JP2009010606A - Tunnel connection system, tunnel control server, tunnel connecting device, and tunnel connection method - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To provide a tunnel connection system capable of performing data packet transfer with a low processing load and without depending upon an application between apparatuses belonging to different home networks. <P>SOLUTION: In the tunnel connection system 1, a tunnel control server 20 allocates a network address so as to make a network 40 and a network 41 the same network, and transmits to tunnel connecting devices 10 and 11 the network address and tunnel connection information including information of the range of IP addresses allocatable to apparatuses being subordinates of the tunnel connecting devices 10 and 11. The tunnel connecting devices 10 and 11 each receive the tunnel connection information and allocate an IP address to the apparatuses being subordinates of the tunnel connecting devices on the basis of the tunnel connection information. <P>COPYRIGHT: (C)2009,JPO&INPIT

Description

  The present invention relates to a tunnel connection system, a tunnel management server, a tunnel connection device, and a tunnel connection method for establishing a tunnel between devices existing in different home networks and the like and realizing direct communication such as Peer to Peer communication. .

  Recently, home appliances (TVs, set-top boxes, HDD recorders, TV game machines, etc.) equipped with a network function for connecting to the Internet have been released. With the widespread use of ultra-high-speed communication networks in each home, A private network (hereinafter referred to as a home network) in which PCs are connected to each other by wire or wireless is being constructed.

  In a home network, generally, an IP address (hereinafter referred to as a private IP address) that can be used locally is different from an IP address (hereinafter referred to as a global IP address) that is uniquely used on the Internet. And a global IP address is assigned to a gateway device in the home network (hereinafter referred to as a home network gateway device) from an Internet service provider (ISP).

  The home gateway device has an address-port number translation (NAPT) function (or simply an address translation (or simply an address translation)) that mutually translates a device private IP address and a global IP address and a port number assigned to the home gateway device. Network Address Translation (NAT) function), and devices in the home network are connected to the Internet via the home gateway device.

  In the future, home appliances will be retained from terminals outside the home (for example, cafes, offices, friends' homes, etc.) by connecting a variety of home appliances to the home gateway device and connecting to the Internet. It is expected that users' needs for various services such as sharing data that is being used and remotely controlling home appliances in the house will increase. In order to realize these services, the NAPT set in the home gateway device when accessing an in-home home appliance from a terminal outside the home is important.

  NAPT converts a private IP address and a port number used for communication (hereinafter referred to as a private port number) into a global IP address and a port number (hereinafter referred to as a global port number). This function converts an address and a global port number into a private IP address and a private port number. This makes it possible to simultaneously access devices on the Internet side from a plurality of devices in the home.

  However, when a device on the Internet side tries to access a device in a home network that uses NAPT, the device on the Internet side has a global IP address corresponding to the private IP address and private port number of the device in the home network. Since the port number cannot be known, communication cannot be performed as it is.

  Therefore, in order to realize secure communication between a device on the Internet side and a device in the home network, the Internet side device knows a NAT solution technology that knows a communicable IP address and port number, and UDP encapsulation, L2TP (Layer 2). Tunneling technology for encapsulating packets transmitted by devices in a home network, such as Tunneling Protocol), is used. The NAT resolution technology includes a technology for performing NAT resolution using UPnP to a UPnP IGD (Universal Plug and Play Internet Gateway Device) -compatible home gateway, and performing NAT resolution by transmitting UDP packets from inside the NAT. STUN (Simple Travel of UDP through NATs) and the like.

  As described above, the home network and the Internet can be connected to each other by the NAT solution technology and the tunneling technology. However, in order to make a device in the home network and a device in a different home network peer-to-peer connection (hereinafter referred to as P2P connection), the following further needs to be considered.

  Since each home network has its own private IP address, different home networks may use the same private IP address. Therefore, when trying to transfer a data packet from a device, if the private IP address of the device in the home network and the device in the partner's home network overlap, the data packet is transferred to which home network device Cannot be determined and the data packet cannot be transferred.

  A home gateway device (for example, see Patent Document 1) for solving this problem is disclosed. FIG. 10 is a diagram illustrating an internal configuration of a conventional home gateway device. In the home gateway device of FIG. 10, when a device such as a home appliance or a PC connected to the device is connected to a device in a different home network, the device transmits a connection request to the home gateway device, and the home gateway is triggered by the request. The device resolves the global IP address of the opposing home gateway device by communicating with a DNS (Domain Name System) server located on the Internet.

  Thereafter, a home-to-home tunneling initiation (HTIP) processing unit in the home gateway device negotiates with the opposing home gateway device to establish a tunnel between the home gateway devices. At this time, tunnel parameters are exchanged between the home gateway devices, and it is detected whether the private IP addresses of the devices connected to the home gateway devices are not duplicated. If the private IP address overlaps, the home gateway device creates a network address table used by the NAT / NAPT processing unit so that the private IP address does not overlap.

  In addition, for the data packet transferred from the subordinate device, the IP address of the header part is changed to NAT / NAPT based on the newly created network address table before and after the transfer of the tunnel established between the home gateway devices. Conversion is performed by the conversion processing unit. As a result, IP packets do not overlap between devices belonging to different home networks, and data packets can be transferred.

JP 2004-229299 A

  However, in applications such as UPnP that realizes plug-and-play between devices, UPnP AV that enables sharing of AV content between devices, and SIP (Session Initiation Protocol) that establishes a session between devices, the payload of the data packet Part contains IP address information.

  Conventionally, when IP addresses overlap between devices belonging to different home networks, in communication by the application, in addition to conversion of the IP address of the header portion of the data packet, rewriting of IP address information included in the payload portion (hereinafter referred to as the IP address information) (Referred to as application-level IP address translation).

For this reason, in the IP address conversion at the application level, the payload portion must be analyzed in the application layer for each data packet to convert the IP address information. Therefore, the processing load at the time of data packet transfer is high and the performance is poor. It was.

  In addition, it is necessary to convert the IP address included in the payload for each application. When communicating with a new application, an IP address conversion process corresponding to the application must be added. Met.

  The present invention has been made in view of the above circumstances, and performs application-independent data packet transfer with a low processing load between devices belonging to different home networks without performing IP address conversion at the application level. An object of the present invention is to provide a tunnel connection system, a tunnel management server, a tunnel connection device, and a tunnel connection method.

  In order to achieve the above object, a first tunnel connection system of the present invention is arranged in a first network via the Internet, and includes a first tunnel connection device for performing a tunnel connection, A tunnel connection system arranged in a network and connected to a second tunnel connection device for performing a tunnel connection and a tunnel management server for managing the tunnel connection, the tunnel management server comprising: A network address is assigned so that the first network and the second network are the same network, and the network address and a range of IP addresses that can be assigned to the devices under the first and second tunnel connection devices To the first and second tunnel connection devices. The first and second tunnel connection devices each receive the tunnel connection information and, based on the tunnel connection information, assign IP addresses to devices under the tunnel connection device. The tunnel control unit to be assigned is configured.

  According to the above configuration, it is possible to perform highly versatile data packet transfer between devices belonging to different home networks without depending on the application, and without depending on the application, without performing IP address conversion at the application level. . For example, since a range of IP addresses that can be assigned to devices connected to the tunnel connection device is assigned so that the home networks under each tunnel connection device are the same network (subnet), the IP addresses do not overlap. Even in a device cooperation application that includes information on the IP address of the device in the payload portion, data can be transferred without converting the IP address of the data packet.

  In the second tunnel connection system of the present invention, the tunnel control unit of the first and second tunnel connection devices registers the network address information so that data can be transferred between each other. It is configured to set a tunnel that is.

  According to the above configuration, IP addresses can be set so that devices on different home networks do not overlap each other, tunnel connection can be realized, application is not dependent on low processing load, and versatility is high. Data packet transfer can be performed.

  Further, according to the third tunnel connection system of the present invention, a device under the first tunnel connection device and a device under the second tunnel connection device communicate with each other through the tunnel using the IP address. It is configured to do.

  According to the above configuration, it is possible to perform tunnel connection between communication devices in different networks, and it is possible to perform data packet transfer that is low in processing load and does not depend on an application, and that is highly versatile.

  In addition, the first tunnel management server of the present invention is arranged in the first network and is arranged in the second network and the first tunnel connection device for performing the tunnel connection, and performs the tunnel connection. A tunnel management server that manages the tunnel connection with the second tunnel connection device and is connected to the Internet, so that the first network and the second network are the same network. The first and second tunnel connection devices are assigned with a network address, and tunnel connection information including information on a range of IP addresses that can be assigned to the devices under the network address and the first and second tunnel connection devices. A network address management unit for transmitting to the network.

  According to the above configuration, it is possible to perform highly versatile data packet transfer between devices belonging to different home networks without depending on the application, and without depending on the application, without performing IP address conversion at the application level. . For example, since a range of IP addresses that can be assigned to devices connected to the tunnel connection device is assigned so that the home networks under each tunnel connection device are the same network (subnet), the IP addresses do not overlap. Even in a device cooperation application that includes information on the IP address of the device in the payload portion, data can be transferred without converting the IP address of the data packet.

  The first tunnel connection device of the present invention is a tunnel connection device for performing a tunnel connection with another tunnel connection device arranged in another network, for managing the tunnel connection. A network address assigned by the tunnel management server so that the other network and the network in which the tunnel connection device is arranged are the same network, a range of IP addresses that can be assigned to devices under the tunnel connection device, And tunnel connection information including information on a range of IP addresses that can be assigned to devices under the other tunnel connection device, and assigning IP addresses to devices under the tunnel connection device based on the tunnel connection information The control unit is included.

  According to the above configuration, it is possible to perform highly versatile data packet transfer between devices belonging to different home networks without depending on the application, and without depending on the application, without performing IP address conversion at the application level. . For example, since a range of IP addresses that can be assigned to devices connected to the tunnel connection device is assigned so that the home networks under each tunnel connection device are the same network (subnet), the IP addresses do not overlap. Even in a device cooperation application that includes information on the IP address of the device in the payload portion, data can be transferred without converting the IP address of the data packet.

  In the second tunnel connection device of the present invention, a tunnel control unit registers a network address information, so that a tunnel which is a route for performing data transfer with the other tunnel connection device is added. The configuration is set.

  According to the above configuration, IP addresses can be set so that devices on different home networks do not overlap each other, tunnel connection can be realized, application is not dependent on low processing load, and versatility is high. Data packet transfer can be performed.

  The first tunnel connection method of the present invention is disposed in the first network via the Internet, and is disposed in the second network, the first tunnel connection device for performing the tunnel connection, A tunnel connection method used in a tunnel connection system in which a second tunnel connection device for performing a tunnel connection and a tunnel management server for managing the tunnel connection are connected, wherein the tunnel management server includes: A network address is assigned so that the first network and the second network are the same network, and the network address and a range of IP addresses that can be assigned to the devices under the first and second tunnel connection devices The tunnel connection information including the information of the first and second tunnels A step of transmitting to a connection device, and a step of receiving the tunnel connection information in each of the first and second tunnel connection devices and assigning an IP address to a device under the tunnel connection device based on the tunnel connection information And a method having

  According to the above-described method, it is possible to perform highly versatile data packet transfer between devices belonging to different home networks without depending on the application, and without depending on the application, without performing IP address conversion at the application level. . For example, since a range of IP addresses that can be assigned to devices connected to the tunnel connection device is assigned so that the home networks under each tunnel connection device are the same network (subnet), the IP addresses do not overlap. Even in a device cooperation application that includes information on the IP address of the device in the payload portion, data can be transferred without converting the IP address of the data packet.

  In the second tunnel connection method of the present invention, in the first and second tunnel connection devices, a tunnel which is a path for performing data transfer between each other is registered by registering information on the network address. The method includes a step of setting.

  According to the above method, IP addresses can be set so that devices on different home networks do not overlap with each other, tunnel connection can be realized, application is not dependent on low processing load, and versatility is high. Data packet transfer can be performed.

  In the third tunnel connection method of the present invention, the device under the first tunnel connection device and the device under the second tunnel connection device communicate with each other through the tunnel using the IP address. The way to do it.

  According to the above method, it is possible to perform tunnel connection between communication devices in different networks, and it is possible to perform data packet transfer that is low in processing load and does not depend on an application, and that is highly versatile.

  According to the present invention, since communication between devices belonging to different home networks does not require IP address conversion of the data packet transmitted from the device (conversion of information in the header and payload), the application can be performed with low processing load. It is possible to transfer data packets that do not depend on. Therefore, applications can communicate with each other through devices linked applications such as UPnP / UPnP AV between devices belonging to different home networks without being aware that the home networks are different.

  Hereinafter, a tunnel connection system and a tunnel connection method according to an embodiment of the present invention will be described in detail with reference to the drawings.

  Fig.1 (a) is a figure which shows an example of a structure of the tunnel connection system 1 in embodiment of this invention. The tunnel connection system 1 includes a tunnel connection device (A) 10, (B) 11, a tunnel management server 20, a home gateway device (A) 30, (B) 31, a home network (A) 40, (B) 41, an ISP 50. , 51, device AA 60, device AB 61, device BA 62, and Internet 70.

  The home networks 40 and 41 are configured to include devices (device AA60, device AB61, device BA62, etc.) such as home appliances, TVs, HDD recorders, game machines, audio devices, and PCs, and tunnel connection devices 10 and 11. . The tunnel connection device 10 (11) is a device that makes a tunnel connection with the opposing tunnel connection device 11 (10) (a tunnel connection device arranged in the home network of the counterpart device connected by P2P). Devices (device AA, device BA, etc.) to be connected to the devices of the home networks 40, 41 are installed under the tunnel connection devices 10, 11.

  The devices in the home networks 40 and 41 and the tunnel connection devices 10 and 11 are connected to ISP networks 50 and 51 via home gateway devices (Home Gateway: HGW) 30 and 31 having a NAT / NAPT function, and the Internet. 70.

  A tunnel management server 20 is installed on the Internet 70, supports tunnel connection between tunnel connection devices (to perform NAT resolution and tunnel connection setting in cooperation with the tunnel connection device), and subordinate to each tunnel connection device 10, 11. Manage network addresses.

  A private IP address (for example, 192.168.0.2 in the home network 40 in the figure) is assigned to the interface on the home gateway side of the tunnel connection devices 10 and 11 from the home gateway devices 30 and 31. In addition, the IP address assigned by the tunnel management server 20 (169.254.0 for the tunnel connection device 10 in the figure) is assigned to the interface on the opposite side of the home gateway of the tunnel connection devices 10 and 11 and the devices under the interface. .1, 169.254.0.2) is set in the device AA60.

  The home gateway devices 30 and 31 are assigned a global IP address assigned by the ISP to the interface on the Internet 70 side, and a private IP address is assigned to the home network 40 and 41 side (for example, the home gateway device 30 in the figure). Is assigned a global IP address 210.110.10.5 and a private IP address 192.168.0.1). The IP address is similarly set for the opposing tunnel connection device 11.

  Here, an outline of an example of packet transfer processing in each device when a data packet is transferred from a device connected to the tunnel connection device 10 (11) to a device under the tunnel connection device 11 (10) facing the tunnel connection device 10 (11). explain. FIG. 1B shows an example in which data packet transfer is performed from the device AA60 or the device AB61 to the device BA62.

  First, the data packet transmitted from the device is encrypted by the tunnel connection device 10 and encapsulated by UDP. At this time, the destination IP address in the outer IP header is the global IP address of the opposing home gateway device 31, and the destination port number is the global port number to which the opposing tunnel connection device 11 is mapped in the opposing home gateway device 31. The private IP address of the tunnel connection device 10 is set as the source IP address. In the figure, the destination IP address is 200.100.0.2 in the tunnel connection device 10, the destination port number is the global port number mapped to the tunnel connection device 11 in the home gateway device 31, and the source IP address is It is encapsulated with a UDP / IP header of 192.168.0.1.

  Thereafter, the home gateway device 30 converts the source IP address of the received packet into the global IP address of the home gateway device 30 and transfers it to the opposing home gateway device 31 via the Internet 70. In the figure, in the home gateway device 30, the transmission source IP address is converted to 210.110.10.5 and transferred to the home gateway device 31.

  The opposing home gateway device 31 that has received the data packet converts the destination IP address into the private IP address 192.168.0.2 of the tunnel connection device 11 and transfers it to the tunnel connection device 11. The tunnel connection device 11 decapsulates and decrypts the UDP / IP header, and the data packet is transferred to the subordinate device BA62.

  Here, an example of the configuration of the tunnel connection devices 10 and 11 in the tunnel connection system 1 will be described.

  FIG. 2 is a block diagram showing an example of the internal configuration of the tunnel connection devices 10 and 11 in the embodiment of the present invention. The tunnel connection devices 10 and 11 include a tunnel interface 101, an IP processing unit / routing unit 102, a tunnel control unit 103, an encryption / decryption processing unit 104, a tunnel connection processing unit 105, a device connection control unit 106, and an IP address management unit. 107, a user / device authentication processing unit 108, an HGW-side interface 109 connected to the home network, and a device-side interface 110 connected to subordinate devices.

  The tunnel interface 101 is not a physical network interface but a virtual network interface for transferring a data packet inside a device to a tunnel established with an opposing tunnel connection device.

  The IP processing unit / routing unit 102 processes the IP packet received from each interface or each processing unit, and performs path control to each interface or each processing unit based on the routing table and the protocol information of the packet. FIG. 3 is a diagram conceptually illustrating a setting example of the routing table.

  When the tunnel control unit 103 establishes a tunnel with the opposing tunnel connection device, the tunnel control unit 103 negotiates parameters for setting the tunnel with the tunnel management server 20 and the opposing tunnel connection device, and performs NAT resolution and tunneling for each. Control the processing unit. Further, the network address acquired from the tunnel management server 20 is set in the IP address management unit 107, and parameters related to the tunnel (IP address, port number, encryption parameter, etc. of the opposing tunnel connection device) are set in the tunnel connection processing unit 105 and the encryption. The tunnel interface 101 is generated by setting in the encryption / decryption processing unit 104. The tunnel interface 101 is generated for each established tunnel.

  The encryption / decryption processing unit 104 encrypts the data packet received from the IP processing unit / routing unit 102 and transfers it to the tunnel connection processing unit 105 or decrypts the data packet received from the tunnel connection processing unit 105. And transfer to the IP processing unit / routing unit 102.

  The tunnel connection processing unit 105 performs UDP encapsulation on the data packet received from the encryption / decryption processing unit 104 and transfers the data packet to the HGW side interface 109 or receives the data packet received from the IP processing unit / routing unit 102. UDP decapsulation and transfer to the encryption / decryption processing unit 104.

  In response to a connection request from a device under the tunnel connection device, the device connection control unit 106 authenticates the device at the user / device authentication processing unit 108, and the IP address management unit 107 performs authentication on the authenticated device. An unused IP address is assigned from the IP address management table. FIG. 4 is a diagram conceptually illustrating a setting example of the IP address management table. In the figure, 192.168.0.4 and 192.168.0.7 indicate that they are not used.

  Next, an example of the configuration of the tunnel management server 20 in the tunnel connection system 1 will be described.

  FIG. 5 is a block diagram showing an example of the internal configuration of the tunnel management server 20 in the embodiment of the present invention. The tunnel management server 20 includes a device control unit 201, a tunnel state management unit 202, a network address management unit 203, a device management unit 204, a device authentication unit 205, and an Internet side interface 206 connected to the Internet 70. .

  When the device control unit 201 receives a connection request from the tunnel connection device, the device control unit 201 authenticates the tunnel connection device requested for connection by the device authentication unit 205. Support the establishment of tunnels.

  The tunnel state management unit 202 manages the state of each tunnel established by the tunnel connection device.

  The network address management unit 203 manages the network address assigned to each tunnel connection device in association with the tunnel connection device in the network address management table. FIG. 6 shows an example of the network address management table. The network address management unit 203 assigns a network address to each tunnel connection device so that home networks under each tunnel connection device are the same network (subnet).

  The device management unit 204 manages the state (network information such as a global IP address) of each tunnel connection device.

  Next, an example of a tunnel connection operation in the tunnel connection system 1 will be described.

  FIG. 7 is a sequence chart showing the flow of processing when establishing a tunnel in the tunnel connection system 1. In the figure, an example in which the device AA 60 performs P2P communication with the device BA 62 is shown. It is assumed that the tunnel connection device 10 has never established a tunnel with another tunnel connection device. Further, the tunnel connection device 11 notifies the tunnel management server 20 of the global IP address (200.100.0.2) of the own device, has already established a tunnel with another tunnel connection device, and has tunneled to the device BA62. It is assumed that an IP address is assigned from the connection device 11.

  First, the device AA 60 requests the tunnel connection device 10 to connect to the device BA 62 (step S101). The tunnel connection apparatus 10 authenticates the device AA 60 with the user / device authentication processing unit 108 in the device connection control unit 106 (step S102), and when the authentication is successful, requests the tunnel management server 20 to connect (step S103). ). The device control unit 201 of the tunnel management server 20 that has received the connection request from the tunnel connection device 10 performs authentication of the tunnel connection device 10 by the device authentication unit 205 (step S104). When the authentication is successful, the device control unit 201 transmits a connection request from the tunnel connection device 10 to the tunnel connection device 11 based on the network information managed by the device management unit 204 (step S105). The tunnel connection device 11 returns a connection request response to the tunnel connection device 10 via the tunnel management server 20 (steps S106 and S107).

  The tunnel connection device 10 that has received the response cooperates with the tunnel management server 20 together with the tunnel connection device 11 to perform NAT resolution in order to set up a tunnel between the tunnel connection device 10 and the tunnel connection device 11. After the NAT resolution, the tunnel connection device 10 and the tunnel connection device 11 pass the tunnel parameters used in the tunnel connection (each global IP address, port number, encryption parameter, etc. obtained by the NAT resolution) via the tunnel management server 20. Are exchanged (step S108).

  After exchanging the tunnel parameters, the tunnel management server 20 determines the network address to be assigned to each tunnel connection device 10, 11 in the network address management unit 203 (step S109), and sends a tunnel connection request to each tunnel connection device 10, 11. Transmit (step S110 and step S111). The tunnel connection request includes an information element including a network address, a range of IP addresses that can be assigned to connected devices (including a tunnel connection device), and a range of IP addresses that are assigned to devices under the opposite tunnel connection device. Included as

  The tunnel connection device 10 receives the tunnel connection request at the tunnel control unit 103, extracts the network address included in the tunnel connection request and the range of IP addresses that can be assigned to the device, and the IP address of the IP address management unit 107 Register in the management table (step S112). Further, the tunnel control unit 103 registers the route to the tunnel connection device 11 in the routing table of the IP processing unit / routing unit 102 (step S113). In the routing table of FIG. 3, the route to the tunnel connection device 11 corresponds to the column whose interface is the tunnel AB I / F. On the other hand, in the tunnel connection device 11, the IP address management unit 107 registers the route to the tunnel connection device 10 (step S114).

  After setting the routing table, the tunnel connection device 10 transmits a tunnel setting completion notification via the tunnel set in the tunnel connection device 11 (step S115). The tunnel connection device 11 that has received the tunnel setting completion notification transmits a response to the tunnel connection device 10 (step S116). After the tunnel connection device 10 receives the response, the tunnel connection device 10 transmits a tunnel connection completion notification to the tunnel management server 20 (step S117). In the tunnel management server 20, the tunnel status management unit 202 registers the connection status of the tunnel AB as being connected. As a result, a tunnel between tunnel connection device 10 and tunnel connection device 11 (hereinafter referred to as tunnel AB) is opened (step S118), and communication using the tunnel becomes possible.

  Next, an example of processing when assigning an IP address to a device to which the tunnel connection devices 10 and 11 are connected when the tunnel is opened in the tunnel connection system 1 will be described. FIG. 8 is a sequence chart illustrating an example of a processing flow when assigning an IP address to a device to which the tunnel connection devices 10 and 11 are connected when the tunnel is opened in the tunnel connection system 1. It is assumed that the tunnel AB is opened between the tunnel connection device 10 and the tunnel connection device 11.

  After opening the tunnel AB (step S201), the tunnel connection device 10 refers to the IP address management table in the IP address management unit 107 and assigns an unused IP address to the device AA60 that requested the connection (step S202). And transmitted as a connection request response (step S203). At this time, the connection request response includes the tunnel connection device 10 as a default gateway and 169.254.0.0/16 as a network address as information elements in addition to the IP address. The device AA 60 sets network information based on the information element of the connection request response (step S204).

  Thereafter, the device AA 60 communicates with the device BA 62 using an application such as UPnP / UPnP AV using the IP address 169.254.0.2 assigned from the tunnel connection device 10 (step S205). As the IP address of the device BA62, the IP address 169.254.0.9 assigned from the tunnel connection device 11 is used.

  Next, an example of processing when assigning an IP address to a device to which the tunnel connection devices 10 and 11 are connected after the tunnel is opened in the tunnel connection system 1 will be described. FIG. 9 is a sequence chart illustrating an example of a processing flow when the tunnel connection system 1 assigns an IP address to a device to which the tunnel connection devices 10 and 11 are connected after the tunnel is opened. It is assumed that the tunnel AB is opened between the tunnel connection device 10 and the tunnel connection device 11.

  After opening the tunnel AB (step S301), the device AB61 transmits a connection request to the tunnel connection device 10 (step S302). The tunnel connection apparatus 10 that has received the connection request authenticates the device by the user / device authentication processing unit 108 via the device connection control unit 106 (step S303). When the authentication is successful, the tunnel connection device 10 refers to the IP address management table in the IP address management unit 107, assigns an unused IP address to the device AB61 that requested the connection (step S304), and connects the connection request. (Step S305). At this time, the connection request response includes the tunnel connection device 10 as a default gateway and 169.254.0.0/16 as a network address as information elements in addition to the IP address. The device AB61 sets network information based on the information element of the connection request response (step S306).

  Thereafter, the device AB61 communicates with the device BA62 using an application such as UPnP / UPnP AV using the IP address (169.254.0.3) assigned from the tunnel connection device 10 (step S307). The IP address of the device BA62 is the IP address 169.254.0.9 assigned from the tunnel connection device 11. Also, when communicating with the device AA 60 belonging to the same home network 40, the IP address 169.254.0.3 assigned by the tunnel connection device 10 is used.

  As described above, according to the tunnel connection system 1, in communication between devices belonging to different home networks 40 and 41, the different home networks 40 and 41 are set to have the same network address. Thus, application communication such as highly versatile UPnP / UPnP AV is possible. This is because the tunnel connection devices 10 and 11 set IP addresses for the devices under the control, so that the IP addresses of the devices do not overlap, so that application communication such as UPnP / UPnP AV can be performed without IP address conversion. It depends. That is, since the data packet transmitted from the device is transferred as it is to the opposite device via the tunnel, devices belonging to different home networks 40 and 41 can communicate with each other as if they are in the same home network. it can.

  Here, an example in which tunnel connection is started by a connection request from a device under the tunnel connection devices 10 and 11 has been described. However, the present invention is not limited to this, and the tunnel connection can be performed without receiving a connection request from the device. May be started (for example, a setting in which the tunnel connection device 10 (11) automatically connects to the opposite tunnel connection device 11 (10)).

  In addition, here, the opposing device that performs the tunnel connection is a tunnel connection device in which a device is connected to the subordinate, but a device to which no device is connected may be used. However, the device needs to have a function of performing a tunnel connection, a function of acquiring an IP address from the tunnel management server 20, and a function of performing a routing setting for the tunnel.

  Furthermore, here, the trigger for starting the tunnel connection is a connection request from a subordinate device, but it is not particularly limited. The tunnel connection devices 10 and 11 may be automatically started when the power is turned on, or tunnel connection may be started by the devices of the tunnel connection devices 10 and 11 themselves.

  Further, a DHCP message may be used as a connection request transmitted from the subordinate equipment to the tunnel connection devices 10 and 11 after the tunnel is opened. In this case, the tunnel connection apparatuses 10 and 11 capture the DHCPDISCOVER transmitted by the device, set the network address and IP address assigned from the tunnel management server 20 in the response message DHCPOFFER, and transmit it.

  The tunnel connection devices 10 and 11 may be integrated with the home gateway devices 30 and 31. As a matter of course, the network connection apparatus is not limited to a stationary type, and may be a mobile terminal (for example, a mobile phone, a notebook PC, a PDA, etc.).

  Furthermore, the network is not limited to the home networks 40 and 41, and may be a public wireless LAN (hot spot), a private network such as a company or a university.

  INDUSTRIAL APPLICABILITY The present invention has an effect that data packets can be transferred between devices belonging to different home networks with a low processing load and does not depend on an application, and tunnel connection for performing communication using a device cooperation application such as UPnP / UPnP AV. This is useful for systems, tunnel management servers, tunnel connection devices, etc.

The figure for demonstrating an example of a structure of the tunnel connection system in embodiment of this invention, and an example of the mode of a data packet transfer The block diagram which shows an example of the internal structure of the tunnel connection apparatus in embodiment of this invention The figure which shows notionally the example of a setting of the routing table in embodiment of this invention The figure which shows notionally the example of a setting of the IP address management table in embodiment of this invention The block diagram which shows an example of the internal structure of the tunnel management server in embodiment of this invention The figure which shows notionally the example of a setting of the network address management table in embodiment of this invention The sequence chart which shows an example of the flow of the process at the time of establishing a tunnel in the tunnel connection system in embodiment of this invention The sequence chart which shows an example of the flow of a process at the time of the tunnel connection system in embodiment of this invention when assigning an IP address to the apparatus to which the tunnel connection apparatus was connected at the time of tunnel opening The sequence chart which shows an example of the flow of a process at the time of assigning an IP address to the apparatus with which the tunnel connection apparatus was connected after the tunnel opening in the tunnel connection system in embodiment of this invention The figure which shows the internal structure of the conventional home gateway apparatus

Explanation of symbols

DESCRIPTION OF SYMBOLS 1 Tunnel connection system 10,11 Tunnel connection apparatus 101 Tunnel interface 102 IP processing part / routing part 103 Tunnel control part 104 Encryption / decryption processing part 105 Tunnel connection control part 106 Equipment connection control part 107 IP address management part 108 User / Device authentication processing unit 109 HGW side interface 110 Device side interface 20 Tunnel management server 201 Device control unit 202 Tunnel state management unit 203 Network address management unit 204 Device management unit 205 Device authentication unit 206 Internet side interface 30, 31 Home gateway device 40, 41 Home network 50, 51 ISP
70 Internet 80 Host

Claims (9)

A first tunnel connection device disposed in the first network via the Internet for performing tunnel connection; and a second tunnel connection device disposed in the second network for performing tunnel connection. A tunnel connection system to which a tunnel management server for managing the tunnel connection is connected,
The tunnel management server assigns a network address so that the first network and the second network are the same network, and assigns the network address to the devices under the first and second tunnel connection devices. A network address management unit for transmitting tunnel connection information including information on a range of assignable IP addresses to the first and second tunnel connection devices;
Each of the first and second tunnel connection apparatuses includes a tunnel control unit that receives the tunnel connection information and assigns an IP address to a device under the tunnel connection apparatus based on the tunnel connection information. The tunnel connection system according to claim 1,
A tunnel connection system in which the tunnel control unit of the first and second tunnel connection apparatuses registers a network address information to set a tunnel which is a path for performing data transfer with each other. The tunnel connection system according to claim 2,
A tunnel connection system in which devices under the first tunnel connection device and devices under the second tunnel connection device communicate using the IP address via the tunnel. A tunnel between a first tunnel connection device arranged in the first network for making a tunnel connection and a second tunnel connection device arranged in the second network for making a tunnel connection A tunnel management server that manages connections and is connected to the Internet,
A network address is assigned so that the first network and the second network are the same network, and the IP address that can be assigned to the network address and the devices under the first and second tunnel connection devices. A tunnel management server having a network address management unit for transmitting tunnel connection information including range information to the first and second tunnel connection devices. A tunnel connection device for establishing a tunnel connection with another tunnel connection device arranged in another network,
From the tunnel management server for managing the tunnel connection, to the network address assigned so that the other network and the network where the tunnel connection device is arranged are the same network, to the devices under the tunnel connection device Receives tunnel connection information including a range of IP addresses that can be assigned and information on a range of IP addresses that can be assigned to devices under the other tunnel connection device, and based on the tunnel connection information, Tunnel connection apparatus having a tunnel control unit that assigns an IP address to the device. The tunnel connection device according to claim 5,
The tunnel control unit is a tunnel connection device that sets a tunnel that is a route for performing data transfer with the other tunnel connection device by registering the information of the network address. A first tunnel connection device disposed in the first network via the Internet for performing tunnel connection; and a second tunnel connection device disposed in the second network for performing tunnel connection. A tunnel connection method used in a tunnel connection system to which a tunnel management server for managing the tunnel connection is connected,
In the tunnel management server, a network address is assigned so that the first network and the second network are the same network, and the network address and the devices under the first and second tunnel connection devices are assigned. Transmitting tunnel connection information including information on a range of assignable IP addresses to the first and second tunnel connection devices;
Each of the first and second tunnel connection devices includes a step of receiving the tunnel connection information and assigning an IP address to a device under the tunnel connection device based on the tunnel connection information. The tunnel connection method according to claim 7, further comprising:
In the first and second tunnel connection apparatuses, a tunnel connection method including a step of setting a tunnel which is a path for mutual data transfer by registering information of the network address. The tunnel connection method according to claim 8, comprising:
A tunnel connection method in which the devices under the first tunnel connection device and the devices under the second tunnel connection device communicate using the IP address through the tunnel.

Images