JP2007104593A - Individual network inter-access system - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To provide an individual network inter-access system capable of suppressing an increase in network traffic around an administration server. <P>SOLUTION: Server groups apparently viewed as one group on networks are interconnected by an overlay network and routing information is delivered into the network for executing routing with respect to communication via fixed networks among separate system mobile networks unable to directly deliver the routing information to the fixed networks. Thus, the load imposed on access destination administration at connected terminals is relieved, and avoidance of a single fault point and load distribution are executed at the same time, so that the stability of network services and ease of the administration can be enhanced. <P>COPYRIGHT: (C)2007,JPO&INPIT

Description

  The present invention relates to a system for performing interconnection by an overlay network configured on a wide area network in a wide area network such as a fixed network, a wireless network, or a network including both, with respect to individual networks connected thereto.

  Conventionally, in order to connect private networks connected to a wide area network, the private networks are connected by a VPN (Virtual Private Network), and communication is established by forming tunneling on the wide area network. On the other hand, a VPN management server is prepared when there are a large number of VPN connection destinations or when there is a change in the connection destinations dynamically. Then, the VPN management server inquires about the connection destination and connects all the private networks in a mesh form, or configures and connects a star-shaped VPN network with the VPN management server as the center. Related techniques are disclosed in Patent Documents 1 and 2 below.

By the way, when all private networks are connected in a mesh shape, the management server may become a single point of failure. Furthermore, a server capable of establishing many private networks and VPNs on the private network side is essential. When the private network side is a mobile network, the gateway connected to the wide area network may change dynamically, making it difficult to place a server. Furthermore, there has been a problem that management of information related to the connection destination on the terminal side by connecting in a mesh form becomes complicated.
JP 2005-25756 A JP 2005-57693 A

As described above, when a star-shaped VPN network is configured with the management server as the center, the management server may become a single failure point, and the fault tolerance performance is difficult. In addition, since all communication is performed via the VPN management server, there is a problem that a load is applied to the VPN management server and network traffic increases in a network close to the VPN management server.
The present invention has been made in view of the above circumstances, and an object thereof is to provide an individual network mutual access system capable of suppressing an increase in network traffic in the vicinity of a management server.

  In order to achieve the above object, according to one aspect of the present invention, a wide area network, an individual network connected to the wide area network and having an address system different from the address system of the wide area network, and the individual networks are connected to the wide area network. An individual network mutual access comprising: an overlay network including a server group having a common virtual address and an individual address for connection via a network; and an overlay network management server for managing the overlay network A system is provided.

  In such a configuration, regarding a system using a management server installed on a wide area network, consider a star-shaped network centered on the management server. This management server is provided with redundancy, and the management servers are networked to construct an overlay network. Each management server has the same address and can be seen as one machine from the gateway of the private address. It is assumed that a plurality of private network gateways are connected to each management server and the route information of each private network is raised. According to this route information, when establishing a route and communicating between private networks, access is made to another network via an overlay network constructed on a wide area network.

  According to the present invention, it is possible to provide an individual network mutual access system capable of suppressing an increase in network traffic near the management server.

Embodiments of the present invention will be described in detail below with reference to the drawings.
FIG. 1 is a diagram showing an example of an individual network mutual access system according to the present invention. The individual network mutual access system of FIG. 1 is formed with an overlay network 500 including a plurality of overlay network servers (ONS) 100 (100a to 100e) as a core. The overlay network 500 is managed by an overlay network management server (ON management server) 200. Each server 100, 200 is connected to a fixed network 300 (300a to 300e), and each fixed network 300 is connected to a mobile network MANET 400 (400a to 400e).

  The overlay network server 100 is a device installed on the fixed network 300 and has a unique address. Furthermore, the overlay network server 100 has a function of being able to connect to any overlay network server 100 with a unique address as viewed from the MANET 400 side. Thus, the overlay network server 100 can configure an overlay network with other overlay network servers 100. Note that the function of the overlay network server 100 can be realized by either hardware or software.

  FIG. 2 is a functional block diagram of the overlay network server 100 of FIG. The overlay network server 100 includes a control device 110 that controls the entire device, a MANET side VPN connection accepting device 120 that accepts and maintains a VPN connection from the MANET 400, and an overlay network management server when the device is connected to the overlay network. 200, an overlay network connection destination resolution apparatus 130 that resolves a connection destination by receiving an inquiry from another overlay network server 100 to be connected, and an overlay network 500 that is connected to another overlay network server 100 An overlay network connection device 140 that can perform the overlay network server 100, and the overlay network server 100 constituting the overlay network 500 and the network. An overlay network route control device 150 that exchanges routes related to the MANET-configured wireless device 600 constituting the ANET 400 and establishes route information, a fixed network connection device 160 that connects to the fixed network 300, and stores various information. And a storage unit 170.

  The route exchange protocol used in the overlay network route control device 150 may be any protocol such as RIP, OSPF, IS-IS. As long as the fixed network connection device 160 can be connected to the fixed network 300, any device may be used.

  The storage unit 170 manages a path information storage device 171 that manages path information, an IF information storage device 172 that stores information on a logical interface created by overlay network connection, and a connection destination address of the overlay network management server 200. The overlay network management server information storage device 173 is stored.

  FIG. 3 is a functional block diagram showing the overlay network management server 200 of FIG. The overlay network management server 200 includes a control device 210, a fixed network connection device 220, an overlay network server connection device 230, a connection destination distribution device 240, and an overlay network server information storage device 250. The functions of the overlay network management server 200 are mainly server registration and management from the overlay network server 100 and server inquiry for setting up an overlay network. This apparatus may be a dedicated apparatus or may be implemented as software on a PC, and may be realized by hardware or software.

  The control device 210 is a device for controlling the device, and performs cooperation with various processing units and overall control. The fixed network connection device 220 is a device for connecting to the fixed network 300, and may be of any mounting form, such as its shape and electrical signal format, as long as it can be connected to the fixed network 300.

  The overlay network server connection device 230 is a device that registers a server from the overlay network server 100 and inquires about a configuration server on the overlay network 500. At the time of registration, processing such as authentication may be performed, and it is necessary to provide information for identifying the server in the registration sequence. The registered server information is registered in the overlay network server information storage device 250 together with information that can uniquely determine the server. Further, after this process or when a connection destination inquiry request is received along with this process, the overlay network server 100 to be inquired is determined by the connection destination distribution apparatus 240.

  The connection destination distribution device 240 inquires about another server 100 to be connected to the overlay network server 100 that has inquired. The number of servers to be inquired at the time of server inquiry is arbitrary, and the operation manager may set the number of inquiries regardless of whether one is inquired from all of them or all of them are inquired. Since the server to be inquired is registered in the overlay network server information storage device 250, the server information is determined and extracted from this device by an arbitrary logic for the necessary number, and is returned to the inquiring overlay network server 100. The logic for selecting the server may be random, network information about the location, metric information with the apparatus, or other methods. However, according to the logic to be used, it is necessary to acquire necessary information at the time of registration by this apparatus and register it in the overlay network server information storage apparatus 250.

  The fixed network 300 is a network in which the overlay network server 100 and the overlay network management server 200 are installed, and each network can communicate. If this network can communicate with each other, it may be configured by a wired network, a wireless network, or by these two, and thus can be said to be a backbone network. In addition, MANET 400 can be connected to the backbone network.

  The MANET 400 is a network configured by mobile devices, and is configured by an address system different from the address system of the fixed network 300. Therefore, the MANET 400 address cannot flow on the fixed network 300, and the two networks cannot communicate directly. The MANET 400 includes one or more aggregates of the MANET configuration wireless devices 600. This network may be configured wirelessly or wired. The network system may be a private network address or a global address. The routing protocol used in this network may be a MANET protocol such as AODV or a LAN protocol such as OSPF.

  The overlay network 500 is a network configured by the overlay network server 100 on the fixed network 300, and is a virtual network realized by an upper protocol. In this embodiment, the overlay network 500 has a function that allows connection from the MANET 400 by a unique address. Specifically, this function may be realized by using all the overlay network servers 100 with the same address. In addition, the overlay network server 100 has a function of transferring communication from the MANET 400, and realizes a function of determining and routing the MANET-configured wireless device 600 that is a connection destination. As described above, this is due to RIP or OSPF. Each overlay network server 100 has a unique address, which connects the servers to form an overlay network.

  The MANET configuration radio apparatus 600 is an apparatus constituting the MANET 400, and at least one of them is connected to the fixed network 300. In this embodiment, it is assumed that MANET 400 is a wireless network and a MANET routing protocol such as AODV is used as a routing protocol.

  As shown in FIG. 4, the MANET configuration wireless device 600 includes a control device 610, a fixed network connection device 620, an overlay network server connection device 630, a wireless communication device 640, an overlay network server information storage device 650, and a MANET. A route information storage device 660.

  The control device 610 is a device that controls the entire device, and assigns each internal device. The fixed network connection device 620 is a device for connecting to the fixed network 300, and acquires an address from the fixed network. The overlay network server connection device 630 is a device for connecting to any one of the overlay network servers 100 to perform VPN connection, and information necessary for connecting to the overlay network server 100 from the overlay network server information storage device 650 ( The address or name of the overlay network server 100 is acquired, and a VPN connection is made to the overlay network server 100. At the time of connection, route information of the own MANET is acquired from the MANET route information storage device 660 and transmitted to the connection destination overlay network server 100. In addition, when there is a change in the route information, there is a means for transmitting only the difference each time, transmitting the whole periodically, or notifying the change in some form.

  In the present embodiment, the wireless communication device 640 is a device for performing communication on MANET. Through this device, MANET route information is collected. The overlay network server information storage device 650 is a device that stores information related to the overlay network server 100 to be connected, and stores information on addresses and names that the overlay network server 100 has in common. This information is assumed to be registered in advance. The MANET route information storage device 660 is a device having own MANET route information.

  Next, the operation of the above configuration will be described. Here, when the overlay network server 100b is connected to the fixed network 300b and the overlay network 500, when the MANET 400a is connected to the fixed network 300b and the overlay network server 100b, and from the MANET-configured wireless device 600a connected to the MANET 400a, another MANET 400e. A case where information is transmitted to the MANET-configured radio apparatus 600e connected to the network will be described below.

  FIG. 5 is a flowchart showing a processing procedure of the overlay network server 100 when connected to the fixed network 300 and the overlay network 500. As shown in FIG. 1, in a network in which fixed networks 300a, b, c, d, e are laid, overlay network servers 100a, c, d, e are installed on the fixed networks 300a, c, d, e, respectively. Suppose that Here, consider a case where the overlay network server 100b is installed on the fixed network 300b.

  First, it is assumed that the overlay network server 100b is connected to the fixed network 300b via the fixed network connection device 160 (step S11). Then, the control device 110 detects this or receives an activation command from the outside, and activates the overlay network connection destination resolution device 130. The overlay network connection destination resolution device 130 first connects to the overlay network management server information storage device 173 and acquires information for connecting to the overlay network management server 200.

  For example, as shown in FIG. 6, the overlay network management server information storage device 173 manages overlay network management server connection destination information, and passes primary and secondary information to the overlay network connection destination resolution device 130 as a response. Based on these pieces of information, the overlay network connection destination resolution device 130 connects to the overlay network management server 200 (step S12). At this time, an address unique to the overlay network server 100b is used as the transmission source address.

  The overlay network management server 200 receives this communication and performs processing in the overlay network server connection device 230. As a flow of processing, authentication may be performed first to verify the validity of the overlay network server 100b. As this method, a method based on a device ID or a certificate may be used. In this case, a storage unit for storing information necessary for authentication and a control unit for performing the processing are separately provided. Next, information (IP address or the like) for identifying a terminal and a connection destination inquiry request are transmitted from the overlay network connection destination solution apparatus 130. Actually, the connection destination inquiry request may be sent separately.

  The overlay network server connection device 230 receives this, and is registered in the overlay network server information storage device 250 together with information that can uniquely determine the server. The overlay network server connection device 230 that has received the connection destination inquiry request passes this request to the connection destination distribution device 240. The number of servers to be inquired at the connection destination distribution device 240 at the time of server inquiry is arbitrary, and even if one of them is inquired, all of them are inquired, or the operation manager sets the number of inquiries. good. Since the server to be inquired is registered in the overlay network server information storage device 250, server information is determined from this device by an arbitrary logic for the required number, and is returned to the overlay network server connection device 230.

  The overlay network server connection device 230 returns this information to the inquiring overlay network server 100. In this embodiment, it is assumed that 100a and 100c are returned. The logic for selecting the server may be random, network information about the location, metric information with the apparatus, or other methods. However, according to the logic to be used, at the time of registration, it is necessary to acquire necessary information by this apparatus and register it in the overlay network server information storage apparatus 250. Upon receiving this, the overlay network server 100b passes this information to the overlay network connection device 140 (step S13).

  The overlay network connection device 140 connects to the overlay network servers 100a and 100c to configure the overlay network 500 based on the received information (step S14). At this time, mutual authentication may be performed. The overlay network connection device 140 connects to the overlay network connection device 140 included in each of the connection destination overlay network servers 100a and 100c, and creates a logical interface.

  The information on the logical interface is managed as shown in FIG. 7, for example, and stored in the IF information storage device 172. In FIG. 7, an IF ID is assigned to each logical interface and stored together with address information of the destination to which the IF is connected. The MANET IF column indicates whether the connection destination is MANET 400. The logical interface may periodically check for survival.

  When the connection is completed, route information is transmitted and received (steps S15 and S16). The route information relates to the MANET configuration radio apparatus 600 that is a component of the MANET 400 connected to each overlay network server 100. The route information may be a general routing protocol such as RIP or OSPF, or may be unique. Thereby, the overlay network server 100b can know the route information of the MANET-configured wireless devices in the MANETs 400c, d, e, and f connected to the overlay network servers 100a, c, d, and e. Such route information is managed as shown in FIG. 8 and stored in the route information storage device 171. Based on this, the route table is formed with priority on the one with the smallest metric.

  Next, the connection of the MANET 400a to the fixed network 300b and the overlay network server 100b will be described. FIG. 9 is a flowchart showing the processing procedure. When the MANET 400a connects to the fixed network 300b, any one MANET-configured wireless device 600 connects via the fixed network connection device 620. When connected to the fixed network 300b, the fixed network connection device 620 acquires an address in a form according to the network address system of the fixed network 300b. This may be set manually by DHCP or manually.

  In order to connect to the overlay network server 100 from the overlay network server information storage device 650, the control device 610 detects this when connected to the fixed network 300b, or the overlay network server connection device 630 is activated by a manual trigger. Get information about. This information is assumed to be manually input in advance. The overlay network server connection device 630 attempts to connect to the overlay network server 100. The overlay network server 100b is connected to the fixed network 300b to which the MANET 400a is connected, and the address held in common by the overlay network server 100 is assumed to be 10.1.1.1/24 here. For example, the network address 10.1.1.0 is advertised everywhere in the fixed network 300.

  As a result, the overlay network server connection device 630 that has issued a connection request to the address 10.1.1.1 of the overlay network server 100 is connected to the overlay network server 100b located closest to the metric. The overlay network server 100b accepts this connection by the MANET side VPN connection accepting device 120 (step S21). At this time, mutual authentication may be performed between the two. The overlay network server connection device 630 and the MANET side VPN connection acceptance device 120 communicate to establish a VPN. Thereafter, the MANET-configured radio apparatus 600 does not accept other communications from the fixed network and does not perform communications other than through the VPN.

  When the VPN is established, the MANET configuration wireless device 600 becomes the default gateway of the MANET 400a and advertises this information in the MANET 400a. On the other hand, in the overlay network server 100b, the MANET side VPN connection accepting device 120 notifies the control device 110 that the VPN has been established. In response to this, the control device 110 assigns an IF ID as a new logical interface and stores it in the IF information storage device 172 together with the address information of the destination to which the IF is connected. At this time, in the MANET IF column, it is input that the connection destination is MANET400.

  The overlay network server connection device 630 extracts the route information of the MANET-configured wireless device 600 connected in the MANET 400a from the MANET route information storage device 660, and transmits the route information to the MANET side VPN connection accepting device 120. The MANET side VPN connection accepting device 120 receives this (step S23) and passes it to the overlay network route control device 150. The overlay network route control device 150 stores and updates this information in the route information storage device 171 together with appropriate metric information and a logical interface (step S23). If RIP is used for route control in the overlay network 500, route communication is performed at regular intervals, and if OSPF is used, only the difference is directly connected to the overlay network when the route information is updated. The other overlay network servers 100a and 100c are advertised. As a result, all routes of the MANET configuration wireless device 600 connected to the MANET 400a are transmitted to the overlay network 500 (step S24).

  Next, a case where information is transmitted from the MANET-configured radio apparatus 600a connected to the MANET 400a to the MANET-configured radio apparatus 600e connected to another MANET 400e will be described. When the MANET-configured radio apparatus 600a transmits data to the MANET-configured radio apparatus 600e connected to another MANET 400e, the data is first transmitted from the radio communication apparatus 640 of the MANET-configured radio apparatus 600a. However, since the MANET-configured radio apparatus 600e does not exist in the same MANET 400a, the route cannot be resolved. Therefore, the MANET is connected to the default gateway and transmitted to the overlay network 500. This communication relays the MANET configuration wireless device in the MANET 400a and reaches the default gateway. The default gateway transfers this information as it is to the overlay network server 100b through the VPN.

  The subsequent processing flow in the overlay network server 100b is shown in FIG. The overlay network server 100b first receives communication from the wireless terminal through the MANET side VPN connection accepting device 120 (step S41). Then, the MANET side VPN connection accepting device 120 once passes the received communication to the control device 110. The control device 110 confirms the transmission destination of this communication (step S42), and passes the connection destination to the overlay network connection destination solution device 130. The overlay network connection destination resolution device 130 connects to the path information storage device 171 and resolves the transfer destination (step S43). If it has the routing table of FIG. 8 and the address of the destination MANET-configured radio apparatus 600e is 192.168.189.32, it is understood that the transfer is performed from IF2. If the error is not listed in the route table, an error such as an ICMP packet may be returned to the transmission source as an error at this time (step S46).

  It is assumed that IF2 is connected to the overlay network server 100a. The overlay network connection destination solution device 130 returns the transfer destination IF2 to the control device 110 because the transfer destination has been clarified. Since the transfer destination has been clarified, the control device 110 designates the transfer destination and passes it to the overlay network connection device 140. The overlay network connection device 140 transmits the transfer contents from the designated logical IF ID to the received transfer destination.

  The overlay network server 100a receives this, resolves the transfer destination by looking at the route information, and sends it to the next overlay network server 100e in the same manner as the overlay network server 100b. When the overlay network connection destination resolution device 130 receives this information, the overlay network server 100e passes the information to the control device 110, and the overlay network connection destination resolution device 130 reveals the transfer destination (step S44). If the transfer is not to MANET under its control here, after transferring the information to the next overlay network server (step S47), the processing procedure shifts to step S42 with the route information received from the previous overlay network server (step S42). S48).

  At this time, since the MANET-configured radio apparatus 600e is connected to the MANET 400e, the MANET IF becomes ◯ in the route table. The overlay network connection destination resolution device 130 returns the IF ID and the transfer to MANET to the control device 110. Since the control device 110 knows that the information is to be transferred to the MANET, the control device 110 passes it to the MANET side VPN connection accepting device 120. The MANET side VPN connection accepting apparatus 120 transfers this information to the gateway of the connected MANET 400e according to the IF ID (step S45).

  The MANET-configured wireless device serving as the gateway receives this information through the overlay network server connection device 630. The VPN connection from the MANET-configured wireless device functioning as a gateway to the overlay network server 100e is established with the address of the overlay network server 100e as 10.1.1.1. The control device 610 determines the route from this information to the destination address by comparing with the information in the MANET route information storage device 660, and routes to the wireless communication device 640e. Accordingly, communication from the wireless communication device 640a to the wireless communication device 640e is established.

  As described above, in this embodiment, with respect to communication via a fixed network between different address systems and mobile networks in which route information cannot flow directly to the fixed network, a server group that appears to be one on the network is represented by an overlay network. Connected and routed in this network to route. As a result, the connection destination of connection management in the terminal serving as the gateway on the private network side can be simplified as a single location, and a single failure point can be eliminated by multiplexing the connection destinations into a network. As a result, it is possible to reduce the burden of connection destination management on the connected terminal side, avoid single points of failure and load distribution at the same time, and improve network service stability and manageability. It becomes possible.

  In addition, this invention is not limited to the said embodiment as it is, In an implementation stage, a component can be deform | transformed and embodied in the range which does not deviate from the summary. In addition, various inventions can be formed by appropriately combining a plurality of constituent elements disclosed in the embodiment. For example, some components may be deleted from all the components shown in the embodiment. Furthermore, constituent elements over different embodiments may be appropriately combined.

1 is a schematic diagram of an individual network mutual access system according to a first embodiment of the present invention. The block diagram which shows the structure of the overlay network server 100 in the embodiment. The block diagram which shows the structure of the overlay network management server 200 in the embodiment. The block diagram which shows the structure of the MANET structure radio | wireless apparatus 600 in the embodiment. 5 is a flowchart when the overlay network server 100 is connected to the fixed network 300 and the overlay network 500 in the embodiment. The figure which shows the example of the overlay network management server connection destination information in the embodiment. 4 is a diagram showing an example of management of logical interface information in the embodiment. FIG. The figure which shows an example of the management of the route information in the route information storage device 171. The flowchart which shows the process sequence at the time of the connection to the fixed network 300b and the overlay network server 100b of MANET400a. 6 is a flowchart showing a processing procedure of the overlay network server 100 in the embodiment.

Explanation of symbols

  DESCRIPTION OF SYMBOLS 100 ... Overlay network server, 110 ... Control apparatus, 120 ... MANET side VPN connection acceptance apparatus, 130 ... Overlay network connection destination resolution apparatus, 140 ... Overlay network connection apparatus, 150 ... Overlay network path control apparatus, 160 ... Fixed network connection apparatus , 170 ... storage unit, 171 ... path information storage device, 172 ... IF information storage device, 173 ... overlay network management server information storage device, 200 ... overlay network management server, 210 ... control device, 220 ... fixed network connection device, 230 ... overlay network server connection device, 240 ... connection destination distribution device, 250 ... overlay network server information storage device, 300 ... fixed network, 400 ... MANET, 500 ... overlay Network, 600 ... MANET configuration wireless device, 610 ... control device, 620 ... fixed network connection device, 630 ... overlay network server connection device, 640 ... wireless communication device, 650 ... overlay network server information storage device, 660 ... MANET route information storage apparatus

Claims (6)

A wide area network,
An individual network connected to the wide area network and having an address system different from the address system of the wide area network;
An overlay network comprising a server group having a common virtual address and an individual address for connecting the individual networks to each other via the wide area network;
An individual network mutual access system comprising an overlay network management server for managing the overlay network. The individual network mutual access system according to claim 1, wherein terminals connected in the individual network have a common unique address used to participate in the overlay network. The connection between the individual networks is performed by connecting the overlay network and the individual network,
2. The individual network mutual access system according to claim 1, wherein the individual network is connected to the overlay network by the same address. The individual network mutual access system according to claim 1, wherein the individual network transmits an address in the individual network to the overlay network at the time of accessing the overlay network. 2. The individual network mutual access system according to claim 1, further comprising means for exchanging route information regarding the individual network on the overlay network. When an outgoing call from the individual network occurs to the individual network, the overlay network is routed according to a destination address, and the outgoing call is relayed to a target individual network via a connected VPN (Virtual Private Network). The individual network mutual access system according to claim 1.

Images