JP2010157858A - Vpn connection device, dns packet control method, and program - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To provide a technology for performing name resolution of a host device on the side of an opposite VPN device. <P>SOLUTION: A VPN connection device having a function to set a VPN between itself and an opposite VPN connection device is provided with: a storage means for storing DNS proxy response condition information including the address and the host name of an opposite host device using the VPN on the side of the opposite VPN connection device; a determination means for receiving a DNS query packet from a host device connected to the VPN connection device and determining whether or not a host name related to an enquiry included in the DNS query packet is included in the DNS proxy response condition information stored to the storage means; and a response means which acquires an address corresponding to the host name from the DNS proxy response condition information and transmits a DNS response packet including the address to the host device when it is determined by the determination means that the host name is included, and sending out the DNS query packet to a communication network when it is determined by the determination means that the host name is not included. <P>COPYRIGHT: (C)2010,JPO&INPIT

Description

  The present invention relates to a VPN (Virtual Private Network) technique, and particularly relates to a technique that enables a VPN to be introduced easily and flexibly without changing an existing network.

  In recent years, VPNs are increasingly used in place of dedicated lines for inter-company network connection. VPN is a technology that enables connection between bases by using a public line such as the Internet as if it is a dedicated line using tunneling technology.

  There are various types of VPN implementations, but companies that want to build VPNs apply to VPN operators for VPN construction, and carriers set up devices and set up networks. It is common.

As a conventional technique related to VPN, there is a technique described in Patent Document 1, for example.
JP 2004-066418 A

  In the general VPN construction as described above, it is necessary to change some of the existing network devices in the company to VPN dedicated devices or to change the existing network configuration. In addition, it takes a certain amount of time to complete the construction of a new VPN.

  Therefore, for example, even if there is a request to connect a specific base with a VPN for a certain period of time, it is difficult to meet such a request in consideration of the effort and cost of changing the settings of the existing network. In addition, it has been difficult in the prior art to adopt a flexible connection form in which only a specific member in one base and a specific member in another base participate in the VPN.

  If there is a technology that solves the above-mentioned problems of the prior art, can easily construct a VPN without changing the configuration of the existing network, and can flexibly set the host devices participating in the VPN, it can be easily used even between different companies. VPN construction becomes possible. As such a technique, there is a technique assumed in the embodiment of the present invention.

  However, even if a VPN is established between different companies and the names of the host devices in the other company are known, access to the other company's name resolution means (DNS (Domain Name System) server, etc.) is generally difficult. As a result, there is a problem that it is difficult to access the counterpart host device using the name.

  The present invention has been made in view of this point, and solves the above problem in a technology that can easily construct a VPN without changing the configuration of an existing network, and the name of the host device on the opposite VPN device side. The purpose is to provide a technology for solving the problem.

In order to solve the above problems, the present invention is a VPN connection device having a function of setting a VPN between the opposite VPN connection device, network connection means for connecting to a communication network,
DNS proxy response condition including host device connection means for connecting a host device using the VPN, an address of the opposite host device using the VPN on the opposite VPN connection device side, and a host name of the opposite host device Storage means for storing information; a DNS query packet is received from a host device connected to the VPN connection device via the host device connection means; and a host name related to an inquiry included in the DNS query packet is the storage means A determination unit that determines whether or not it is included in the DNS proxy response condition information stored in the server, and obtains an address corresponding to the host name from the DNS proxy response condition information when determined to be included in the determination unit When the DNS response packet including the address is transmitted to the host device and determined not to be included by the determination unit, the DNS query packet is transmitted. And response means for sending to the communication network packets via the network connection unit, configured as a VPN connection apparatus characterized by comprising a.

  Further, the VPN connection device receives information including the address and host name of the opposite host device from the opposite VPN connection device via the VPN, and uses the information received from the opposite VPN connection device to the DNS Means for generating proxy response condition information may be provided.

  According to the present invention, it is possible to provide a technique for performing name resolution of the host name of the host apparatus on the opposite VPN apparatus side in a technique that can easily construct a VPN without changing the configuration of an existing network. Therefore, it becomes possible to access the host device on the opposite VPN device side using the name, and the convenience for the user is improved.

  Embodiments of the present invention will be described below with reference to the drawings.

(System configuration)
FIG. 1 shows a configuration diagram of a system according to an embodiment of the present invention. As shown in FIG. 1, in the system according to the embodiment of the present invention, a private network 100 and a private network 200 are connected via the Internet 300, and a communication control server 310 is connected to the Internet 300.

  The private network 100 is connected to the Internet 300 via a router 110, and the private network 200 is connected to the Internet 300 via a router 210.

  The private network 100 includes a host device 130, a host device 120, a VPN device 140, and a DNS server 150. This DNS server 150 is an existing one. The host device 130 and the VPN device 140 are connected to the LAN, and the host device 120 is connected to the VPN device 140. In this way, by installing the VPN device 140 between the existing network (LAN) and the host device participating in the VPN, the VPN device 140 allows the packet sent from the host device connected to the VPN device 140 to be transmitted. Monitoring is always possible.

  Similarly, the private network 200 includes a host device 230, a host device 220, a DNS server 250, and a VPN device 240. The host device 230 and the VPN device 240 are connected to the LAN, and the host device 220 is connected to the VPN device 240.

  In the system shown in FIG. 1, two bases are shown and one host device is shown under the VPN device. However, these are only shown as representatives, and more bases are actually shown. And a host device can be connected.

  In the system shown in FIG. 1, the communication control server 310 is a device that performs control for building a VPN, which is a secure communication path, between the VPN device 140 and the VPN device 240. In this embodiment, the communication control server 310 is a SIP server, and name exchange and key exchange are performed by exchanging messages between the VPN devices via the SIP via the communication control server 310 to establish a VPN between the VPN devices. ing. A method for establishing a secure communication path by such a method is an existing technology.

  The DNS server 150 is a DNS server that stores the IP address and host name of the device in the private network 100 in association with each other. The DNS server 250 stores the IP address and host name of the device in the private network 200. It is a DNS server that stores data in association with each other.

  FIG. 2 shows a functional configuration diagram of the VPN device 140. Since the VPN device 240 has the same configuration as the VPN device 140, only the VPN device 140 will be described.

  As shown in FIG. 2, the VPN device 140 includes a PVN (private network) side interface unit 146, a control unit 149, a VPN subordinate terminal side interface unit 147, a web setting interface unit 144, and a database 145. The control unit 149 includes a DNS proxy response function unit 148, a packet acquisition control unit 141, a communication control unit 142, and a NAT control unit 143.

  The PVN (private network) side interface unit 146 is a functional unit for transmitting and receiving data to and from the LAN configuring the private network 100. The VPN subordinate terminal side interface unit 147 is a functional unit for transmitting and receiving packets to and from a host device (terminal) connected to the VPN device 140 in order to enable VPN communication using the VPN device 140. .

  The web setting interface unit 144 is a functional unit for providing a web screen to a terminal connected to the VPN apparatus 140 and inputting various setting information from the web screen. The database 145 is a storage unit for storing setting information.

  The communication control unit 142 in the control unit 149 sets a VPN between the VPN device 140 and the VPN device 240 by performing message transmission / reception based on SIP with the VPN device 240 on the opposite side via the communication control server 310. It has a function. The communication control unit 142 also has a function of receiving a packet from the packet acquisition control unit 141 and transmitting the packet to the other party using the VPN, and a function of passing the packet received via the VPN to the packet acquisition control unit 141. Have. Further, the communication control unit 142 generates VPN transfer condition information for determining whether or not to transmit the packet via the VPN, and DNS proxy response condition information including the host name of the opposite VPN participating host device. , And also has a function of storing in the database 145.

  The NAT control unit 143 is a functional unit that performs control for NAT traversal in order to normally perform packet communication such as SIP communication when the router 110 has a NAT function. Existing technology can be used for NAT traversal technology itself.

  The packet acquisition control unit 141 checks whether the information included in the packet received from the host device under the control of the VPN device 140 matches the VPN transfer condition stored in the database 145. It has a function to decide to transmit a packet using VPN. Further, the packet acquisition control unit 141 checks whether the information included in the packet received from the VPN matches the information stored in the database 145, thereby determining whether to transfer the packet to the destination host device. It also has the function of determining

  The DNS proxy response function unit 148 monitors the DNS query packet sent from the host device (the host device 120 in this embodiment) connected to the VPN device 140 via the VPN subordinate terminal side interface unit 147, and stores it in the database 145. When it is determined that the DNS query packet for the host device under the opposing VPN device has been received by referring to the stored information, the IP address of the host device related to the DNS query is extracted from the information stored in the database 145. The IP address is included in the DNS response and returned to the host device that sent the DNS query packet. The DNS proxy response function unit 148 also has a function of generating DNS proxy response condition information including the host name of the opposite VPN participating host device and storing it in the database 145.

  The VPN device 140 includes, for example, a storage device such as a CPU or a memory, and a program corresponding to the function of the control unit 149 in a computer having a general program such as a communication program, a Web program, and a database program This can be realized by executing. The program can be stored in a recording medium such as a memory and installed in the computer from the recording medium.

(System operation)
Hereinafter, an operation example in the system shown in FIGS. 1 and 2 will be described with reference to the sequence charts shown in FIGS. In the following example, communication via a VPN is performed between the host device 120 in the private network 100 and the host device 220 in the private network 200.

  First, the communication control unit 142 of the VPN device 140 transmits a registration request message to the communication control server 310 (step 11). This registration request message includes the identification information of the VPN device 140 and the IP address corresponding to the VPN device 140, and the communication control server 310 stores the identification information and the IP address in association with each other to register the information. Done. After registration, a response message is returned (step 12). A similar registration process is performed in the VPN device 240 (steps 13 and 14).

  Subsequently, the user of the host device 120 on the private network 100 side accesses the Web setting I / F unit 144 from the host device 120 to input information necessary for VPN construction (steps 15 and 16).

  In this embodiment, the VPN apparatus 140 is connected to the VPN apparatus 240, and the host apparatus 120 performs communication between the VPN apparatus 140 and the VPN apparatus 240 under the VPN apparatus 140. Therefore, here, identification information of VPN device 140 (referred to as VPN-A), identification information of VPN device 240 (referred to as VPN-B), IP address of host device 120 (referred to as address A), and host name (Host-A) are entered and stored in the database 145. In this example, information setting is performed from the host device 120 to the VPN device 140, but information setting may be performed from an arbitrary terminal.

  Similar to the private network 100 side, on the private network 200 side, the identification information (VPN-B) of the VPN device 240 and the identification information (VPN-A) of the VPN device 140 and the IP address (address B of the host device 220). ) And a host name (referred to as host-B) are stored in the database 245 (steps 17 and 18).

  Subsequently, in this example, the host device 120 instructs the Web setting I / F unit 144 to set a VPN between the VPN device 140 and the VPN device 240 (step 19). This instruction includes identification information (VPN-A, VPN-B).

  The communication control unit 142 receives an instruction from the Web setting I / F unit 144 (step 20), and transmits a connection request message to the communication control server 310 (step 21). In the present embodiment, the connection request message is an INVITE message, and the INVITE message includes VPN-B as destination identification information and VPN-A as transmission source identification information.

  The communication control server 310 that has received the connection request message acquires the IP address of the VPN device 240 from the registration information based on VPN-B, and transfers the connection request message to the IP address (step 22). The communication control unit 242 that has received the connection request message confirms with reference to the database 245 whether or not the VPN connection (connection with the VPN device 140) related to the connection request is set (step 23). Here, since the settings have been made in steps 17 and 18, the communication control unit 242 returns a response message to the VPN apparatus 140 via the communication control server 310 (steps 24-26).

  Through such processing, a VPN, which is a secure communication path, is established between the VPN device 140 and the VPN device 240 (step 27).

  Thereafter, the communication control unit 142 uses the information stored in Step 16 to identify the VPN device 140 identification information (VPN-A, which is also VPN identification information for the opposite VPN device), and the IP address of the subordinate host device 120 ( The address A) and the host name (host-A) are read (step 28) and transmitted to the VPN apparatus 240 using the VPN (step 29). Similarly, the communication control unit 242 of the VPN apparatus 240 determines its own identification information (VPN-B), the IP address (address B) and the host name (host) of the host apparatus 220 under its control from the information stored in step 18. -B), and transmits them to the VPN apparatus 140 using the VPN (steps 30 and 31).

  The communication control unit 142 that has received the information from the opposing VPN device 240 stores the received information in the database 145 as a table together with the information that has already been saved (step 32). An example of the table is shown in FIG.

  In the table shown in FIG. 6, the identification information (VPN-B) of the partner VPN device 240 that is VPN-connected to the user (VPN device 140), the information connected to the user (VPN device 140), and the VPN The host device address (address A) designated as the host device that uses the VPN between the device 140 and the VPN device 240, and the partner as the host device that uses the VPN between the VPN device 240 and the VPN device 140 The address (address B) and host name (host-B) of the host device specified on the side are stored. Similarly, the database 245 on the VPN device 240 side stores the table shown in FIG. 7 (step 33 in FIG. 3). FIG. 6 also shows settings related to the opposing VPN device identified by VPN-C. In this setting, the host device 120 can also perform VPN communication with the host device of the address C under the opposing VPN device identified by VPN-C.

  6 and 7, the identification information of the opposing VPN device, the address of the host device using the VPN under its own control, and the address of the host device using the VPN under the control of the opposing VPN device can be collectively referred to as VPN transfer condition information. Further, the addresses and host names of the VPN using host devices under the opposing VPN device can be collectively referred to as DNS proxy response condition information.

  In the above example, an IP address is used as the VPN transfer condition, but a MAC address may be used in addition to the IP address. In addition to the address, a protocol may be used as a condition.

  In the above example, the VPN transfer condition information and the DNS proxy response condition information are generated at the same timing, but only the DNS proxy response condition information may be generated at a different timing. For example, when the host name or address of a host device participating in the VPN is changed, the changed host name and address are input to the VPN device 140 from the host device, and the DNS proxy response function unit of the VPN device 140 148 transmits the host name and address to the opposite VPN device via the communication control unit 142, and the opposite VPN device updates the table using the host name and address. When the VPN device 140 receives a new host name and address, the DNS proxy response function unit 148 updates the table using the new host name and address.

  Next, an operation when a DNS query packet is transmitted from the host device 120 will be described with reference to FIG. FIG. 4 shows an example 1 in which a DNS query packet is processed by a normal DNS server, and an example 2 in which the VPN device 140 responds (by proxy) to a DNS query packet.

  A DNS query packet is transmitted from the host device 120, and the packet acquisition control unit 141 receives it. The packet acquisition control unit 141 determines that the packet is a DNS query packet from the header of the packet, and the packet is received. It is passed to the DNS proxy response function unit 148 (steps 41 and 42).

  The DNS proxy response function unit 148 searches the table shown in FIG. 6 and determines whether or not the host name included in the DNS query packet is included in the table (steps 43 and 44). In Example 1, since the host name included in the DNS query packet is not included in the table, the DNS proxy response function unit 148 sends the DNS query packet to the outside via the packet acquisition control unit 141 and the PVN side interface unit 146. (Steps 45 and 46). The DNS query packet is processed as usual by the DNS server 150 or the DNS server on the Internet.

  Next, Example 2 will be described.

  A DNS query packet is transmitted from the host device 120, and the packet acquisition control unit 141 receives it. The packet acquisition control unit 141 determines that the packet is a DNS query packet from the header of the packet, and the packet is received. It is passed to the DNS proxy response function unit 148 (steps 51 and 52).

  The DNS proxy response function unit 148 searches the table shown in FIG. 6 and determines whether or not the host name included in the DNS query packet is included in the table (steps 53 and 54). In Example 2, since the host name (host-B) included in the DNS query packet is included in the table, the DNS proxy response function unit 148 obtains the address B corresponding to host-B from the table. (Step 54), a DNS response packet including the address B is generated and returned to the host device 120 via the packet acquisition control unit 141 and the VPN subordinate terminal side interface unit 147 (Steps 55 and 56). As a result, the host device 120 can acquire the address B corresponding to host-B and transmit the packet to the address B.

  Next, Example 1 and Example 2 in the case of transmitting a packet for communication from the host device 120 will be described with reference to FIG.

  Example 1 is an example where the destination address set in the header of a packet sent from the host device 120 is a global address outside the private networks 100 and 200.

  In this case, the packet transmitted from the host device 120 is received by the VPN device 140 and acquired by the packet acquisition control unit 141 in the VPN device 140 (step 61). The packet acquisition control unit 141 acquires the source address and destination address of the packet from the packet header. Then, the packet acquisition control unit 141 refers to the table shown in FIG. 6 and performs a search for checking whether the combination of the transmission source address and the destination address exists in the table (steps 62 and 63). In Example 1, since the destination address is not set in the table, the search fails. When the search fails, the packet acquisition control unit 141 transmits the packet via the PVN side interface unit 146 without using the VPN. Then, the packet is delivered to the destination according to normal routing without going through the VPN (step 64).

  Example 2 is an example where the destination address set in the header of the packet sent from the host device 120 is the address (address B) of the host device 220. The address B is obtained by the procedure of Example 2 in FIG.

  The packet transmitted from the host device 120 is received by the VPN device 140 and acquired by the packet acquisition control unit 141 in the VPN device 140 (step 71). The packet acquisition control unit 141 acquires the source address and destination address of the packet from the packet header. Then, the packet acquisition control unit 141 refers to the table shown in FIG. 6 and performs a search based on the combination of the transmission source address and the destination address (steps 72 and 73). In Example 2, since the set of address A and address B, which is a set of the source address and the destination address, is set in the table, the search is successful.

  Then, the packet acquisition control unit 141 acquires the identification information (VPN-B) of the connection destination VPN device corresponding to the pair of address A and address B (step 73), and sends out the packet received from the host device 120. The VPN that should be determined is the VPN set for VPN-B. Then, the packet acquisition control unit 141 passes VPN-B and the packet to the communication control unit 142 (step 74), and the communication control unit 142 transmits the packet using the VPN (step 75). If the destination of the packet is address C, the packet is transmitted using the VPN set for VPN-C from the table of FIG.

  The packet transmitted from the communication control unit 142 is received by the communication control unit 240 of the VPN device 240, and the communication control unit 240 passes the received packet to the packet acquisition control unit 241 (step 76). The packet acquisition control unit 241 acquires the source address and destination address of the packet from the header of the packet, refers to the table shown in FIG. 7, and performs a search based on the set of the source address and destination address (step 77). 78). Here, the search is successful, and the packet acquisition control unit 241 transmits the packet to the host device 220 that is the destination (step 79). If the search fails here, for example, the packet is discarded without being transmitted to the host device 220. Note that the packet receiving side may transmit the packet to the destination without performing a check referring to the table as described above.

  As described above, by applying the technology based on the present invention, a VPN can be easily constructed simply by installing a VPN device in an existing network. In addition, it is configured to refer to the address of the packet sent from the host device and determine whether to send the packet to the VPN based on the VPN transfer condition information. The host device to participate can be set flexibly. Furthermore, DNS proxy response condition information is automatically generated in the VPN device, and the name of the VPN participating host device under the opposing VPN device is resolved based on the DNS proxy response condition information. For example, VPN between different companies Even if it is constructed, name resolution can be performed, and the host device under the opposing VPN device can be easily accessed using the name.

  The present invention is not limited to the above-described embodiments, and various modifications and applications are possible within the scope of the claims.

1 is a configuration diagram of a system according to an embodiment of the present invention. 2 is a functional configuration diagram of a VPN device 140. FIG. It is a sequence chart for demonstrating operation | movement of the system which concerns on embodiment of this invention. It is a sequence chart for demonstrating operation | movement of the system which concerns on embodiment of this invention. It is a sequence chart for demonstrating operation | movement of the system which concerns on embodiment of this invention. It is a figure which shows the table stored in the database. It is a figure which shows the table stored in the database.

Explanation of symbols

100 Private network 200 Private network 300 Internet 110, 210 Router 310 Communication control server 120, 130, 220, 230 Host device 150, 250 DNS server 140 VPN device host 141 Packet acquisition control unit 142 Communication control unit 143 NAT control unit 144 Web setting Interface unit 145 Database 146 PVN (private network) side interface unit 147 VPN subordinate terminal side interface unit 148 DNS proxy response function unit 149 Control unit

Claims (6)

A VPN connection device having a function of setting a VPN with the opposite VPN connection device,
Network connection means for connecting to a communication network;
Host device connection means for connecting a host device using the VPN;
Storage means for storing DNS proxy response condition information including the address of the opposite host device that uses the VPN on the opposite VPN connection device side and the host name of the opposite host device;
A DNS proxy response condition in which a DNS query packet is received from a host device connected to the VPN connection device via the host device connection means, and a host name related to an inquiry included in the DNS query packet is stored in the storage means Determining means for determining whether or not the information is included;
When it is determined by the determination means that the address corresponding to the host name is acquired from the DNS proxy response condition information, a DNS response packet including the address is transmitted to the host device, and the determination means A response means for sending the DNS query packet to the communication network via the network connection means when it is determined that it is not included;
A VPN connection device characterized by comprising:   Means for receiving information including the address and host name of the opposite host device from the opposite VPN connection device via the VPN, and generating the DNS proxy response condition information using the information received from the opposite VPN connection device The VPN connection device according to claim 1, further comprising: The storage means includes an address of an opposite host device that uses the VPN on the opposite VPN connection device side, and an address of a host device that is connected to the VPN connection device by the host device connection means and uses the VPN. Stores VPN transfer condition information,
The VPN connection device
A transfer determination unit that receives a packet from the host device and determines whether a set of a destination address and a source address of the packet is included in the VPN transfer condition information stored in the storage unit;
A packet control means for transmitting the packet to the opposite VPN connection device side via the network connection means using the VPN when it is determined to be included by the transfer determination means; The VPN connection device according to claim 1 or 2, characterized in that   Information including the VPN identification information and the address of the host device is transmitted to the opposing VPN connection device via the VPN, and information including the VPN identification information and the address of the counter host device is transmitted to the VPN. The VPN connection device according to claim 3, further comprising means for generating the VPN transfer condition information using information received from the opposite VPN connection device via the information received from the opposite VPN connection device. A DNS packet control method executed by a VPN connection device having a function of setting a VPN with an opposite VPN connection device,
The VPN connection device includes network connection means for connecting to a communication network, host device connection means for connecting a host device that uses the VPN,
Storage means for storing DNS proxy response condition information including the address of the opposite host device that uses the VPN on the opposite VPN connection device side and the host name of the opposite host device;
The DNS packet control method is:
A DNS proxy response condition in which a DNS query packet is received from a host device connected to the VPN connection device via the host device connection means, and a host name related to an inquiry included in the DNS query packet is stored in the storage means A determination step of determining whether the information is included;
If it is determined to be included by the determination step, an address corresponding to the host name is acquired from the DNS proxy response condition information, a DNS response packet including the address is transmitted to the host device, and the determination step A response step of sending the DNS query packet to the communication network via the network connection means when it is determined that it is not included;
A DNS packet control method comprising: A program for causing a computer to function as a VPN connection device having a function of setting a VPN between the opposite VPN connection device,
The computer includes a network connection means for connecting to a communication network, a host device connection means for connecting a host device using the VPN,
Storage means for storing DNS proxy response condition information including the address of the opposite host device that uses the VPN and the host name of the opposite host device on the opposite VPN connection device side, and the program stores the computer ,
A DNS proxy response condition in which a DNS query packet is received from a host device connected to the VPN connection device via the host device connection means, and a host name related to an inquiry included in the DNS query packet is stored in the storage means Determining means for determining whether or not the information is included;
When it is determined by the determination means that the address corresponding to the host name is acquired from the DNS proxy response condition information, a DNS response packet including the address is transmitted to the host device, and the determination means A response means for sending the DNS query packet to the communication network via the network connection means when it is determined that it is not included;
Program to function as.

Images