JP2010233168A - Communication control device and monitoring device - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To avoid having communication fall into a disabled state, by overlapping a local IP address and a virtual IP address in the connecting system of a virtual-private-network (VPN) communication controller to a local network. <P>SOLUTION: The communication controller, for example, serves as an IP-line unit 73, installed at a monitoring apparatus in a monitoring system to perform VPN communications to a monitoring center. The IP-line unit 73 has a packet processing unit 101 to convert an input packet to the packet to be transmitted; a storage 103 to store the virtual IP address of the IP-line unit 73 in the VPN; and a determination unit 105 to compare a source address in a transmitting packet with the virtual IP address stored in the storage 103. The determination unit 105 determines whether both a network and a host in the source address agree with each other in the virtual IP address. An encapsulator 107 encapsulates the packet, when the determined result agrees. <P>COPYRIGHT: (C)2011,JPO&INPIT

Description

  The present invention relates to a communication control apparatus that performs VPN communication. The communication control device is provided in, for example, a monitoring device provided as a monitoring target of the monitoring system, and transmits monitoring information to a remote monitoring center by VPN.

  Conventionally, in a system that monitors a monitoring target such as a store or a factory with a remote monitoring center, a monitoring terminal installed on the monitoring target communicates with the monitoring center. The monitoring terminal transmits a monitoring video, a security-related signal detected by the sensor, and the like to the monitoring center.

  In recent years, it has been proposed to use a broadband line as a communication line of a monitoring system against the background of the development of network technology. However, since the data to be transmitted is data that requires high confidentiality, such as surveillance video and security-related signals, the required level for communication security is also high. Therefore, it has been proposed to construct a VPN (virtual private network) that functions as a virtual dedicated line between the monitoring center and the monitoring terminal to ensure communication security (Patent Document 1).

  When VPN is applied to the monitoring system, the monitoring information packet is encapsulated. Then, the encapsulated packet is communicated between the monitoring center and the monitoring terminal through the VPN tunnel. In order to construct such a VPN, virtual IP addresses (hereinafter referred to as virtual IP addresses) are assigned to the monitoring center and the monitoring terminal, respectively.

JP 2006-203313 A

  By the way, it is assumed that a user's local network (LAN) is provided for a monitoring target such as a store or a factory (the user here is a user for the monitoring system, for example, the monitoring target is a store) In addition, users are store owners). In this case, it is conceivable to connect a monitoring terminal to the LAN to be monitored and connect to the Internet via the LAN to perform VPN communication with the monitoring center.

  However, if the local IP address of the monitored LAN and the virtual IP address of the VPN overlap, VPN communication becomes impossible. More specifically, in the VPN, the packet is encapsulated by referring to the network part of the destination address of the packet. That is, if the network part of the destination address corresponds to the network part of the VPN virtual IP address, the packet is encapsulated. Therefore, if the network portion overlaps between the local IP address of the LAN to be monitored and the virtual IP address of the VPN, communication becomes impossible.

  In order to avoid the above problems, the virtual IP address is generally assigned so as not to overlap with the local IP address of the monitored LAN.

  However, the LAN to be monitored is managed by the user and is independent of the monitoring center. Therefore, even if the VPN side avoids duplication when assigning a virtual IP address, the network environment to be monitored is subsequently reconstructed for the convenience of the user, and the local IP address is changed. There is a possibility that the local IP address overlaps with the virtual IP address of the VPN of the monitoring system. In such a case, VPN communication cannot be performed and there is a possibility that the monitoring work may be hindered.

  The monitoring system also plays a role of security and the like, and the level of demand for the safety and stability of the system is high. For this reason, it is desirable to prevent communication from being disabled as much as possible even if addresses overlap due to circumstances on the monitored network side as described above.

  In the above, the background of the present invention has been described by taking up the monitoring system. However, similar problems can arise outside the monitoring system. That is, in a configuration in which a VPN communication control device is connected to a LAN, communication is disabled if the local IP address overlaps with the VPN virtual IP address for some reason.

  The present invention has been made under the above-described background, and an object of the present invention is to provide a technique capable of avoiding communication failure due to address duplication in a configuration in which a VPN communication control device is connected to a local network. is there.

  A communication control apparatus of the present invention is a communication control apparatus that is connected to a local network and is connected to a wide area network via the local network and performs VPN communication, and a packet processing unit that converts an input packet into a transmission packet; A storage unit for storing the virtual IP address of the communication control device in the VPN, a source address in the transmission packet, and the virtual IP address stored in the storage unit, and a network of the source address A determination unit that determines whether both the network part and the host part of the virtual IP address match with each other, and when the determination result by the determination unit matches, the transmission packet is encapsulated And an encapsulating part to be converted.

  As described above, according to the present invention, the source address in the transmission packet is compared with the virtual IP address, and both the network part and the host part of the source address are compared with the network part and the host part of the virtual IP address. It is determined whether or not both match, and if the determination result matches, the transmission packet is encapsulated. Accordingly, even if the network part of the destination address of the transmission packet transmitted to the VPN overlaps with the network part of the local IP address due to the change of the address of the local network, VPN communication is possible. In this way, it is possible to prevent communication from being disabled due to duplication of addresses in the configuration in which the VPN communication control device is connected to the local network.

  In the present invention, the storage unit may further store a virtual IP address of a target device connected by the VPN, and the determination unit further includes a destination address included in the transmission packet, Compare the virtual IP address of the target device stored in the storage unit, and whether both the network part and the host part of the destination address match both the network part and the host part of the virtual IP address of the target device It may be determined.

  According to the above invention, in addition to comparing the source address in the transmission packet with the virtual IP address of the communication control device, the destination address and the virtual IP address of the target device are also compared. In the latter comparison process, both the network portion and the host portion are to be compared. If the comparison results match, the transmission packet is encapsulated. Therefore, in the configuration in which the VPN communication control device is connected to the local network, it is possible to more reliably avoid communication failure due to address duplication.

  The communication control device of the present invention may be connected to the information processing device through a dedicated communication path different from the local network, and the packet processing unit uses the dedicated communication packet for the dedicated communication path as the input packet. The transmission packet may be input from the information processing apparatus, and the transmission packet to be transmitted to the VPN may be extracted from the data area of the dedicated communication packet.

  In this configuration, the communication control apparatus is connected to the information processing apparatus via a dedicated communication path different from the local network, and a dedicated communication packet is input as an input packet from the information processing apparatus. Even in such a case, according to the present invention, VPN communication can be suitably performed, and it is possible to prevent communication from being disabled due to address duplication. For example, a monitoring device including the communication control device and the information processing device is provided as a monitoring target. The information processing apparatus functions as a monitoring control apparatus to generate monitoring information, and the communication control apparatus transmits the monitoring information to a remote monitoring center via VPN. The dedicated communication path is a communication path in the monitoring apparatus, and this may be a local network in a monitoring apparatus different from the local network to be monitored.

  The communication control apparatus of the present invention may further include a reissue request unit, and the reissue request unit includes both the network part and the client address part of the local IP address of the communication control apparatus in the local network. When the VPN is disconnected in accordance with both the network part and the client address part of the virtual IP address of the communication control device in the VPN, the VPN server may be requested to reissue the VPN address.

  With this configuration, both the network part and the client address part of the local IP address of the communication control device coincide with both the network part and the client address part of the virtual IP address of the communication control device in the VPN, and the VPN is disconnected. Even in such a case, VPN communication can be performed by reissuing the virtual IP address. Therefore, it is possible to avoid communication failure due to address duplication.

  Another aspect of the present invention is a monitoring apparatus that is connected to a monitoring target local network and transmits monitoring information acquired by the monitoring target from the local network to a remote monitoring center via a wide area network. The monitoring apparatus includes a monitoring control unit that generates monitoring information to be transmitted to the monitoring center, and a communication control unit that performs VPN communication with the monitoring center. A packet processing unit that converts an input packet including the monitoring information into a transmission packet to be transmitted to the monitoring center, a storage unit that stores a virtual IP address of the monitoring device in the VPN, and a transmission source in the transmission packet Compare the address with the virtual IP address stored in the storage unit, and whether both the network part and the host part of the source address match both the network part and the host part of the virtual IP address A determination unit that determines the transmission packet, and an encapsulation unit that encapsulates the transmission packet when the determination result by the determination unit is the same A. Also in this aspect, the various configurations of the present invention described above may be provided.

  In the above configuration, the present invention is applied to a monitoring system, and more specifically, to a monitoring device connected to a monitoring center. Monitoring information is transmitted from the monitoring device to the monitoring center. At this time, the source address in the monitoring information transmission packet is compared with the virtual IP address, and both the network part and the host part of the source address match both the network part and the host part of the virtual IP address. If it is determined that the determination results match, the transmission packet is encapsulated. Since such a determination is performed, it is possible to prevent communication from being disabled because the monitored local IP address and the VPN virtual IP address of the monitoring apparatus overlap. The monitoring system also plays a role of security and the like, and the level of demand for the safety and stability of the system is high, and the present invention can suitably meet such needs.

  The present invention is not limited to the above-described aspects of the communication control device and the monitoring device. The present invention may be expressed in the form of other apparatuses or systems, and the present invention may be realized in the form of a method, a program, or a computer-readable recording medium on which the program is recorded.

  As described above, according to the present invention, it is possible to prevent communication from being disabled due to address duplication in a configuration in which a VPN communication control apparatus is connected to a local network.

It is a figure which shows the whole structure of the monitoring system of this Embodiment. It is a block diagram which shows the structure of a monitoring system more concretely. It is a figure which shows the condition where the address of the monitoring object LAN is changed in the monitoring system. It is a figure which shows the local IP address of the monitoring object LAN, and the virtual IP address of VPN in a monitoring system. It is a figure which shows the structure of the IP line unit corresponded to the communication control apparatus of this invention. It is a flowchart which shows operation | movement of an IP line unit. It is a figure which shows the example of operation | movement of an IP line unit.

  Hereinafter, embodiments of the present invention will be described with reference to the drawings. In the present embodiment, the present invention is applied to a monitoring system. In the monitoring system, the monitoring target and the monitoring center communicate monitoring information. The communication control device of the present embodiment is provided in the monitoring device on the monitoring target side. First, the configuration of the monitoring system will be described.

  FIG. 1 shows the overall configuration of the monitoring system of the present invention. As illustrated, in the monitoring system 1, communication is performed among the monitoring center 3, the monitoring target 5, and the user base 7. Here, the user means a user of the monitoring service of the monitoring target 5 by the monitoring system 1. In the example of the present embodiment, the monitoring target 5 is a store, and the user base 7 is an office of the store owner.

  The monitoring center 3 includes a communication management device 11 and a plurality of center devices 13, and these are connected so as to be communicable. The communication management device 11 and the plurality of center devices 13 may be arranged at geographically distant locations. The plurality of center devices 13 may be respectively arranged in a plurality of assigned areas. Further, the plurality of center devices 13 may share functions. For example, one center device 13 may function as a control center device that processes a security-related signal, and another center device 13 may function as an image center device that mainly processes monitoring video. One center device 13 may be used within the scope of the present invention.

  A monitoring device 15 and a user device 17 are provided in the monitoring target 5 and the user base 7, respectively. The monitoring device 15 and the user device 17 correspond to terminals in the monitoring system 1. The monitoring device 15 sends monitoring information to the center device 13 and the user device 17. The monitoring information is, for example, an image of a monitoring camera and a monitoring signal detected by the monitoring target 5. The monitoring signal is, for example, a guard signal indicating that an abnormality has occurred, and the guard signal is generated based on a detection signal from a sensor installed in the monitoring target 5 or generated when an alarm button (switch) is operated. Is done. In addition, the user device 17 sends a control signal and an audio signal to the monitoring device 15. Such a signal from the user device 17 to the monitoring device 15 is also included in the monitoring information.

  In FIG. 1, one monitoring target 5 and one user base 7 are shown. However, actually, the monitoring center 3 communicates with a plurality of monitoring targets 5 and a plurality of user bases 7. Accordingly, the communication management device 11 also communicates with the plurality of monitoring devices 15 and the plurality of user devices 17. Each monitoring device 15 communicates with an associated user device 17 (store owner's terminal).

  According to the monitoring system 1 of FIG. 1, for example, it is assumed that the monitoring device 15 detects an abnormality by a sensor signal or the like. In this case, a guard signal is transmitted as monitoring information to the monitoring center 3 together with the video of the monitoring target 5. In the monitoring center 3, the operator confirms the security signal and video on the monitor of the center device 13, and gives necessary instructions to the security guard. The guard who received the instruction rushes to the monitoring object 5 and deals with the abnormality.

  Further, for example, the monitoring device 15 sends the image of the monitoring target 5 to the user device 17 periodically or according to other settings. For example, when a visitor is detected by the sensor, an image or the like is sent to the user device 17. In addition, transmission of video or the like may be requested from the user device 17. The owner can grasp the state of the store from the video or the like. In addition, the owner can send a voice or the like from the user device 17 to the monitoring device 15 to instruct the store clerk about necessary items.

  Next, a communication form of the monitoring system 1 will be described. The communication management device 11, the monitoring device 15, and the user device 17 are connected to the Internet.

  Furthermore, the communication management device 11 is connected to the monitoring device 15 and the user device 17 by a VPN (Virtual Private Network) 21 between center terminals on the Internet. In order to construct the VPN 21 between center terminals, the communication management device 11 is provided with a VPN server function, and the monitoring device 15 and the user device 17 are provided with a VPN client function. In VPN, a VPN tunnel is constructed, encrypted communication is performed, and high security is realized.

  Further, the monitoring device 15 and the user device 17 perform SIP communication 23 via the communication management device 11. The SIP communication 23 is performed via the center terminal VPN 21 described above. The communication management device 11 has a SIP server function.

  Further, the monitoring device 15 and the user device 17 are directly connected by the inter-terminal VPN 25 without going through the communication management device 11. In order to construct the inter-terminal VPN 25, the user device 17 is provided with a VPN server function, and the monitoring device 15 is provided with a VPN client function.

  Here, the VPN 21 between the center terminals is always connected with a VPN tunnel constructed, and is used for communication between the center device 13, the monitoring device 15, and the user device 17. On the other hand, the inter-terminal VPN 25 is constructed only when necessary.

  The reason for using the inter-terminal VPN 25 will be described. In the monitoring system 1, a large amount of data such as video is communicated. When the center terminal VPN 21 is used for all communications, the load of the communication management apparatus 11 becomes enormous. Therefore, communication between the monitoring device 15 and the user device 17 is performed by the inter-terminal VPN 25, thereby reducing the load on the communication management device 11 while ensuring security.

  Further, the role of the SIP communication 23 in the present embodiment is a special one that is different from a normal IP telephone or the like. That is, the present embodiment positions SIP signaling as a preparation process before VPN connection. More specifically, when establishing a session of the SIP communication 23, signaling is performed. Two-way communication is performed by this signaling, and an INVITE (invite) message and an OK message are exchanged. On the other hand, in order to establish a VPN connection, it is necessary to exchange information. In this embodiment, the IP address and the electronic certificate are exchanged.

  Therefore, the signaling of the SIP communication 23 is used as an information exchange means for establishing a VPN connection. That is, an INVITE message with an IP address and an electronic certificate added is transmitted from the SIP connection source to the connection destination. In response to the INVITE message, an OK message to which an IP address and an electronic certificate are added is returned from the SIP connection destination to the connection source, thereby establishing information exchange.

  The overall configuration of the monitoring system 1 has been described above. As described above, in this embodiment, two types of VPN are used. One connects the communication management device 11 and the terminal (the monitoring device 15 or the user device 17), and the other connects the terminals (the monitoring device 15 and the user device 17). Therefore, in FIG. 1, in order to distinguish these two VPNs, terms such as the center terminal VPN 21 and the terminal VPN 25 are used. However, terms such as VPN21 and VPN25 may be used.

  Next, the configuration of the monitoring system 1 will be described more specifically with reference to FIG. The communication management apparatus 11 includes a firewall 31, an HTTP server 33, a VPN server 35, a SIP server 37, a STUN server 39, an account management server 41, a database 43, and a log server 45.

  The firewall 31 is a device that blocks data other than communication data used between the communication management device 11, the monitoring device 15, and the user device 17. The HTTP server 33 is configured for Internet connection. The VPN server 35 is a server that performs authentication and encryption for VPN tunnel construction.

  The VPN server 35 is configured to realize the center terminal VPN 21, constructs a VPN between the communication management device 11 and the monitoring device 15, and constructs a VPN between the communication management device 11 and the user device 17. . A signal from the monitoring device 15 is decrypted by the VPN server 35 and transmitted to the center device 13. A signal from the center device 13 is encrypted by the VPN server 35 and transmitted to the monitoring device 15. Also, when the communication management device 11 sends a signal to the monitoring device 15, encryption is performed by the VPN server 35. In the communication between the communication management device 11 and the user device 17, the VPN server 35 similarly performs encryption and decryption.

  The SIP server 37 performs signaling processing according to the SIP protocol, and connects the monitoring device 15 and the user device 17. The SIP server 37 performs a SIP connection control function when the user device 17 requests connection to the monitoring device 15 or when the monitoring device 15 requests connection to the user device 17.

  In SIP signaling, messages are exchanged. Specifically, an INVITE (invite) message and an OK message are exchanged. Using this message exchange, as described above, an IP address and an electronic certificate are exchanged for establishing a VPN connection.

  The STUN server 39 provides a STUN function in order to correspond to the NAT function of the routers of the monitoring device 15 and the user device 17.

  The account management server 41 is a server that manages various types of information such as authentication. Information to be managed is stored in the database 43. Information to be managed includes an IP line account, a digital certificate for VPN connection (tunnel construction), and key pair information. Further, in the process of SIP signaling, authentication and authorization are performed for connections between terminals. Information for this processing is also stored in the database 43 and used by the account management server 41.

  The log server 45 is a server for storing a log generated by the monitoring device 15.

  The center device 13 includes a monitoring console 51 and a line connection device 53. A monitoring console 51 is connected to the communication management device 11 via the line connection device 53. For example, when the center device 13 is an image center, the monitoring video is supplied to the monitoring console 51 and managed by the monitoring console 51. When the center device 13 is a control center, security-related information is supplied to the monitoring console 51. The monitoring video is also suitably displayed on the control center monitor. The monitoring video or the like may be communicated between the center devices.

  Next, the monitoring device 15 will be described. The monitoring device 15 is connected to the monitoring target LAN 61. The monitored LAN 61 is a local network (LAN) of the monitored object 5 and includes a router 63 for a broadband line, and the router 63 is connected to the Internet as a wide area network (WAN) as a gateway. The monitoring device 15 is connected to the router 63. A monitoring target PC (personal computer) 65 is also connected to the router 63. The monitoring target PC 65 is a PC installed on the monitoring target 5. In the example of the present embodiment, the monitoring target 5 may be a store and the monitoring target PC 65 may be a store PC. Still other devices may be connected to the monitored LAN 61.

  The monitoring device 15 includes a controller 71, an IP line unit 73, a peripheral device 75, and a multi-line adapter 77.

  The controller 71 is composed of a computer and realizes a monitoring function in cooperation with the peripheral device 75. The controller 71 is connected to the monitoring center 3 via the IP line unit 73. The controller 71 is also connected to the user device 17 via the IP line unit 73.

  In FIG. 2, a monitoring camera 81, a sensor 83, and an alarm button 85 are illustrated as peripheral devices 75. The controller 71 performs an image recognition process on the monitoring video to detect an abnormality. Further, the controller 71 detects an abnormality based on the detection signal input from the sensor 83. An abnormality is also detected when the alarm button 85 is pressed. Other peripheral devices may be used for abnormality detection. When an abnormality occurs, the controller 71 communicates with the center device 13 and transmits a security signal and an image signal. A microphone is provided together with the monitoring camera 81, and an audio signal is also transmitted. In this way, the controller 71 implements the security function of the monitoring target 5.

  The monitoring video and audio are also transmitted when requested by the center device 13. Furthermore, the monitoring video and audio are also sent to the user device 17. Transmission to the user device 17 is performed, for example, periodically, or according to other settings. For example, when a visitor is detected by the sensor 83, an image or the like is sent to the user device 17. Also, when requested by the user device 17, the monitoring device 15 transmits a video or the like.

  The IP line unit 73 constructs a VPN tunnel for the controller 71 to communicate with the communication management apparatus 11. In addition, a VPN tunnel is established for the controller 71 to communicate with the user device 17. The former corresponds to the inter-terminal VPN 21, and the latter corresponds to the inter-terminal VPN 25. In these connections, the IP line unit 73 realizes a VPN client function.

  In FIG. 2, the IP line unit 73 is shown as an internal configuration of the controller 71. This represents a physical arrangement. As a communication configuration, the IP line unit 73 is disposed between the controller 71 and the router 63.

  The multi-line adapter 77 is connected to the center device 13 via a mobile phone network. The multi-line adapter 77 is used for transmitting a security signal when the broadband line is disconnected. A security signal is transmitted from the controller 71 to the multi-line adapter 77 via the IP line unit 73 and transmitted from the multi-line adapter 77 to the center device 13.

  Next, the user device 17 will be described. The user device 17 includes a VPN terminal device (hereinafter referred to as VTE) 91 and a user PC (personal computer) 93. User PC 93 is connected to VTE 91, VTE 91 is connected to router 95, and router 95 is connected to the Internet. The router 95 is a router for a broadband line, and is a LAN gateway at the user base 7.

  The VTE 91 is a line termination device for broadband connection. Then, the VTE 91 constructs a VPN tunnel with the VPN server 35 of the communication management apparatus 11 and constructs a VPN tunnel with the IP line unit 73 of the monitoring apparatus 15. In the former, the VTE 91 functions as a VPN client, and in the latter, the VTE 91 functions as a VPN server.

  The VTE 91 transfers the video, audio and control signals received from the controller 71 of the monitoring device 15 to the user PC 93. Further, the VTE 91 transfers the voice and control signal received from the user PC 93 to the controller 71.

  In the present embodiment, the user base 7 is a store owner's office or the like. Therefore, the user PC 93 may be a store owner's PC. The user PC 93 is used by the owner to view the monitoring video of the monitoring target 5. In order to provide this function, the user PC 93 is installed with application software capable of displaying and switching the monitoring video of the monitoring target 5 by communicating with the controller 71.

  In the present embodiment, the user device 17 is fixed. However, the function of the user device 17 may be incorporated in a mobile terminal or the like and movable.

  The overall configuration of the monitoring system 1 has been described above. Next, characteristic features of the present invention will be described.

  In the present embodiment, the IP line unit 73 of the monitoring device 15 corresponds to the communication control device of the present invention. As described above, the IP line unit 73 is connected to the monitoring target LAN 61 and is connected to the Internet via the monitoring target LAN 61 to perform VPN communication. The virtual IP address for VPN is set so as not to overlap with the local IP address of the monitored LAN 61. However, there is a possibility that the local IP address is changed for some reason and overlaps with the virtual IP address. The present embodiment is effective in such a case, and can prevent the VPN communication from being disabled. This will be described in detail below.

  First, an example of a local IP address and a virtual IP address given to the configuration of the monitoring system 1 will be described with reference to FIG.

  FIG. 3 corresponds to a part of the monitoring system 1. As already described, as a schematic configuration, the monitoring target LAN 61 includes a router 63 as a gateway to the Internet. The router 63 is connected to the monitoring target PC 65 and is connected to the IP line unit 73 (the communication control device of the present invention) of the monitoring device 15.

  In the monitoring device 15, a controller 71 is connected to the IP line unit 73. In FIG. 2 described above, the IP line unit 73 is shown as the internal configuration of the controller 71 in order to express the physical arrangement. However, as a communication configuration, as shown in FIG. 3, the IP line unit 73 and the controller 71 are in communication with each other.

  The IP line unit 73 of the monitoring device 15 is connected to the communication management device 11 of the monitoring center 3 via the router 63 and the Internet. Then, a VPN is constructed between the IP line unit 73 and the communication management device 11.

  As shown in FIG. 3, in the monitoring target LAN 61, local IP addresses are assigned to the IP line unit 73 and the monitoring target PC 65. In VPN, virtual IP addresses are assigned to the IP line unit 73 and the monitoring center 3 (communication management apparatus 11).

  Here, in the example of FIG. 3, the local IP address is changed. Such a change may occur, for example, when the monitoring target LAN 61 is reconfigured for the convenience of the user. When the address change as shown in FIG. 3 is performed, the following problem occurs.

Referring to FIG. 4, the local IP address before the change is as follows.
IP line unit: 192.168.0.3
Monitored PC: 192.168.0.1
On the other hand, the virtual IP address is as follows.
IP line unit: 10.180.3
Monitoring center: 10.180.1

  The IP line unit 73 needs to determine that the packet is a VPN encapsulation target as a VPN process. In the conventional VPN, the network part of the destination address of the packet is referred to for such a determination. If the network part of the destination address is the network part (10.180) of the virtual IP address, the packet is encapsulated and sent out to the VPN tunnel.

  In the example of FIG. 4, when the destination of the packet is the VPN monitoring center 3 (communication management device 11), the destination address is “10.800.1” and includes the network part of the virtual IP address. The packet is encapsulated and sent out to the VPN tunnel.

  In order to perform the above VPN processing normally, the local IP address and the virtual IP address must not have overlapping network portions. If the network part overlaps, VPN communication becomes impossible. Therefore, when connecting a VPN-compatible device to the LAN, a virtual IP address is set so that the local IP address and the network portion do not overlap. In the example of FIG. 4, the network portion of the local IP address is “192.168.”. Therefore, the network part of the virtual IP address is set to “10.180”.

However, in the examples of FIGS. 3 and 4, the local IP address is changed, and as a result, the local IP address and the virtual IP address are as follows.
・ Local IP address
IP line unit: 10.180.0.5
Monitored PC: 10.180.0.2
・ Virtual IP address
IP line unit: 10.180.3
Monitoring center: 10.180.1

  As a result of the change of the local IP address, the network part of the local IP address matches the network part of the virtual IP address. For this reason, the IP line unit 73 cannot perform VPN communication.

  Such a situation occurs, for example, when the monitoring target LAN 61 is reconstructed. The monitoring target LAN 61 belongs to the monitoring target 5 and is owned by the user. For this reason, it is conceivable that the local IP address is changed without considering the VPN with the monitoring center 3, and as a result, an address duplication phenomenon occurs.

  In the present embodiment, in order to prevent the above problem, the IP line unit 73 is configured as follows.

  FIG. 5 shows the configuration of the IP line unit 73 together with the controller 71 and the router 63. As described above, the IP line unit 73 corresponds to the communication control device of the present invention, and also corresponds to the communication control unit of the present invention. The controller 71 corresponds to the information processing apparatus and the monitoring control unit of the present invention.

  The IP line unit 73 and the controller 71 are connected by a LAN (Ethernet, registered trademark). This LAN is a separate LAN from the monitored LAN 61. In order to distinguish from the monitored LAN 61, the LAN between the controller 71 and the IP line unit 73 is referred to as an intra-monitoring device LAN 201. The intra-monitoring device LAN 201 can also be referred to as an intra-controller LAN.

  As shown in FIG. 5, the IP line unit 73 includes a packet processing unit 101, a storage unit 103, a determination unit 105, an encapsulation unit 107, and a reissue processing unit 109.

  The packet processing unit 101 receives a packet from the controller 71 and converts the input packet (input packet) into a monitoring information packet (transmission packet) to be sent to the monitoring center 3 by VPN. Here, as will be described later, a process of extracting a transmission packet from the data area of the input packet is performed. The packet processing unit 101 may also input a packet for the monitoring target LAN 61 and a packet for a WAN other than the VPN. These packets are composed of a header area and a data area, and a source IP address and a destination IP address are stored in the header area.

  The storage unit 103 stores various types of information processed by the IP line unit 73. In relation to the present embodiment, the storage unit 103 stores the local IP address and virtual IP address of the IP line unit 73.

  The determination unit 105 compares the transmission source address in the transmission packet obtained by converting the packet input by the packet processing unit 101 with the virtual IP address stored in the storage unit 103. Then, the determination unit 105 determines whether both the network part and the host part of the source address match with both the network part and the host part of the virtual IP address.

  If the determination results match, the determination unit 105 supplies the packet to the encapsulation unit 107. If the determination results do not match, the determination unit 105 sends the packet to the router 63 as it is.

  The encapsulation unit 107 is configured to encapsulate a packet for transmission to the VPN tunnel. In the present embodiment, the packet is supplied from 105 to the encapsulation unit 107 and encapsulated by the encapsulation unit 107 only when the determination result of the determination unit 105 is the same.

  In encapsulation, the packet is encrypted. Then, the global IP address of the VPN connection partner is added (encapsulated). In the example of the present embodiment, the global IP address of the communication management device 11 is given. The capsule created in this way is sent to the router 63.

  In addition, the reissue processing unit 109 is configured to request the VPN server 35 of the communication management apparatus 11 to reissue a virtual IP address. The reissue processing unit 109 will be described in detail later.

  The characteristic configuration of the IP line unit 73 in the present embodiment has been described above with reference to FIG.

  Next, the operation of the present embodiment will be described with reference to FIGS. Here, the packet transmission operation of the IP line unit 73 will be described.

  FIG. 6 is a flowchart showing processing of each packet. First, the packet input by the packet processing unit 101 is converted into a transmission packet (S1). The determination unit 105 acquires a transmission source address in the packet (S3). Then, the determination unit 105 determines whether both the network part and the host part of the transmission source address match both the network part and the host part of the virtual IP address of the IP line unit 73 (S5). If the determination result in step S5 is No, the packet is transmitted as it is to the router 63 (S9). If the determination result in step S5 is Yes, the packet is encapsulated by the encapsulation unit 107 (S7), and the encapsulated packet is transmitted to the router 63 (S9).

  FIG. 7 shows the above processing more specifically. In the upper left part of FIG. 7, an input packet 121 from the controller 71 is shown. As described above, the controller 71 and the IP line unit 73 are connected by the LAN 201 within the monitoring apparatus. The input packet 121 is a LAN packet of the in-monitoring device LAN 201.

  The input packet 121 has a header area 123 and a data area 125. Although not shown, the addresses of the controller 71 and the IP line unit 73 set in the monitoring apparatus LAN 201 are attached to the header area 123 as a transmission source and a destination (these addresses are addresses described below). (Omitted from the figure to avoid confusion). The data area 125 includes data of a packet to be processed by the IP line unit 73, that is, a packet to be sent to the router 63. In other words, the controller 71 generates a packet to be processed by the IP line unit 73, adds information that the transmission source is the controller 71 and the destination is the IP line unit 73 to the header area 123 of this packet, and the IP line unit 73 73.

  The packet processing unit 101 extracts (extracts) the packet 131 in the data area of the input packet 121. The packet 131 includes a source address 133 and a destination address 135 in the header area 132. These are the addresses of communication ahead from the IP line unit 73, unlike the addresses of the LAN 201 in the monitoring apparatus. The data area 137 includes monitoring information to be transmitted to the monitoring center 3.

  In the present embodiment, the data area of the input packet 121 includes the packet 131 transmitted to the router 63. However, the packet processing unit 101 rewrites the information in the header area of the input packet 121. May be. That is, in the packet processing unit 101, if the transmission source attached to the header area 123 of the input packet 121 is the controller 71, the transmission area in the header area is the virtual IP address of the IP line unit 73 and the destination is the monitoring center 3. The packet 131 may be rewritten to the virtual IP address and transmitted to the router 63.

  The determination unit 105 compares the source address 133 included in the header area in the packet 131 with the virtual IP address of the IP line unit 73 stored in the storage unit 103. As shown in the figure, the comparison target is the network part and the host part in the address, that is, all the digits of the address.

  The determination unit 105 determines whether the network part and the host part of the transmission source address match the network part and the host part of the virtual IP address. If they do not match, the packet is sent to the router 63 as it is. If they match, the packet is sent to the encapsulation unit 107.

  FIG. 7 shows three types of packets addressed to WAN, LAN, and VPN. In the figure showing each addressed packet, the upper row shows the source address and the lower row shows the destination address. In FIG. 7, the local IP address of the IP line unit 73 is the same as that after the change in FIGS. 3 and 4 (10.180.0.5). The virtual IP address is also the same as in the example of FIGS. 3 and 4 (10.180.0.3). Therefore, in the conventional process, since the network address of the local network and the VPN is the same, communication is impossible. However, in this embodiment, communication is possible as follows.

  In the packet addressed to the WAN, the source address is the local IP address of the IP line unit 73, and the destination address is the global IP address. The source address does not match the virtual IP address. Therefore, the packet is sent to the router 63.

  In the packet addressed to the LAN, the source address is the local IP address of the IP line unit 73 and the destination address is the local IP address for the monitored LAN 61. Also in this case, the source address does not match the virtual IP address. Therefore, the packet is sent to the router 63.

  In the packet addressed to the VPN, the source address is the virtual IP address of the IP line unit 73, and the destination address is the virtual IP address of the monitoring center 3 (communication management device 11). In this case, the transmission source address matches the virtual IP address of the packet processing unit 101. Therefore, the packet is sent to the encapsulation unit 107. The encapsulation unit 107 encrypts the packet. Then, the global IP address of the monitoring center 3 (communication management device 11) is given to the encrypted packet (encapsulation). The packet created in this way is sent to the router 63 and sent to the monitoring center 3.

  In this way, according to the present embodiment, the determination unit 105 compares the packet source address with the virtual IP address, and particularly compares both the network part and the host part in the address. . Thereby, even when the local IP address is changed, the function of the IP line unit 73 can be suitably maintained.

  However, even with the above configuration, the problem may not be avoided. This is the case in the IP line unit 73 where the network part and host part of the local IP address match the network part and host part of the virtual IP address. In other words, this is a case where all digits of the local IP address and the virtual IP address completely match. This situation cannot be fully handled by the determination unit 105, and VPN packets cannot be processed. Therefore, in order to cope with such a situation, the reissue request unit 109 functions suitably as described below.

  The reissue processor 109 functions when the local IP address of the monitored LAN 61 is changed. When the local IP address of the monitored LAN 61 is changed, the local IP address of the IP line unit 73 is also changed, and the local IP address of the storage unit 103 is also rewritten. The reissue processing unit 109 compares the updated local IP address of the IP line unit 73 with the virtual IP address of the IP line unit 73. Then, the reissue request unit 109 determines whether both the network part and the client address part of the local IP address match both the network part and the client address part of the virtual IP address. If the determination results are the same, the reissue processor 109 requests reissue of the VPN address. The reissue request is issued to the VPN server 35 of the communication management apparatus 11.

  When a new virtual IP address is sent from the communication management apparatus 11 in response to the reissue request, the reissue processing unit 109 stores the new virtual IP address in the storage unit 103. Then, the IP line unit 73 performs VPN processing using the new virtual IP address. The above determination and the like are also performed using a new virtual IP address.

  The processing of the reissue request unit 109 is performed as follows using the VPN function in an actual apparatus. When the network part and host part (all digits) of the local IP address match the network part and host part of the virtual IP address, VPN communication is disabled and the VPN connection is disconnected. After disconnection, VPN connection processing is performed. In the reconnection process, a new virtual IP address is acquired from the VPN server 35 of the communication management apparatus 11 and stored in the storage unit 103. Such a VPN disconnection and reconnection function corresponds to the reissue request unit 109 in FIG.

  Thus, according to the present embodiment, even when the local IP address is changed and the network part and the host part all match in the local IP address and the virtual IP address, the reissue request unit 109 functions appropriately. Then, the VPN communication function of the IP line unit 73 can be secured by changing the virtual IP address side.

  Next, a modification of the present embodiment will be described. In the above embodiment, the determination target of the determination unit 105 is the packet source address. The determination unit 105 may also determine the destination address of the packet as a determination target. This will be described below.

  Although not shown in FIG. 5, the storage unit 103 of the IP line unit 73 stores the virtual IP address of the VPN connection partner. In this example, the virtual IP address of the communication management apparatus 11 is stored.

  The determination unit 105 compares the destination address of the packet with the virtual IP address of the connection partner stored in the storage unit 103. Here, it is determined whether or not a virtual IP address that matches the destination address is registered in the storage unit 103. Also, in this process, the determination unit 105 determines whether both the network part and the host part of the destination address match both the network part and the host part of the connection partner virtual IP address stored in the storage unit 103. Determine.

  The determination unit 105 passes the packet to the encapsulation unit 107 when the determination result of the transmission source address matches and the determination result of the destination address also matches.

  As described above, by determining not only the source address but also the destination address, it is possible to more reliably determine the VPN packet. Further, it is possible to more reliably avoid the situation where communication becomes impossible due to the change of the local IP address.

  Next, another modification will be described. In the example of the above embodiment, the present invention is applied to the inter-center-terminal VPN 21 between the monitoring device 15 and the monitoring center 3 (communication management device 11). However, the present invention is not limited to the above example. The present invention is also preferably applied to the inter-terminal VPN 25 between the monitoring device 15 and the user device 17. Further, the present invention may be applied to other than the monitoring system. The present invention is particularly useful when the local IP address is changed due to a change in the LAN or the like outside the management of the VPN virtual IP address setter.

  The embodiment of the present invention has been described above. According to the present invention, as described above, the VPN communication control device (IP line unit 73 in the embodiment) compares the source address in the transmission packet with the virtual IP address, and the network portion of the source address. Both the host part and the host part determine whether or not they match both the network part and the host part of the virtual IP address, and if the determination results match, the transmission packet is encapsulated. Therefore, it is possible to prevent communication from being disabled due to address duplication due to the change of the local IP address.

  Further, according to the present invention, the communication control device is connected to the information processing device through the dedicated communication path. A dedicated communication packet for the dedicated communication path is input from the information processing apparatus to the communication control apparatus as an input packet. A packet to be transmitted to the VPN is extracted from the data area of the dedicated communication packet. Then, an address included in the data area in the dedicated communication packet is a comparison target with the virtual IP address. In the above embodiment, the information processing apparatus is the controller 71, the dedicated communication path is the LAN 201 in the monitoring apparatus, and the dedicated communication packet is a packet in the LAN 201 in the monitoring apparatus. As described above, even when a dedicated communication packet is input from the information processing apparatus, according to the present invention, VPN communication can be suitably performed, and communication from being disabled due to address duplication can be avoided.

  According to the present invention, since the reissue processing unit is provided in the communication control device as described in the above embodiment, both the network portion and the client address portion of the local IP address of the communication control device in the local network are provided. However, even when the VPN is disconnected in accordance with both the network part and the client address part of the virtual IP address of the communication control device in VPN, VPN communication can be performed by reissuing the virtual IP address. Therefore, it is possible to avoid communication failure due to address duplication.

  Further, according to the present invention, as described above as a modification, in addition to the comparison between the transmission source address in the transmission packet and the virtual IP address of the communication control device, the destination address and the virtual IP address of the target device are also included. Compare. In the latter comparison process, both the network portion and the host portion are to be compared. If the comparison results match, the transmission packet is encapsulated. With such a configuration, it is possible to more reliably avoid communication failure due to address duplication in a configuration in which a VPN communication control device is connected to a local network.

  Moreover, the present invention is preferably applied to a monitoring system as described above. Then, it is possible to prevent communication from being disabled because the monitored local IP address and the VPN virtual IP address of the monitoring apparatus overlap. The monitoring system also plays a role of security and the like, and the level of demand for the safety and stability of the system is high, and the present invention can suitably meet such needs.

  The preferred embodiments of the present invention have been described above. However, the present invention is not limited to the above-described embodiments, and it goes without saying that those skilled in the art can modify the above-described embodiments within the scope of the present invention.

  As described above, the monitoring system according to the present invention is useful for monitoring a store or the like from a remote place using communication.

DESCRIPTION OF SYMBOLS 1 Monitoring system 3 Monitoring center 5 Monitoring object 7 User base 11 Communication management apparatus 13 Center apparatus 15 Monitoring apparatus 17 User apparatus 21 VPN between center terminals
23 SIP communication 25 VPN between terminals
33 HTTP server 35 VPN server 37 SIP server 41 Account management server 43 Database 61 Monitored LAN
63 Router 65 Monitored PC
71 Controller 73 IP line unit 91 VPN terminator (VTE)
93 User PC
95 router 101 packet processing unit 103 storage unit 105 determination unit 107 encapsulation unit 109 reissue processing unit

Claims (5)

A communication control device connected to a local network and connected to a wide area network via the local network to perform VPN communication,
A packet processing unit for converting an input packet into a transmission packet;
A storage unit for storing a virtual IP address of the communication control device in the VPN;
The transmission source address in the transmission packet is compared with the virtual IP address stored in the storage unit, and both the network part and the host part of the transmission source address are the network part and the host part of the virtual IP address. A determination unit for determining whether or not both match,
An encapsulation unit that encapsulates the packet when the determination result by the determination unit is coincident;
A communication control device comprising: The storage unit further stores a virtual IP address of a target device connected by the VPN,
The determination unit further compares the destination address included in the transmission packet with the virtual IP address of the target device stored in the storage unit, and both the network part and the host part of the destination address are the target The communication control apparatus according to claim 1, wherein it is determined whether or not both the network part and the host part of the virtual IP address of the device match. The communication control device is connected to the information processing device through a dedicated communication path different from the local network,
The packet processing unit inputs a dedicated communication packet for the dedicated communication path from the information processing apparatus as the input packet, and extracts the transmission packet to be sent to the VPN from the data area of the dedicated communication packet. The communication control device according to claim 1, wherein   Both the network portion and the client address portion of the local IP address of the communication control device in the local network match both the network portion and the client address portion of the virtual IP address of the communication control device in the VPN. The communication control apparatus according to claim 1, further comprising a reissue processing unit that requests a VPN server to reissue the VPN address when the VPN address is disconnected. A monitoring device connected to a local network to be monitored and transmitting monitoring information acquired by the monitoring target from the local network to a remote monitoring center via a wide area network,
A monitoring control unit that generates monitoring information to be transmitted to the monitoring center;
A communication control unit that performs VPN communication with the monitoring center;
The communication control unit, a packet processing unit for converting an input packet including the monitoring information from the monitoring control unit into a transmission packet to be transmitted to the monitoring center;
A storage unit for storing a virtual IP address of the monitoring device in the VPN;
The transmission source address in the transmission packet is compared with the virtual IP address stored in the storage unit, and both the network part and the host part of the transmission source address are the network part and the host part of the virtual IP address. A determination unit for determining whether or not both match,
An encapsulating unit that encapsulates the transmission packet when the determination result by the determining unit is the same;
The monitoring apparatus characterized by having.