JP2007110387A - Vpn connecting system and method for connecting vpn - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To provide a VPN connecting system facilitating the setting work of a VPN connection and being capable of flexibly changing a device at the connecting place of the VPN connection. <P>SOLUTION: A specified communication connection is used by taking an operation displaying users' VPN-start indication for a connecting-place device 2 as an opportunity. The connecting-place device 1 is informed automatically of the VPN connecting parameter of the connecting-place device 2. The connecting-place device 1 establishes and processes a new VPN connection by using the parameter. <P>COPYRIGHT: (C)2007,JPO&INPIT

Description

  The present invention relates to a VPN connection system and a VPN connection method for performing VPN (Virtual Private Network) connection between devices.

In order to establish a VPN connection between a plurality of devices such as a server and a client terminal connected via a communication network, settings are required for each device. This setting is a setting of a global IP address assigned to a partner device of VPN connection or a setting of authentication information for connecting to the partner device. As described above, Non-Patent Document 1 discloses a technique for performing settings for each apparatus that performs VPN connection.
"Let's try various ways to connect between sites using two remote access routers", "online", "October 04, 2005 search", Internet <URL: http: //buffalo.melcoinc .co.jp / products / catalog / network / remoteaccess / setup / f01.html>

  By the way, when setting a device for VPN connection as described above, the user who performs the setting work has obtained the global IP address and authentication information of the connection destination device, and the user is familiar with the device setting operation. It is assumed that. Therefore, there is a situation where it is not easy for a user who lacks such knowledge to make settings. Further, when the device is set, the VPN connection destination device is limited until the device setting is performed again, and therefore it is not possible to flexibly select an arbitrary device as the connection destination. Furthermore, in the case of a communication network configuration in which the global address of the VPN connection destination device is dynamically changed, there is a problem that the device setting operation has to be repeated many times, and such a communication network. Even when the dynamic DNS technology is used in the form, there is a problem that the technology related to the setting must be familiar.

  SUMMARY OF THE INVENTION An object of the present invention is to provide a VPN connection system and a VPN connection method capable of facilitating a VPN connection setting operation and flexibly changing a VPN connection destination device.

  In order to achieve the above object, the present invention provides a VPN connection system for establishing a connection of a VPN (Virtual Private Network) connection between a connection source device and a connection destination device, wherein the connection destination device is a predetermined device. After the connection of the communication connection is completed or after detecting the connection request, the connection source device holds at least a transmission destination address and authentication information addressed to the own device to the connection source device using communication in the predetermined communication connection. VPN connection destination parameter transmission means for transmitting a VPN connection destination parameter for use in a new VPN connection, wherein the connection source device is addressed to the transmission destination address included in the VPN connection destination parameter received from the connection destination device. VPN connection establishment request means for transmitting a connection establishment request for the VPN connection holding the authentication information included in the VPN connection destination parameter. The connection destination device includes authentication means for authenticating establishment of a VPN connection based on authentication information included in the connection establishment request, and the connection destination device responds to the connection establishment request when the authentication is completed. A connection establishment request response means for transmitting a connection establishment request response to the connection source device, wherein the connection source device and the connection destination device receive or transmit the connection establishment request response between each other device. A VPN connection system comprising VPN connection establishment means for performing a VPN connection establishment process.

  According to the present invention, in the VPN connection system, when the predetermined communication connection is a communication connection used for a telephone, the connection destination apparatus receives a VPN connection information instruction reception instruction for receiving a VPN connection destination parameter transmission instruction. Means for transmitting the VPN connection destination parameter to the transmission source device by the VPN connection destination parameter transmission means after receiving the transmission instruction.

  In the VPN connection system according to the present invention, the communication connection used for the telephone is a Voice Over Internet Protocol communication connection.

  According to the present invention, in the VPN connection system, when the predetermined communication connection is a communication connection used for transmission / reception of electronic mail, the connection destination apparatus is configured such that an electronic mail transmission terminal transmits an electronic message via the connection source apparatus. VPN connection request identification information first storage means for reading and temporarily storing VPN connection request identification information included in the data of the e-mail transmitted to the e-mail reply terminal, and the e-mail reply connected under the network of the own apparatus When the temporarily stored VPN connection request identification information is included in the e-mail data transmitted from the terminal to the e-mail transmission terminal, the VPN connection destination parameter is additionally registered in the e-mail data. VPN connection destination parameter additional registration means for forwarding to the e-mail transmission terminal, the connection source device VPN connection request identification information second storage means for reading and temporarily storing VPN connection request identification information included in the data of the e-mail transmitted to the e-mail reply terminal by the e-mail transmission terminal, and transmitted from the connection destination device VPN connection start instructing means for instructing the VPN connection establishment request means to transmit the connection establishment request for the VPN connection when the temporarily stored VPN connection request identification information is included in the data of the e-mail received, It is characterized by providing.

  In the VPN connection system according to the present invention, the connection source device and the connection destination device are each included in data of an email transmitted from either the email transmission terminal or the email reply terminal. A disconnection request detecting means for detecting VPN disconnection request identification information; and a VPN disconnection means for disconnecting a VPN connection established between the devices upon detection of the VPN disconnection request identification information. And

  In the VPN connection system according to the present invention, when the predetermined communication connection is a communication connection used for sending and receiving an instant message, the connection source device and the connection destination device are respectively connected to an instant message transmission terminal. VPN connection request identification information storage means for reading and temporarily storing VPN connection request identification information included in the data of the instant message transmitted to the instant message reply terminal via the connection source device, and the connection destination device If the instant message data transmitted from the instant message reply terminal connected to the network of the device to the instant message transmission terminal includes the temporarily stored VPN connection request identification information, To data VPN connection destination parameter additional registration means for additionally registering the VPN connection destination parameter and transferring it to the instant message transmission terminal, wherein the connection source device transmits the instant message transmitted from the connection destination device. A VPN connection start instruction means for instructing the VPN connection establishment request means to transmit the connection establishment request for the VPN connection when the data includes the temporarily stored VPN connection request identification information. To do.

  In the VPN connection system according to the present invention, the connection source device and the connection destination device are each included in data of an instant message transmitted from either the instant message transmission terminal or the instant message reply terminal. A disconnection request detecting means for detecting VPN disconnection request identification information; and a VPN disconnection means for disconnecting a VPN connection established between the devices upon detection of the VPN disconnection request identification information. And

  The present invention also relates to a VPN connection method in a VPN connection system for establishing a connection of a VPN (Virtual Private Network) connection between a connection source device and a connection destination device, and a VPN connection destination parameter transmission means of the connection destination device However, after completion of connection of a predetermined communication connection or after detection of a connection request, the connection source device uses the communication in the predetermined communication connection to hold at least a transmission destination address and authentication information addressed to itself The connection source device transmits a VPN connection destination parameter used for a new VPN connection, and the VPN connection establishment request means of the connection source device is addressed to the transmission destination address included in the VPN connection destination parameter received from the connection destination device. A connection establishment request for the VPN connection holding the authentication information included in the VPN connection destination parameter, and the connection destination The authentication unit of the device authenticates the establishment of the VPN connection based on the authentication information included in the connection establishment request, and the connection establishment request response unit of the connection destination device responds to the connection establishment request when the authentication is completed. A corresponding connection establishment request response is transmitted to the connection source device, and the VPN connection establishment means of the connection source device and the connection destination device receive or transmit the connection establishment request response between the mutual devices. A VPN connection method characterized by performing a VPN connection establishment process.

  According to the present invention, in the above VPN connection method, when the predetermined communication connection is a communication connection used for a telephone, the VPN connection information instruction accepting means of the connection destination device transmits the VPN connection destination parameter. The VPN connection destination parameter transmitting means of the connection destination device transmits the VPN connection destination parameter to the transmission source device after receiving the instruction and receiving the transmission instruction.

  According to the present invention, in the VPN connection method described above, when the predetermined communication connection is a communication connection used for email transmission / reception, the VPN connection request identification information first storage means of the connection destination device is an email. A VPN connection destination parameter additional registration unit of the connection destination device reads and temporarily stores VPN connection request identification information included in the data of the email transmitted from the transmission source device to the email reply terminal via the connection source device. When the temporarily stored VPN connection request identification information is included in the e-mail data transmitted from the e-mail reply terminal connected to the network of the own device to the e-mail transmission terminal The VPN connection destination parameter is additionally registered in the mail data, transferred to the e-mail sending terminal, and the connection source device VPN connection request identification information second storage means reads and temporarily stores VPN connection request identification information included in the data of the e-mail transmitted from the e-mail transmission terminal to the e-mail reply terminal, and the connection source device When the VPN connection start instruction means includes the temporarily stored VPN connection request identification information in the e-mail data transmitted from the connection destination device, the VPN connection establishment request means is connected to the VPN connection establishment request means. It is characterized by instructing transmission of an establishment request.

  In the VPN connection method described above, the VPN connection request identification information of each of the connection source device and the connection destination device when the predetermined communication connection is a communication connection used for sending and receiving instant messages. Storage means reads and temporarily stores VPN connection request identification information included in the data of the instant message transmitted from the instant message transmission terminal to the instant message reply terminal via the connection source device, and VPN connection of the connection destination device The destination parameter addition registration means includes the temporarily stored VPN connection request identification information in the data of the instant message transmitted to the instant message sending terminal from the instant message reply terminal connected to the network of the own device. If the The VPN connection destination parameter is additionally registered in the data of the tangent message, transferred to the instant message transmission terminal, and the VPN connection start instruction means of the connection source device transmits the instant message transmitted from the connection destination device. When the VPN connection request identification information temporarily stored is included in the data, the VPN connection establishment request means is instructed to transmit the connection establishment request for the VPN connection.

  According to the present invention, in response to an operation indicating a VPN start instruction by a user, a predetermined communication connection session established in advance between the connection source device and the connection destination device is used, and the VPN connection of the connection destination device is performed. The parameter is automatically notified to the connection source device. Using this parameter, the connection source device establishes a new VPN connection. Therefore, VPN connection can be easily performed without user setting. Even when the global IP address of the connection destination device changes dynamically, the VPN connection setting work can be completed simply by performing a predetermined communication connection that can establish a connection without difficult settings. The setting work can be reduced. Further, the VPN connection destination can be flexibly changed by changing the predetermined communication connection to another connection destination device.

  Hereinafter, a VPN connection system according to an embodiment of the present invention will be described with reference to the drawings. FIG. 1 is a block diagram showing a configuration of a VPN connection system according to the embodiment. In this figure, reference numeral 1 denotes a connection source device for VPN connection. Reference numeral 2 denotes a connection destination device for VPN connection. Reference numeral 3 denotes a VPN connection requesting terminal connected under the connection source device 1 in the private network A. Reference numeral 4 denotes a VPN connection response terminal connected under the connection destination apparatus 2 in the private network B. The connection source device 1 and the connection destination device 2 are connected via an external network.

FIG. 2 is a diagram illustrating functional blocks of the connection source device and the connection destination device.
As shown in this figure, in the connection source device 1, the communication processing unit 11 transmits and receives information to and from the connection destination device 2. The control unit 12 controls each processing unit of the connection source device 1. The VPN connection preparation processing unit 13 performs various processes related to preparation for VPN connection. The VPN connection establishment processing unit 14 performs VPN connection establishment processing. The storage unit 15 is a connection disconnection processing unit that performs VPN connection disconnection processing. Reference numeral 16 stores various information.

  In the connection destination device 2, the communication processing unit 21 transmits and receives information to and from the connection source device 1. The control unit 22 controls each processing unit of the connection destination device 2. The VPN connection preparation processing unit 23 performs various processes related to preparation for VPN connection. The parameter transmission processing unit 24 transmits parameters relating to the VPN connection setting to the connection source device 1 using a predetermined communication connection established in advance with the connection source device 1. The VPN connection establishment processing unit 25 performs VPN connection establishment processing. The connection disconnection processing unit 26 performs VPN connection disconnection processing. The storage unit 27 stores various information.

  In the situation where the connection source device 1 and the connection destination device 2 are physically connected via an external network as shown in FIG. 1, the VPN connection request terminal 3 and the VPN connection response terminal 4 A predetermined communication connection is performed by each user's operation. The VPN connection system according to the present embodiment uses a predetermined communication connection established in advance between the terminals, so that the user does not need to set up a VPN connection to the connection source device 1 or the connection destination device 2 without new work. Easy VPN connection. Hereinafter, this process will be described step by step. In the present embodiment, the predetermined communication connection is an IP telephone communication connection using VOIP (Voice Over Internet Protocol) technology, an electronic mail communication connection, an instant message communication connection, or the like.

<VPN connection processing using IP phone>
FIG. 3 is a block diagram showing a configuration of a VPN connection system using an IP phone.
FIG. 4 is a diagram showing a processing flow in a VPN connection system using an IP phone.
A VPN connection process using an IP phone will be described as a first example with reference to FIGS. 3 and 4.
In FIG. 3, a telephone 3a corresponds to the VPN connection requesting terminal 3 of FIG. The telephone 4a corresponds to the VPN connection response terminal 4 of FIG. A SIP (Session Initiation Protocol) server 5 is newly connected to the external network. Further, it is assumed that the connection source device 1 and the connection destination device 2 further have an IP telephone connection function unit based on the VOIP technology.

  First, a user who uses the telephone 3a makes a call to the telephone 4a (step S101). Then, the connection source device 1 receives the outgoing signal and transmits an INVITE message to the SIP server 5 (step S102). The SIP server 5 reads the IP address of the telephone 4a from the table based on the telephone number included in the INVITE message, and transfers the INVITE message to the IP address (step S103). The connection destination device 2 connected to the telephone 4a receives the INVITE message. The connection destination device 2 detects that the message is a message for outgoing call to the telephone 4a by the INVITE message, and transmits a ringing signal to the telephone 4a (step S104). As a result, the bell of the telephone 4a rings.

  The user of the telephone 4a raises the handset by ringing the bell. Then, the telephone 4a detects that the handset has been raised and notifies the connection destination device 2 (step S105). Thereby, the connection destination apparatus 2 transmits a command (200 OK) for notifying that the receiver has been raised to the SIP server 5 (step S106). Further, the SIP server 5 transfers the command (200 OK) to the connection source device 1 (step S107). As a result, an IP telephone session is established between the connection source device 1 and the connection destination device 2. Note that the processing up to the establishment of the IP telephone session is the same as in the prior art.

  Next, when an IP phone session is established, the user's voice is transmitted and received between the phones. Therefore, the users of the telephones mutually confirm that the VPN connection is made by voice. That is, the user of the telephone 3a notifies the user of the telephone 4a that the VPN connection is to be made verbally (step S108), and the user of the telephone 4a notifies the user of the telephone 3a of the response verbally (step S109).

  Under such circumstances, the user of the telephone 4a operates the connection destination device 2 or the telephone 4a (for example, pressing a switch or pressing a touch panel) and inputs a VPN connection start instruction (step S110). As a result, the VPN connection preparation processing unit 23 of the connection destination device 2 detects the start of VPN connection (when the user operates the telephone 4a, information is transmitted from the telephone and the VPN connection start is notified), and the parameter The transmission processing unit 24 is instructed to transmit VPN connection destination parameters.

  Next, the parameter transmission processing unit 24 uses the IP telephone connection session already established between the telephone 4a and the telephone 3a to transmit VPN connection destination parameter information to the connection source device 1 (step S111). . This VPN connection destination parameter includes at least the global IP address of the connection destination device 2 and authentication information. Specifically, the authentication information is a time stamp, a VPN session number, a password, or the like. Note that the VPN connection destination parameter information is transmitted to the connection source device 1 using the IP telephone connection session. For example, the parameter transmission processing unit 24 uses the same IP telephone connection session ID and service protocol. A packet is generated, and a VPN connection destination parameter is stored in the data part of the packet and transmitted. The VPN connection destination parameter is registered in the storage unit 27 by the parameter transmission processing unit 24.

  Next, when receiving the VPN connection destination parameter information transmitted from the connection destination device 2, the VPN connection preparation processing unit 13 of the connection source device 1 transfers the VPN connection destination parameter to the VPN connection establishment processing unit 14, and VPN Instruct connection request transmission. The VPN connection establishment processing unit 14 transmits a connection establishment request storing authentication information included in the VPN connection destination parameter to the global address (connection destination device 2) included in the VPN connection destination parameter (step S112). . The session after this connection establishment request is a session different from the IP telephone connection.

  Next, in the connection destination apparatus 2 that has received the connection establishment request, the VPN connection establishment processing unit 25 reads the authentication information included in the connection establishment request and performs authentication processing. For example, when authentication information (a combination of a time stamp, a VPN session number, and a password) stored in the connection establishment request is the same as the authentication information of the VPN connection destination parameter registered in the storage unit 27, it is determined that the authentication is complete. To do. When the authentication is completed, the VPN connection establishment processing unit 25 transmits a connection establishment response corresponding to the connection establishment request to the connection source device 1 (step S113). As a result, the VPN connection establishment processing units 14 and 25 of the connection source device 1 and the connection destination device 2 detect the start of the VPN connection with each other, and establish a VPN connection session (step S114). The procedure from the transmission / reception of the connection establishment request and the connection establishment response to the end of the VPN connection establishment process is the same as the conventional VPN connection establishment process. After the VPN connection is established, the IP telephone connection session may be maintained between the connection source device 1 and the connection destination device 2 or may be disconnected.

  Through the above processing, the IP phone connection session is used in response to an operation indicating a VPN start instruction by the user, and the VPN connection parameters of the connection destination device 2 are automatically notified to the connection source device 1. Using the parameters, the connection source device 1 performs processing for establishing a new VPN connection. Therefore, VPN connection can be easily performed without user setting. Even if the global IP address of the connection destination device changes dynamically, the subsequent VPN connection setting work can be completed by a simple method only by performing an IP telephone connection, and the IP telephone connection can be made by another connection. By changing to the destination device, the VPN connection destination can be changed flexibly.

  When disconnecting the VPN connection, the user of the telephone 4a operates the connection destination device 2 or the telephone 4a (for example, pressing a switch or pressing a touch panel) and inputs a VPN disconnection start instruction. (Step S115). As a result, the connection disconnection processing unit 26 of the connection destination apparatus 2 detects the start of VPN disconnection (when the user operates the telephone 4a, information is transmitted from the telephone and the VPN disconnection start is notified), and the VPN disconnection is performed. The request is transmitted to the connection source device 1 (step S116). Then, the connection source device 1 that has received the VPN connection request transmits a VPN disconnection request response to the connection destination device 2 (step S117). As a result, the VPN connection between the connection source device 1 and the connection destination device 2 is disconnected. The disconnection of the VPN connection may be started from the user of the telephone 3a.

<VPN connection processing using e-mail>
FIG. 5 is a block diagram showing a configuration of a VPN connection system using electronic mail.
FIG. 6 is a diagram showing a processing flow in the VPN connection system using electronic mail.
A VPN connection process using e-mail will be described as a second example with reference to FIGS. 5 and 6.
In FIG. 5, an e-mail transmission terminal 3b corresponds to the VPN connection request terminal 3 of FIG. The electronic mail reply terminal 4b corresponds to the VPN connection response terminal 4 of FIG. A mail server 6 is newly connected to the external network. The mail server 6 is shown as being connected to an external network for convenience of explanation, but may be provided in each private network. Further, it is assumed that the connection source device 1 and the connection destination device 2 have an electronic mail transmission / reception function unit.

  First, a user who uses the e-mail transmission terminal 3b transmits an e-mail to the e-mail reply terminal 4b (step S201). At this time, the user writes and transmits VPN connection request identification information in the header, subject, body text, attached file description, and the like of the e-mail. In this embodiment, the VPN connection request identification information is a predetermined character string (for example, a character string such as “VPN connection request”) or a symbol, but may be other information. Further, the VPN connection request identification information may be stored in the e-mail data even if it is not a description of the header, subject, text, and attached file. Further, the user may write a text requesting VPN connection in the e-mail text.

  While the e-mail arrives at the e-mail reply terminal 4b, the connection source device 1 transfers the e-mail transmitted from the e-mail transmission terminal 3b to the mail server 6. In this process, the VPN connection preparation processing unit 13 of the connection source apparatus 1 analyzes the e-mail data and performs VPN connection preparation processing (step S202). In this VPN connection preparation process, the VPN connection preparation processing unit 13 determines whether VPN connection request identification information is stored in the e-mail. When the VPN connection request identification information is stored in the e-mail, the e-mail transmission source e-mail address (e-mail address of the e-mail transmission terminal 3b) and the transmission destination e-mail address (e-mail reply terminal 4b) The mail address) and VPN connection request identification information are registered and stored in the storage unit 16. The e-mail is transferred in the connection source device 1 (step S203) and temporarily held in the mail server 6.

  Next, when the user of the e-mail reply terminal 4b issues an inquiry to the mail server, the e-mail reply terminal 4b inquires the mail server 6. Then, the mail server 6 transmits the electronic mail transmitted from the electronic mail transmitting terminal 3b and temporarily held to the electronic mail reply terminal 4b (step S204). At this time, the connection destination device 2 transfers the e-mail to the e-mail reply terminal 4b. Here, the VPN connection preparation processing unit 23 of the connection destination apparatus 2 analyzes the e-mail data and performs VPN connection preparation processing (step S205). In this VPN connection preparation process, the VPN connection preparation processing unit 23 determines whether VPN connection request identification information is stored in the e-mail. When the VPN connection request identification information is stored in the e-mail, the e-mail transmission source e-mail address (e-mail address of the e-mail transmission terminal 3b) and the transmission destination e-mail address (e-mail reply terminal 4b) And the VPN connection request identification information are registered and held in the storage unit 27. Then, the connection destination device 2 transfers the e-mail to the e-mail reply terminal 4b (step S206).

  Next, the user of the e-mail reply terminal 4b confirms that a VPN connection request has come from the user of the e-mail transmission terminal 3b from the contents of the e-mail. Then, the electronic mail reply terminal 4b is instructed to reply to the received electronic mail. The e-mail reply terminal 4b generates an e-mail replying to the e-mail received from the e-mail sending terminal 3b, and sends it to the e-mail sending terminal 3b based on the user's operation (step S207). In this reply e-mail, VPN connection request identification information is held in the header, subject, body text, description of attached file, etc., as described above. The reply e-mail may be automatically replied by the e-mail reply terminal 4b by receiving the e-mail storing the VPN connection request identification information.

  Next, while arriving at the email sending terminal 3b from the email reply terminal 4b, the connection destination device 2 receives the reply email. The VPN connection preparation processing unit 23 of the connection destination apparatus 2 analyzes the reply e-mail data and determines whether or not VPN connection request identification information is included. When the VPN connection request identification information is included in the reply e-mail, the VPN connection preparation processing unit 23 sends the e-mail transmission source e-mail address (e-mail address of the e-mail reply terminal 4b) and the transmission destination e-mail. It is confirmed whether the combination of the mail address (the mail address of the electronic mail transmitting terminal 3 b) and the VPN connection request identification information is registered in the storage unit 27. Also, it is determined whether the information of Recent-Message-ID is stored in the reply e-mail. When the same combination exists in the storage unit 27 and the information of Recent-Message-ID is stored, the VPN connection preparation processing unit 23 sends an electronic message in which the reply e-mail indicates a VPN connection request. The mail is detected (step S208). Thereby, the VPN connection preparation processing unit 23 instructs the parameter transmission processing unit 24 to store the VPN connection destination parameter in the data of the e-mail. Then, the parameter transmission processing unit 24 writes the contents of the VPN connection destination parameter in the e-mail data (step S209). The VPN connection destination parameter includes at least the global IP address of the connection destination device 2 and authentication information. Then, the connection destination device 2 transfers the reply e-mail to the mail server 6 (step S210), and the mail server 6 receives the reply e-mail and temporarily holds it.

  Next, when the user of the e-mail transmission terminal 3b instructs the terminal to make an inquiry to the mail server 6, the e-mail transmission terminal 3b inquires the mail server 6. Then, the mail server 6 transmits the reply e-mail that is transmitted from the e-mail reply terminal 4b and is temporarily held to the e-mail transmission terminal 3b (step S211). At this time, the connection source device 1 connected between the mail server 6 and the email sending terminal 3b receives the reply email. Then, the VPN connection preparation processing unit 13 analyzes the reply e-mail data and determines whether or not VPN connection request identification information is included. When the VPN connection request identification information is included in the reply email, the VPN connection preparation processing unit 13 sends the email address of the email (the email address of the email reply terminal 4b) and the destination address. It is confirmed whether the combination of the mail address (the mail address of the electronic mail transmission terminal 3b) and the VPN connection request identification information is registered in the storage unit 16. Also, it is determined whether the information of Recent-Message-ID is stored in the reply e-mail. If the same combination exists in the storage unit 16 and the information of Recent-Message-ID is stored, the VPN connection preparation processing unit 13 sends an electronic message indicating that the reply email indicates a VPN connection request. The mail is detected (step S212).

  When it is detected that the reply e-mail is an e-mail indicating a VPN connection request, the VPN connection preparation processing unit 13 of the connection source device 1 next transfers the reply e-mail to the e-mail transmission terminal 3. In both cases, the VPN connection destination parameter stored in the reply e-mail is read and transferred to the VPN connection establishment processing unit 14 to instruct VPN connection request transmission. The VPN connection establishment processing unit 14 transmits a VPN connection establishment request holding authentication information for storing VPN connection destination parameters to a global address (connection destination device 2) included in the VPN connection destination parameters (step S213). The session after this connection establishment request is a session different from the electronic mail communication connection. Then, as in the first example, the VPN connection establishment processing unit 25 of the connection destination device 2 returns a response to the VPN connection establishment request to the connection source device 1 (step S214), and then connects to the connection source device 1. A conventional VPN connection is established between the destination devices 2 (step S215).

  Through the above processing, the VPN connection parameter of the connection destination device 2 is automatically stored in the e-mail and notified to the connection source device 1 by e-mail reply from the e-mail reply terminal 4b, and this parameter is used. Then, the connection source device 1 automatically performs processing for establishing a new VPN connection. Therefore, VPN connection can be easily performed without user setting. Even when the global IP address of the connection destination device 2 dynamically changes, the VPN connection is performed only by confirming the start of the VPN connection by sending and receiving e-mails. The VPN connection destination can be flexibly changed by performing transmission / reception of electronic mail with other connection destination devices.

  When disconnecting the VPN connection, the user of the e-mail transmission terminal 3b sends an e-mail for requesting the disconnection of the VPN connection and a transmission instruction to the e-mail reply terminal 4b to the terminal. Do. At this time, the user writes and sends the VPN disconnection request identification information in the e-mail (step S216). In this embodiment, the VPN disconnection request identification information is a predetermined character string (for example, a character string such as “VPN disconnection request”) or a symbol, but may be other information. The VPN disconnection request identification information may be included in the e-mail data even if it is not a header, subject, body text, or attached file description. Further, the user may write a text requesting disconnection of the VPN connection in the e-mail body.

  While the e-mail arrives at the e-mail reply terminal 4b, the connection source device 1 transfers the e-mail to the mail server 6. In this process, the connection disconnection processing unit 15 of the connection source device 1 analyzes the e-mail data and performs VPN disconnection preparation processing (step S217). In this VPN disconnection preparation process, the connection disconnection processing unit 15 of the connection source device 1 determines whether or not VPN disconnection request identification information is included in the e-mail. When the VPN disconnection request identification information is included in the e-mail, the VPN disconnection request identification information is registered and stored in the storage unit 16. Further, the connection source device 1 transfers the e-mail to the mail server 6 after the VPN disconnection preparation process is completed (step S218).

  Next, when the user of the e-mail reply terminal 4b issues an inquiry to the mail server, the e-mail reply terminal 4b inquires the mail server 6. Then, the mail server 6 transmits an e-mail for disconnection to the e-mail reply terminal 4b (step S219). At this time, the connection destination apparatus 2 receives the electronic mail from the mail server 6 and transfers it to the electronic mail reply terminal 4b. At this time, the connection disconnection processing unit 26 of the connection destination device 2 analyzes the e-mail data and performs VPN disconnection preparation processing (step S220). In this VPN disconnection preparation process, the connection disconnection processing unit 26 determines whether VPN disconnection request identification information is included in the e-mail. When the VPN disconnection request identification information is included in the email, VPN disconnection is started. The connection disconnection processing unit 26 transfers the e-mail to the e-mail reply terminal 4b and transmits a VPN disconnection request holding the VPN disconnection request identification information to the connection source device 1 (step S221). If the VPN disconnection request identification information included in the VPN disconnection request is registered in the storage unit 16, the connection source device 1 returns a response to the VPN connection request (step S222). As a result, the VPN connection between the connection source device 1 and the connection destination device 2 is disconnected. The e-mail for requesting the disconnection of the VPN connection may be transmitted from the e-mail reply terminal 4b side to the e-mail transmission terminal 3b side to start the VPN disconnection process.

<VPN connection processing using instant messaging>
FIG. 7 is a block diagram showing the configuration of a VPN connection system using instant messaging.
FIG. 8 is a diagram showing a processing flow in a VPN connection system using instant messaging.
A VPN connection process using instant messaging will be described as a third example with reference to FIGS.
In FIG. 7, the message transmission terminal 3c corresponds to the VPN connection requesting terminal 3 of FIG. The message reply terminal 4c corresponds to the VPN connection response terminal 4 of FIG. In addition, an instant messaging server (hereinafter referred to as IM server) 7 is newly connected to the external network. Further, it is assumed that the connection source device 1 and the connection destination device 2 have an instant messaging information (hereinafter referred to as instant message) transmission / reception function unit. In addition, instant messaging is a mechanism that can notify information directly without receiving operation of the transmission partner, unlike a mechanism in which information is not transmitted unless the transmission partner performs a reception operation like e-mail. There are services such as chat and messenger.

  First, the user using the message transmission terminal 3c activates an instant messaging (IM) function in the message transmission terminal 3c (step S301). Then, the instant message function processing unit notifies port setting instruction information to the connection source device 1 (step S302), and the connection source device 1 performs port setting. This setting is a setting for opening an instant message (IM) reception port. Thereby, thereafter, the connection source device 1 starts reception monitoring of the instant message at the set reception port (step S303). Also, the instant message function processing unit of the message transmission terminal 3c transmits the combination of the IP address of its own device and the ID used for instant message transmission / reception to the IM server 7 and performs instant messaging service registration (step S304). The IM server 7 records the received IP address / ID combination information in a table such as a storage unit.

  Similarly, the user using the message reply terminal 4c activates the instant messaging function in the message reply terminal 4c (step S305). Then, the instant message function processing section notifies the port setting instruction information to the connection destination device 2 (step S306), and the connection destination device 2 performs port setting. Thereby, thereafter, the connection destination device 2 starts reception monitoring of the instant message at the set reception port (step S307). Further, the instant message function processing unit of the message reply terminal 4c transmits the combination of the IP address of the own device and the ID used for instant message transmission / reception to the IM server 7 and performs instant messaging service registration (step S308).

  Then, the IM server 7 records the received IP address / ID combination information in a table such as a storage unit. The IM server 7 transmits the ID registered in the storage unit by the service registration to each message transmission terminal 3c and message reply terminal 4c registered in the service, and notifies other terminals registered in the service (steps S309 and S310). ). Thereby, in each terminal, the other party who can send and receive an instant message can be detected. The combination of the IP address and ID of the partner terminal that can send and receive the instant message is stored in the storage units 16 and 27 by the message sending terminal 3c and the message reply terminal 4c, respectively. Through the above processing, each user of the message transmission terminal 3c and the message reply terminal 4c shifts to an environment in which an instant message can be transmitted and received.

  Next, when performing a VPN connection, first, when a user who uses the message transmission terminal 3c receives an instruction for selecting an instant message transmission destination and an instruction for establishing an instant messaging connection, the message transmission terminal 3c is connected to the instant messaging connection. The request information is transmitted to the message reply terminal 4c via the IM server 7 (step S311). Then, the message reply terminal 4c that accepted the instant messaging connection request transmits a response to the instant messaging connection request to the message transmission terminal 3c via the IM server 7 (step S312). As a result, an instant messaging session is established between the two terminals, and an instant messaging connection is established (step S313).

  Next, the message transmission terminal 3c transmits an instant message to the message reply terminal 4c based on the operation of the user who uses the message transmission terminal 3c to send an instant message (step S314). At this time, the user writes and transmits the VPN connection request identification information in the body of the instant message or the description of the attached file. In this embodiment, the VPN connection request identification information is a predetermined character string (for example, a character string such as “VPN connection request”) or a symbol, but may be other information. Further, the VPN connection request identification information may be included in the data of the instant message even if it is not the description of the body text or the attached file. Further, the user may write a text requesting VPN connection in the instant message text. In the instant message, an ID of the source of the instant message (ID of the message transmission terminal 3c) and an ID of the transmission destination (ID of the message reply terminal 4c) are also stored.

  Before the instant message reaches the message reply terminal 4 c, first, the connection source device 1 receives the instant message and transfers it to the IM server 7. In this process, the VPN connection preparation processing unit 13 of the connection source device 1 analyzes the data of the instant message and performs VPN connection preparation processing (step S315). In this VPN connection preparation process, the VPN connection preparation processing unit 13 determines whether VPN connection request identification information is stored in the data of the instant message. When the VPN connection request identification information is stored in the instant message, the ID of the source of the instant message (ID of the message transmission terminal 3c), the ID of the transmission destination (ID of the message reply terminal 4c), A combination of VPN connection request identification information is registered and stored in the storage unit 16. Then, the instant message is transferred to the IM server 7 (step S316).

  Next, the IM server 7 reads the ID of the transmission destination stored in the instant message, reads the IP address of the message reply terminal 4c stored in the storage unit or the like in association with the ID of the transmission destination, and the IP The instant message is transferred to the address (step S317). Next, since the connection destination device 2 is connected between the communication path between the IM server 7 and the message reply terminal 4c, the connection destination device 2 receives the instant message transmitted from the IM server 7, and receives the message reply terminal. The process of transferring to 4c is performed. Here, the VPN connection preparation processing unit 23 of the connection destination apparatus 2 analyzes the data of the instant message and performs VPN connection preparation processing (step S318). In this VPN connection preparation process, the VPN connection preparation processing unit 23 determines whether VPN connection request identification information is stored in the data of the instant message. When the VPN connection request identification information is stored in the instant message, the ID of the source of the instant message (ID of the message transmission terminal 3c), the ID of the transmission destination (ID of the message reply terminal 4c), The combination of VPN connection request identification information is registered and stored in the storage unit 27. In addition, the control unit 22 of the connection destination apparatus 2 transfers the instant message to the message reply terminal 4c (step S319).

  Next, when the instant message is received at the message reply terminal 4c, the user of the message reply terminal 4c confirms that the VPN connection request is received from the user of the message sending terminal 3c from the contents of the instant message. Then, the message reply terminal 4c is instructed to reply to the received instant message. The message reply terminal 4c generates an instant message for replying the instant message received from the message sending terminal 3c, and sends it to the message sending terminal 3c based on the user's operation (step S320). In this reply instant message, the VPN connection request identification information is held in the body, description of the attached file, etc., as described above.

  Next, while the reply instant message arrives from the message reply terminal 4 c to the message sending terminal 3 c, the connection destination device 2 transfers the reply instant message to the IM server 7. At this time, the VPN connection preparation processing unit 23 of the connection destination device 2 analyzes the data of the returned instant message and determines whether or not VPN connection request identification information is included. When the VPN connection request identification information is included in the reply instant message, the VPN connection preparation processing unit 23 sends the ID of the instant message transmission source (ID of the message reply terminal 4c) and the destination ID (message). Whether the combination of the ID of the transmission terminal 3c) and the VPN connection request identification information is registered in the storage unit 27 is confirmed. When the same combination exists in the storage unit 27, the VPN connection preparation processing unit 23 detects that it is an instant message reply mail indicating a VPN connection request (step S 321), and sends it to the parameter transmission processing unit 24. A VPN connection destination parameter write instruction is notified. Then, the parameter transmission processing unit 24 writes the contents of the VPN connection destination parameter in the reply instant message data (step S322). The VPN connection destination parameter includes at least the global IP address of the connection destination device 2 and authentication information. The destination device 2 transfers the reply instant message to the IM server 7 (step S323).

  Next, the IM server 7 receives the reply instant message. Then, the ID of the transmission destination stored in the instant message is read, the IP address of the message transmission terminal 3c stored in the storage unit or the like is associated with the ID of the transmission destination, and the instant message is sent to the IP address. Transfer (step S324). Next, since the connection source device 1 is connected between the communication path between the IM server 7 and the message transmission terminal 3c, the connection source device 1 receives the instant message transmitted from the IM server 7 and receives the message transmission terminal. The process of transferring to 3c is performed. At this time, the VPN connection preparation processing unit 13 of the connection source device 1 analyzes the data of the instant message and determines whether or not VPN connection request identification information is included. When the VPN connection request identification information is included in the reply instant message, the ID of the source of the instant message (ID of the message reply terminal 4c), the ID of the destination (ID of the message transmission terminal 3c), It is confirmed whether a combination of VPN connection request identification information is registered in the storage unit 16. If the same combination exists in the storage unit 16, the VPN connection preparation processing unit 13 detects that it is a reply of an instant message indicating a request for VPN connection (step S325).

  Next, the VPN connection preparation processing unit 13 of the connection source device 1 transfers the VPN connection destination parameter stored in the reply instant message to the VPN connection establishment processing unit 14 and issues a VPN connection request transmission instruction. The VPN connection establishment processing unit 14 transmits a connection establishment request holding the authentication information included in the VPN connection destination parameter to the global address (connection destination device 2) included in the VPN connection destination parameter (step S326). The session after this connection establishment request is a session different from the instant message communication connection. As in the first and second examples, the VPN connection establishment processing unit 25 of the connection destination device 2 returns a response to the VPN connection establishment request to the connection source device 1 (step S327), and then the connection source device. A conventional VPN connection is established between 1 and the connection destination device 2 (step S328).

As a result of the above processing, the instant message is returned from the instant message reply terminal 4c, so that the VPN connection parameters of the connection destination device 2 are automatically stored in the instant message and notified to the connection source device 1. Using the parameters, the connection source device 1 automatically performs processing for establishing a new VPN connection. Therefore, VPN connection can be easily performed without user setting. Even when the global IP address of the connection destination device 2 dynamically changes, the VPN connection setting work is performed only by confirming the start of the VPN connection by sending and receiving an instant message. The connection can be completed, and the VPN connection destination can be flexibly changed by transmitting / receiving instant messages to / from other connection destination devices 2.

  When disconnecting the VPN connection, the user of the message transmission terminal 3c creates an instant message for requesting disconnection of the VPN connection and sends a message to the message reply terminal 4c. At this time, the user writes and transmits the VPN disconnection request identification information in the instant message (step S329). In this embodiment, the VPN disconnection request identification information is a predetermined character string (for example, a character string such as a VPN connection request) or a symbol, but may be other information. The VPN disconnection request identification information may be included in the instant message data, even if it is not the text and the description of the attached file. Further, the user may write a text requesting disconnection of the VPN connection in the instant message text.

  While the instant message arrives at the message reply terminal 4c, the connection source device 1 transfers the instant message to the IM server 7. In this process, the connection disconnection processing unit 15 of the connection source device 1 analyzes the data of the instant message and performs VPN disconnection preparation processing (step S330). In this VPN disconnection preparation process, the connection disconnection processing unit 15 determines whether VPN disconnection request identification information is stored in the instant message data. When the VPN disconnection request identification information is stored in the instant message, the VPN disconnection request identification information is registered and held in the storage unit 16. Then, the instant message is transferred to the IM server 7 (step S331).

  Next, the IM server 7 transfers the instant message to the message reply terminal 4c (step S332). Then, the message reply terminal 4 c receives the instant message via the connection destination device 2. In this transfer processing, when the connection destination device 2 transfers the instant message to the message reply terminal 4c, the connection disconnection processing unit 26 analyzes the data of the instant message and performs VPN disconnection preparation processing (step S333). In this VPN disconnection preparation process, the connection disconnection processing unit 26 determines whether VPN disconnection request identification information is stored in the instant message data. When the VPN disconnection request identification information is stored in the instant message, VPN disconnection is started. Then, the disconnection processing unit 26 transmits a VPN disconnection request holding the VPN disconnection request identification information to the connection source device 1 (step S334). If the VPN disconnection request identification information included in the VPN disconnection request is registered in the storage unit 16, the connection source device 1 returns a response to the VPN connection request (step S335). As a result, the VPN connection between the connection source device 1 and the connection destination device 2 is disconnected. The instant message for requesting the disconnection of the VPN connection may be transmitted from the message return terminal 4c side to the message transmission terminal 3c side to start the VPN disconnection process.

  Each of the above terminals and devices has a computer system inside. The process described above is stored in a computer-readable recording medium in the form of a program, and the above process is performed by the computer reading and executing this program. Here, the computer-readable recording medium means a magnetic disk, a magneto-optical disk, a CD-ROM, a DVD-ROM, a semiconductor memory, or the like. Alternatively, the computer program may be distributed to the computer via a communication line, and the computer that has received the distribution may execute the program.

  The program may be for realizing a part of the functions described above. Furthermore, what can implement | achieve the function mentioned above in combination with the program already recorded on the computer system, and what is called a difference file (difference program) may be sufficient.

It is a block diagram which shows the structure of a VPN connection system. It is a figure which shows the functional block of a connection origin apparatus and a connection destination apparatus. It is a block diagram which shows the structure of the VPN connection system using an IP telephone. It is a figure which shows the processing flow in the VPN connection system using an IP telephone. It is a block diagram which shows the structure of the VPN connection system using an email. It is a figure which shows the processing flow in the VPN connection system using an email. It is a block diagram which shows the structure of the VPN connection system using an instant messaging. It is a figure which shows the processing flow in the VPN connection system using an instant messaging.

Explanation of symbols

DESCRIPTION OF SYMBOLS 1 ... Connection origin apparatus 2 ... Connection destination apparatus 3 ... VPN connection request terminal 3a, 4a ... Telephone 3b ... E-mail transmission terminal 3c ... Message transmission terminal 4 ... VPN connection Response terminal 4b ... E-mail reply terminal 5c ... Message reply terminal

Claims (11)

A VPN connection system for establishing connection of a VPN (Virtual Private Network) connection between a connection source device and a connection destination device,
After the connection of the predetermined communication connection is completed or the connection request is detected, the connection destination device uses the communication in the predetermined communication connection to send the transmission destination address and authentication information addressed to itself to the connection source device. VPN connection destination parameter transmitting means for transmitting at least a VPN connection destination parameter to be held and used by the connection source device for a new VPN connection;
The connection source device transmits a connection establishment request for the VPN connection holding the authentication information included in the VPN connection destination parameter to a transmission destination address included in the VPN connection destination parameter received from the connection destination device. VPN connection establishment request means is provided,
The connection destination device includes an authentication unit that authenticates establishment of a VPN connection based on authentication information included in the connection establishment request.
The connection destination device comprises connection establishment request response means for transmitting a connection establishment request response corresponding to the connection establishment request to the connection source device when the authentication is completed,
VPN connection establishment means for performing a VPN connection establishment process between mutual devices when the connection source device and the connection destination device receive or transmit the connection establishment request response Connection system. When the predetermined communication connection is a communication connection used for a telephone,
The connection destination device is:
VPN connection information instruction receiving means for receiving a VPN connection destination parameter transmission instruction;
The VPN connection system according to claim 1, wherein after receiving the transmission instruction, the VPN connection destination parameter transmission unit transmits the VPN connection destination parameter to the transmission source device. The VPN connection system according to claim 2, wherein the communication connection used for the telephone is a Voice Over Internet Protocol communication connection. When the predetermined communication connection is a communication connection used for sending and receiving e-mails,
The connection destination device is:
VPN connection request identification information first storage means for reading and temporarily storing VPN connection request identification information included in the data of the e-mail transmitted from the e-mail transmission terminal to the e-mail reply terminal via the connection source device;
If the e-mail data sent to the e-mail sending terminal from the e-mail reply terminal connected to the network of its own device includes the temporarily stored VPN connection request identification information, the e-mail VPN connection destination parameter additional registration means for additionally registering the VPN connection destination parameter to the data and transferring it to the e-mail transmission terminal,
The connection source device is:
VPN connection request identification information second storage means for reading and temporarily storing VPN connection request identification information included in the data of the e-mail transmitted to the e-mail reply terminal by the e-mail transmission terminal;
VPN instructing the VPN connection establishment requesting means to transmit the connection establishment request for the VPN connection when the temporarily stored VPN connection request identification information is included in the data of the e-mail transmitted from the connection destination apparatus. The VPN connection system according to claim 1, further comprising: a connection start instruction unit.
The connection source device and the connection destination device are respectively
A disconnection request detecting means for detecting VPN disconnection request identification information included in the data of the email transmitted from either the email sending terminal or the email reply terminal;
VPN disconnection means for disconnecting the VPN connection established between the mutual devices upon detection of the VPN disconnection request identification information;
The VPN connection system according to claim 4, further comprising: When the predetermined communication connection is a communication connection used for sending and receiving instant messages,
The connection source device and the connection destination device are respectively
VPN connection request identification information storage means for reading and temporarily storing VPN connection request identification information included in the data of the instant message transmitted from the instant message transmission terminal to the instant message reply terminal via the connection source device,
The connection destination device is:
When the instant message data transmitted to the instant message sending terminal from the instant message reply terminal connected to the network of the own device includes the temporarily stored VPN connection request identification information, the instant message VPN connection destination parameter additional registration means for additionally registering the VPN connection destination parameter to the data and transferring it to the instant message transmission terminal,
The connection source device is:
VPN instructing the VPN connection establishment request means to transmit the connection establishment request for the VPN connection when the temporarily stored VPN connection request identification information is included in the data of the instant message transmitted from the connection destination device The VPN connection system according to claim 1, further comprising: a connection start instruction unit. The connection source device and the connection destination device are respectively
Disconnection request detection means for detecting VPN disconnection request identification information included in data of an instant message transmitted from either the instant message transmission terminal or the instant message reply terminal;
VPN disconnection means for disconnecting the VPN connection established between the mutual devices upon detection of the VPN disconnection request identification information;
The VPN connection system according to claim 6, further comprising: A VPN connection method in a VPN connection system for establishing a connection of a VPN (Virtual Private Network) connection between a connection source device and a connection destination device,
The VPN connection destination parameter transmission means of the connection destination device transmits to the connection source device to the connection source device using communication in the predetermined communication connection after completion of connection of the predetermined communication connection or after detecting a connection request. A VPN connection destination parameter for holding a destination address and authentication information and used by the connection source device for a new VPN connection;
The VPN connection establishment request means of the connection source device sends the VPN connection holding the authentication information included in the VPN connection destination parameter to the transmission destination address included in the VPN connection destination parameter received from the connection destination device. Send a connection establishment request,
The authentication unit of the connection destination device authenticates the establishment of a VPN connection based on the authentication information included in the connection establishment request,
The connection establishment request response means of the connection destination device transmits a connection establishment request response corresponding to the connection establishment request to the connection source device when the authentication is completed,
VPN connection establishing means of the connection source device and the connection destination device performs a VPN connection establishment process between the mutual devices upon reception or transmission of the connection establishment request response . When the predetermined communication connection is a communication connection used for a telephone,
The VPN connection information instruction accepting means of the connection destination device accepts a transmission instruction of the VPN connection destination parameter,
The VPN connection method according to claim 8, wherein after receiving the transmission instruction, the VPN connection destination parameter transmission means of the connection destination device transmits the VPN connection destination parameter to the transmission source device. When the predetermined communication connection is a communication connection used for sending and receiving e-mails,
The VPN connection request identification information first storage means of the connection destination device reads the VPN connection request identification information contained in the data of the email transmitted from the email transmission terminal to the email reply terminal via the connection source device. Temporarily remember,
The VPN connection destination parameter additional registration unit of the connection destination device temporarily stores the data in the email sent from the email reply terminal connected to the network of the own device to the email transmission terminal. When VPN connection request identification information is included, the VPN connection destination parameter is additionally registered in the data of the e-mail and transferred to the e-mail transmission terminal.
VPN connection request identification information second storage means of the connection source device reads and temporarily stores VPN connection request identification information included in the e-mail data transmitted to the e-mail reply terminal by the e-mail transmission terminal,
When the VPN connection start instructing means of the connection source device includes the temporarily stored VPN connection request identification information in the e-mail data transmitted from the connection destination device, the VPN connection establishment request means The VPN connection method according to claim 8, wherein transmission of a connection establishment request for VPN connection is instructed. When the predetermined communication connection is a communication connection used for sending and receiving instant messages,
The VPN connection request identification information storage means of each of the connection source device and the connection destination device includes a VPN connection included in the data of the instant message transmitted to the instant message reply terminal via the connection source device by the instant message transmission terminal. Read and temporarily store request identification information,
The VPN connection destination parameter addition registration unit of the connection destination device temporarily stores the instant message data transmitted to the instant message transmission terminal from the instant message return terminal connected to the network of the own device. When VPN connection request identification information is included, the VPN connection destination parameter is additionally registered in the instant message data, and is transferred to the instant message transmission terminal.
When the VPN connection start instructing means of the connection source device includes the temporarily stored VPN connection request identification information in the data of the instant message transmitted from the connection destination device, the VPN connection establishment request means The VPN connection method according to claim 8, wherein transmission of a connection establishment request for VPN connection is instructed.

Images