JP2008219483A - Relay apparatus and program - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To provide a relay apparatus, and a control method thereof, for reducing managing operations of external port numbers and improving security. <P>SOLUTION: A control part of a gateway device 3, during access from a terminal device 1 while designating an external port number, converts the external port number of an accessed terminal to an internal port number stored in a conversion table in which an external IP address of the accessing terminal device 1 is associated with a specified external port number as a pair. Then the control part transfers communication data to a server 2 in an internal network associated with a converted internal port number. So that, even when an access is made while the same external port number is designated from a different terminal device, communication is established with different servers, thereby reducing the number of external port to be maintained than before. <P>COPYRIGHT: (C)2008,JPO&INPIT

Description

  The present invention relates to a relay device that is arranged between an external network such as the Internet and an internal network such as an intranet, and relays communication between both networks, and a program.

  Using a port forwarding function (static IP masquerading), a device on an internal network such as an intranet can be accessed from a device on an external network such as the Internet via a relay device such as a gateway device.

  In this case, the relay apparatus has in advance a conversion table that stores a correspondence relationship between an external port number that is a port for an external network and a local IP address. When a device on the external network accesses a specific device on the internal network via the relay device, the device is accessed by specifying the external port number of the relay device. Then, the relay apparatus that has received this access identifies the local IP address corresponding to the external port number by referring to the above-described conversion table from the designated external port number. Communication is relayed so as to access a specific device on the internal network having the specified local IP address.

  Here, this port forwarding function requires as many external port numbers of the relay apparatus as the number of access destination devices. For this reason, when the number of devices to be accessed is large, a large number of external port numbers are required, and maintenance work such as newly defining or updating external port numbers becomes troublesome.

Patent Document 1 discloses a technique for performing maintenance work of the external port number without human intervention as much as possible.
JP 2004-328027 A

  However, even if the technique disclosed in Patent Document 1 is used, there is no change in that the number of external port numbers is required as the number of access destination devices. The maintenance work will be time consuming.

  In addition, the port forwarding function has a problem from the viewpoint of security because any device on the external network can access a specific device on the internal network if it is accessed by specifying the external port number. .

  The present invention has been made in view of the above circumstances, and provides a relay device that can reduce the labor of maintenance and management of external port numbers and can improve security, and a control method therefor. For the purpose.

In order to achieve the above object, a relay device according to the first aspect of the present invention provides:
A relay device that relays communication between an external network and an internal network,
In association with a set of an external IP address that is an IP (Internet Protocol) address of a device on the external network and a number of an external port that is a port provided for the external network side, Storage means for storing a set of a local IP address of a device and a number of one port of the device;
In response to an access request to an external port from a device on the external network, the external IP address of the device on the external network that is the transmission source of the access request, and the number of the external port that is the transmission destination of the access request An access destination specifying means for specifying a local IP address and a port number associated with the set of the information based on the information stored in the storage means;
Transfer means for transferring the access request to a port having a port number specified by the access destination specifying means of a device on the internal network having the local IP address specified by the access destination specifying means;
It is characterized by providing.

The storage means stores an internal port number in association with a set of an external IP address and an external port number of a device on the external network,
The access destination specifying means responds to an access request to an external port from a device on the external network, and an external IP address of a device on the external network that is a transmission source of the access request and a transmission destination of the access request The internal port number associated with the external port number is identified based on the information stored in the storage means, and the access request is sent to the internal port having the identified internal port number. The transmission destination may be changed, and the local IP address and the port number associated with the changed internal port number may be specified based on the information stored in the storage unit.

In response to an access request to an external port from a device on the external network, the external IP address of the device on the external network that is the transmission source of the access request, and the number of the external port that is the transmission destination of the access request Further comprising a determining means for determining whether or not a set of data is stored in the storage means,
When the determination unit determines that the combination of the external IP address and the external port number is not stored in the storage unit, the device that is the transmission source of the access request cannot access the device on the internal network. You may further provide a notification means to notify that.

In response to an access request to an external port from a device on the external network, the external IP address of the device on the external network that is the transmission source of the access request, and the number of the external port that is the transmission destination of the access request Further comprising a determining means for determining whether or not a set of data is stored in the storage means,
When the determination unit determines that the combination of the external IP address and the external port number is not stored in the storage unit, the device that is the transmission source of the access request can access the device on the internal network. You may further provide the registration means which performs the process for registering information in a memory | storage means.

In order to achieve the above object, a program according to the second aspect of the present invention provides:
A program that causes a computer to realize the function of a relay device that relays communication between an external network and an internal network,
Computer
In association with a set of an external IP address that is an IP (Internet Protocol) address of a device on the external network and a number of an external port that is a port provided for the external network side, Storage means for storing a set of a local IP address of a device and a number of one port of the device;
In response to an access request to an external port from a device on the external network, the external IP address of the device on the external network that is the transmission source of the access request, and the number of the external port that is the transmission destination of the access request An access destination specifying means for specifying a local IP address and a port number associated with the set of the information based on the information stored in the storage means;
Transfer means for transferring the access request to a port having a port number specified by the access destination specifying means of a device on the internal network having the local IP address specified by the access destination specifying means;
To function as.

  According to the present invention, since a plurality of different devices on the internal network can be accessed with a single external port number, the number of external port numbers can be reduced, and the burden associated with maintenance management of external port numbers. Can be reduced. In addition, communication with improved security can be performed.

  Hereinafter, a communication system including a relay device according to an embodiment of the present invention will be described with reference to the drawings.

As shown in FIG. 1, the communication system of this embodiment includes a plurality of terminal devices 1 (1 ₁ to 1 _n ) connected to the Internet N1 (external network) and a plurality of terminals installed in an intranet N2 (internal network). A server 2 (2 _{1 to} 2 _n ), and a gateway device 3 connected between the Internet N1 and the intranet N2.

  The terminal device 1 is a general PC (personal computer), a portable terminal, or the like having a function of connecting to the Internet N1. Each terminal device 1 is set with a global IP address (hereinafter referred to as an IP address).

  The server 2 is a general file server 2 or a WEB server 2 installed in the intranet N2. Each server 2 is set with a local IP address uniquely given in the intranet N2.

  The gateway device 3 is a device that is disposed between the Internet N1 and the intranet N2 and connects the two networks. As shown in FIG. 2, the gateway device 3 includes an external network I / F unit 31, an internal network I / F unit 32, a main storage unit 33, a storage unit 34, a control unit 35, and a display unit 36. And an operation unit 37.

  The external network I / F unit 31 is an interface connected to the Internet N1. In the external network I / F unit 31, an IP address and a plurality of port numbers (external port numbers) designated for access from the Internet N1 side are set.

  The internal network I / F unit 32 is an interface for connecting to each server 2 arranged in the intranet N2. In the internal network I / F unit 32, a local IP address and a port number designated for access from the intranet N2 side are set.

  The main storage unit 33 is composed of a RAM (Random Access Memory) or the like, and serves as a work area for the control unit 35 to execute various processes described later.

  The storage unit 34 includes a RAM, a ROM (Read Only Memory), and the like, and stores a program executed by the control unit 35 to perform various processes. In addition, the storage unit 34 stores a conversion table 341.

The conversion table 341 is a table that is referred to in order to identify the access destination server 2 when the terminal device 1 accesses the server 2.
As shown in FIG. 3, the conversion table 341 is set by the IP address of the terminal device 1, the external port number of the gateway device 3 that can be accessed by the terminal device 1, and the conversion table 341 registration process described later. The internal port number of the gateway device 3 and the local IP address and port number of the access destination terminal device 1 corresponding to the internal port number are stored.

  The control unit 35 includes a CPU (Central Processing Unit) and the like, and controls various operations of the terminal device 1 by executing a program stored in the storage unit 34.

  Functionally, the control unit 35 includes a conversion table setting unit 351, an internal port conversion processing unit 352, and an application proxy processing unit 353, as shown in FIG.

  The conversion table setting unit 351 performs processing such as addition, update, and deletion of records in the conversion table 341.

  In response to the access request to the external port number of the terminal device 1 received by the external network I / F unit 31, the internal port conversion processing unit 352 receives the IP address and access destination of the server 2 that is the transmission source of the access request. It is determined whether or not a pair with the external port number is stored in the conversion table 341. If it is determined that it is stored, the external port number of the access destination is converted into the internal port number stored in association with the set.

  The application proxy processing unit 353 associates the destination IP address with the local IP address and port number of the server 2 stored in the conversion table 341 in association with the internal port number converted by the internal port conversion processing unit 352. Convert the port number. Then, the communication data is transmitted to the port number of the converted server 2 of the transmission destination.

  Next, the operation of the gateway device 3 in the communication system of this embodiment will be described.

(Conversion table 341 registration process)
First, a process of registering a new record in the conversion table 341 that is referred to when the terminal device 1 accesses a specific server 2 (conversion table 341 registration process) will be described with reference to FIG.

  First, a screen (conversion table 341 registration screen) as shown in FIG. 6 for the administrator of the intranet N2 to operate the operation unit 37 of the relay device to register a new record in the conversion table 341 is displayed on the display unit. 36. By operating the operation unit 37, various information (that is, the IP address and external port number on the Internet N1 side, and the IP address and port number on the intranet N2 side) are input on the conversion table 341 registration screen. When the “Register” button is pressed, a conversion table 341 addition request including the input information is transmitted to the control unit 35.

  When receiving the conversion table 341 addition request (step S11; Yes), the control unit 35 of the gateway device 3 receives the input information included in the received conversion table 341 addition request (that is, the Internet N1 input on the conversion table 341 registration screen). Side IP address, external port number, and intranet N2 side IP address, port number) are registered for addition to the conversion table 341 (step S12). That is, the input information is temporarily stored in the main storage unit 33 or the storage unit 34 as information to be added to the conversion table 341.

  Next, the control unit 35 of the gateway device 3 issues a new internal port number that is not yet stored in the conversion table 341 (step S13).

  Then, the control unit 35 of the gateway device 3 associates the input information registered in step S12 with the internal port number issued in step S13, and registers the new information in the conversion table 341 (step S14). The 341 registration process ends.

  For example, when the input information is input as shown in FIG. 6 and the registration button is pressed on the conversion table 341 registration screen, the above conversion table 341 shown in FIG. A third record will be added. Further, the internal port number “60003” of the registered record is a unique value in the conversion table 341.

  In this way, the conversion table 341 registration process registers the record of the conversion table 341 that is referred to for access by the terminal device 1. Also, the internal port number assigned to this record is assigned a unique one in the conversion table 341.

(Server access processing)
Next, processing (server access processing) in which the terminal device 1 accesses the server 2 via the gateway device 3 will be described with reference to FIG.

  The external network I / F unit 31 of the gateway device 3 receives an access request to the server 2 from the terminal device 1. In this access request, the IP address and port number of the terminal device 1 are set as the transmission source, and the IP address and external port number of the gateway device 3 are set as the transmission destination.

  In response to the reception of this access request, the control unit 35 of the gateway device 3 receives the IP address of the terminal device 1 set as the transmission source in the received access request and the gateway device 3 set as the transmission destination. It is determined whether or not the pair with the external port number is stored in the conversion table 341 (step S21).

  If it is determined that it is not stored (step S21; No), the control unit 35 of the gateway device 3 transmits a notification that the server 2 cannot be accessed to the terminal device 1 that is the transmission source (step S22), and ends the processing. To do.

  If it is determined that the combination of the IP address and the external port number is stored (step S21; Yes), the control unit 35 of the gateway device 3 associates the set with the internal port number stored in the conversion table 341. Then, the port number of the transmission destination is converted (step S23).

  Next, the control unit 35 of the gateway apparatus 3 associates the destination IP address and port number with the local IP address of the server 2 stored in the conversion table 341 in association with the internal port number converted in step S23. Each is converted into a port number (step S24).

Then, the control unit 35 of the gateway apparatus 3 transmits the access request received from the terminal apparatus 1 to the converted port number of the server 2 having the local IP address converted in step S24 (step S25).
Thus, the server access process ends.

Next, the server access process will be described with a specific example.
As shown in FIG. 8, it is assumed that there are terminal apparatuses A1 and A2 whose IP addresses are set to “232.0.0.1” and “232.0.0.2”, respectively. Then, the terminal devices A1 and A2 have an IP address of “232.0.0.10” and a local IP address “192.168.0.10” set via the gateway device 3 set to “ Processing for accessing the servers B1 and B2 on the intranet N2 set to “192.168.0.1” and “192.168.0.2” will be described. Note that the conversion table 341 stores information as shown in FIG.

  In this case, the terminal devices A 1 and A 2 access the same external port number “200” of the gateway device 3. The conversion table 341 of the gateway device 3 includes a set of the IP address “232.0.0.1” of the terminal device A1 and the external port number “200” of the access destination, and the IP address “232.0 of the terminal device A2. .0.2 ”and the external port number“ 200 ”of the access destination are stored. Therefore, the internal port conversion processing unit 352 of the gateway device 3 stores the external port numbers of the transmission destinations in the internal port numbers “60001” and “60002” stored in the conversion table 341 in association with the respective sets. Converted.

  Then, the application proxy processing unit 353 of the gateway device 3 associates the IP address and port number set as the transmission destination with the internal port numbers “60001” and “60002” converted earlier, respectively, and the conversion table 341. Is converted into a local IP address and a port number of the server stored in. That is, in the terminal device A1, the transmission destination is converted to the local IP address “192.168.0.1” and the port number “80”. In the terminal device A2, the transmission destination is converted to the local IP address “192.168.0.2” and the port number “8080”.

  Then, the access requests are respectively transferred to the same converted port number of the server having the converted local IP address. That is, in the terminal device A1, the access request is transferred to the port number “80” of the server B1 having the local IP address “192.168.0.1”. In the terminal device A2, the access request is forwarded to the port number “8080” of the server B2 having the local IP address “192.168.0.2”.

  As described above, the gateway device 3 can access the separate servers B1 and B2 even though the terminal device A1 and A2 access the same external port number “200” of the gateway device 3.

As described above, when the gateway device 3 according to the present embodiment accesses the server 2 on the intranet from the terminal device 1 on the Internet N1, the IP address of the terminal device 1 that is the access source and the gateway device that is the access destination The internal port number stored in the conversion table 341 is acquired based on the external port number, and the access destination server 2 is specified from the internal port number.
Therefore, even if different terminal devices 1 access the same external port number, it becomes possible to access different servers 2 by the IP address of each terminal device, and the number of external port numbers managed by the gateway device 3 is reduced. It becomes possible to do. Therefore, the burden of maintaining and managing external port numbers is reduced.

  Further, when the terminal device 1 designates an external port number for access, if the set of the IP address of the terminal device 1 and the designated external port number is not stored in the conversion table 341, Access relay is not performed. As a result, unauthorized access from the terminal device 1 can be prevented, and communication with higher security can be performed.

  In addition, this invention is not limited to the said embodiment, A various deformation | transformation and application are possible.

  In the above embodiment, communication between the terminal device 1 on the Internet N1 and the server 2 on the intranet N2 has been described as an example. However, the present invention is applied to communication other than communication between the terminal device and the server. Also good. For example, the present invention may be applied to communication between mobile phones connected on the Internet N1 and the intranet N2.

  Further, in the above embodiment, in step S21 of the server access process, it is determined whether or not the pair of the access request transmission source IP address and the transmission destination external port number is stored in the conversion table 341. However, when it is known in advance that the set is reliably stored in the conversion table 341, this determination process is not necessarily performed.

  Further, in the above embodiment, if the combination of the IP address of the transmission source of the access request and the external port number of the transmission destination is not stored in the conversion table 341 in the determination process of step S21 of the server access process, the server It explained that it would notify 2 that access was not possible. However, instead of performing this notification, the conversion table registration process described above is performed in which the access destination corresponding to the pair of the IP address of the transmission source of the access request and the external port number of the transmission destination is registered in the conversion table 341. It may be.

  In the above embodiment, in the server access process, the access destination is converted into the internal port number associated with the pair of the IP address of the transmission source and the external port number of the transmission destination, and the converted internal port number is converted to the converted internal port number. The access destination (local IP address, port number) associated with each other is accessed. However, the access destination may be accessed by specifying the access destination from the combination of the IP address of the transmission source and the external port number of the transmission destination and the storage information of the conversion table. There is no need to perform conversion.

  Further, in the above embodiment, it has been described that the process of registering a record in the conversion table 341 is started by the operation of the operation unit 37 on the conversion table registration screen displayed on the display unit 36 of the gateway device 3. . However, the gateway device 3 does not have to include the display unit 36 or the operation unit 37. In this case, the registration process of the conversion table 341 is performed from a PC (personal computer) connected to the gateway device 3. Just do it.

  Moreover, the conversion table 341 does not need to be stored in the gateway device 3 as in the above embodiment. For example, this conversion table 341 may be stored in a DB (database) server or the like connected to the gateway device 3. In this case, the gateway device 3 accesses this DB server and acquires necessary information from the conversion table 341 stored in the DB server.

  The function performed by the control unit 35 of the gateway device 3 according to the above embodiment can also be realized by a general-purpose microprocessor, CPU, or the like. In this case, you may make a processor run the program for implement | achieving said each process.

It is the figure which showed the structure of the communication system which concerns on embodiment of this invention. It is the block diagram which showed the structure of the gateway apparatus contained in the communication system shown in FIG. It is a figure which shows the example of the conversion table which the memory | storage part of the gateway apparatus shown in FIG. 2 memorize | stores. It is the figure which showed the function structure of the control part of the gateway apparatus shown in FIG. It is a flowchart for demonstrating operation | movement of a conversion table registration process. It is a figure which shows the example of a conversion table registration screen. It is a flowchart for demonstrating operation | movement of a server access process. It is a figure for demonstrating the specific example of the server access process shown in FIG.

Explanation of symbols

1 Terminal device 2 Server 3 Gateway device 341 Conversion table N1 Internet N2 Intranet

Claims (5)

A relay device that relays communication between an external network and an internal network,
In association with a set of an external IP address that is an IP (Internet Protocol) address of a device on the external network and a number of an external port that is a port provided for the external network side, Storage means for storing a set of a local IP address of a device and a number of one port of the device;
In response to an access request to an external port from a device on the external network, the external IP address of the device on the external network that is the transmission source of the access request, and the number of the external port that is the transmission destination of the access request An access destination specifying means for specifying a local IP address and a port number associated with the set of the information based on the information stored in the storage means;
Transfer means for transferring the access request to a port having a port number specified by the access destination specifying means of a device on the internal network having the local IP address specified by the access destination specifying means;
A relay device comprising: The storage means stores an internal port number in association with a set of an external IP address and an external port number of a device on the external network,
The access destination specifying means responds to an access request to an external port from a device on the external network, and an external IP address of a device on the external network that is a transmission source of the access request and a transmission destination of the access request The internal port number associated with the external port number is identified based on the information stored in the storage means, and the access request is sent to the internal port having the identified internal port number. The transmission destination is changed, and the local IP address and the port number associated with the changed internal port number are specified based on the information stored in the storage unit.
The relay apparatus according to claim 1. In response to an access request to an external port from a device on the external network, the external IP address of the device on the external network that is the transmission source of the access request, and the number of the external port that is the transmission destination of the access request Further comprising a determining means for determining whether or not a set of data is stored in the storage means,
When the determination unit determines that the combination of the external IP address and the external port number is not stored in the storage unit, the device that is the transmission source of the access request cannot access the device on the internal network. A notification means for notifying
The relay apparatus according to claim 1, wherein the relay apparatus is characterized in that In response to an access request to an external port from a device on the external network, the external IP address of the device on the external network that is the transmission source of the access request, and the number of the external port that is the transmission destination of the access request Further comprising a determining means for determining whether or not a set of data is stored in the storage means,
When the determination unit determines that the combination of the external IP address and the external port number is not stored in the storage unit, the device that is the transmission source of the access request can access the device on the internal network. A registration unit that performs processing for registering information in the storage unit;
The relay apparatus according to any one of claims 1 to 3, wherein the relay apparatus is characterized in that A program that causes a computer to realize the function of a relay device that relays communication between an external network and an internal network,
Computer
In association with a set of an external IP address that is an IP (Internet Protocol) address of a device on the external network and a number of an external port that is a port provided for the external network side, Storage means for storing a set of a local IP address of a device and a number of one port of the device;
In response to an access request to an external port from a device on the external network, the external IP address of the device on the external network that is the transmission source of the access request, and the number of the external port that is the transmission destination of the access request An access destination specifying means for specifying a local IP address and a port number associated with the set of the information based on the information stored in the storage means;
Transfer means for transferring the access request to a port having a port number specified by the access destination specifying means of a device on the internal network having the local IP address specified by the access destination specifying means;
Program to function as.

Images