   The server according to claim 1, wherein the packet periodically transmitted by the first communication device is transmitted at a time interval at which an entry does not disappear from the NAPT table of the router. A first communication device connected to a local area network via a router; a second communication device connected to a second network different from the local area network; and the first communication device in an external network. And a remote access system comprising a server that mediates communication with the second communication device,
The first communication device is:
A dummy address storage unit for storing information related to the dummy address, the address being different from the address of the server, and an address shared with the server as a dummy address;
A registration packet processing unit that transmits a registration packet to the server to register its own address information;
A periodic packet transmitter for periodically transmitting packets to the dummy address;
A connection request packet processing unit that receives a packet requesting connection transmitted from the other communication device via the server;
The second communication device transmits a packet requesting connection to the first communication device;
The server
A dummy address storage unit that stores information related to the dummy address, using a destination address of a packet that is different from its own address and periodically transmitted by the first communication device as a dummy address;
In-home device information DB, which is a database for storing source information of packets periodically transmitted by the first communication device as first in-home device information;
The first communication device acquires the first home device information from the first communication device, triggered by reception of a registration packet transmitted to register its own address information, and the home device information DB A home device registration processing unit to register with
When a packet requesting connection to the first communication device is received from the second communication device, connection is made to the first communication device based on information stored in the home device information DB A connection request mediation unit that transmits a request packet;
Based on the information stored in the dummy address storage unit, a transmission source information change unit that changes the transmission source information of the connection request packet transmitted from the connection request mediation unit to information related to the dummy address; A remote access system comprising: A communication device that is connected to a local area network via a router and that implements predetermined communication with another communication device connected to a network different from the local area network via a server connected to an external network Because
A server address storage unit for storing information related to the server address;
A dummy address storage unit for storing information related to the dummy address, the address being different from the address of the server, and an address shared with the server as a dummy address;
A registration packet processing unit that transmits a registration packet to the server to register its own address information;
A periodic packet transmitter for periodically transmitting packets to the dummy address;
A communication device comprising: a connection request packet processing unit that receives a packet requesting a connection transmitted from the other communication device via the server. A communication method executed by a server that mediates communication between a first communication device connected to a local area network via a router and a second communication device connected to a second network different from the local area network Because
The server is
Receiving a registration packet that the first communication device transmits to register its address information;
An acquisition step of acquiring transmission source information of a packet periodically transmitted by the first communication device as the first home device information, triggered by reception of the registration packet;
Receiving from the second communication device a packet requesting connection to the first communication device;
A connection requesting step for transmitting a packet for requesting connection to the first communication device based on the first in-home device information acquired in the acquiring step;
The transmission source address of the packet requesting the connection is changed to the dummy address with the destination address of the packet periodically transmitted by the first communication device as a dummy address, which is different from its own address. A communication method comprising a transmission source information change step. A first communication device connected to a local area network via a router communicates with a second communication device connected to a network different from the local area network via a server connected to an external network. Communication method,
The first communication device is
Sending a registration packet to the server to register its address information;
A packet that is different from the address of the server and that is shared with the server as a dummy address, and periodically transmits packets to the dummy address;
Receiving a packet for requesting a connection transmitted from the second communication device via the server.

Images