JP2011211306A - Vpn router, communication system, and communication program - Google Patents

Abstract

PROBLEM TO BE SOLVED: To provide a VPN router capable of accessing to a local network easily from an outside environment through a VPN, and limiting an object for the connection of the VPN to a regular terminal.SOLUTION: The VPN router 8 receives a VPN connection request from a portable terminal 7. The VPN router generates and stores an authentication key, and transmits a center authentication instruction to the portable terminal 7 (T1 and T2). The portable terminal 7 transmits a center authentication request to a server 3 (T3). The server 3 transmits an authentication key request to the VPN router 8 to acquire an authentication key stored at the VPN router 8 (T4 and T5). When the authentication key received from the portable terminal 7 is matched with the authentication key received from the VPN router 8, the server 3 transmits a session establishing instruction to the VPN router 8 (T6). Then, the VPN router 8 establishes a VPN session for connecting the portable terminal 7 to a PC (T8).

Description

  The present invention relates to a VPN router, a communication system, and a communication program. Specifically, the present invention relates to a VPN router, a communication system, and a communication program for establishing a VPN session between a plurality of terminal devices.

  Conventionally, VPN (Virtual Private Network) is known as a kind of network service. In VPN, a part of the public network is used as a virtual dedicated line. Communication with high security is performed between the terminal devices in which the VPN session is established. In recent years, it has been proposed to construct a VPN on the Internet. For example, a plurality of terminal devices are connected to the Internet via routers (hereinafter referred to as VPN routers) each having a VPN function. A VPN router connected to each terminal device performs encrypted communication using a predetermined protocol, so that VPN is realized on the Internet.

  An on-demand VPN router is known as a kind of VPN router. In the on-demand type VPN router, an IP address that identifies the end node of the VPN session is registered in advance. When the VPN router receives an IP packet from a locally connected terminal device, the VPN router determines whether the destination address of the IP packet matches the registered IP address. When the destination address matches the registered IP address, the VPN router automatically establishes a VPN session connecting the terminal device and the terminal node.

  In VPN, in order to improve security, an encryption key used for encrypted communication may be periodically updated. Therefore, one VPN router generates a common key and transmits the common key to the other VPN router via the mobile phone network. As a result, a VPN communication device that realizes high security while simplifying data communication necessary for the exchange of the common key is known (see, for example, Patent Document 1).

JP 2006-217275 A

  In recent years, there are cases where a user connects to an in-house network using a mobile terminal (for example, a mobile phone or a notebook PC) on the go. At this time, in order to ensure security during communication, a user may connect to an in-house network via a VPN via a VPN router installed on the go. It is also conceivable that the user can carry the VPN router by reducing the size and weight of the on-demand VPN router. In this case, the mobile terminal and the in-house network may be connected by VPN via a VPN router carried by the user on the go.

  In such a case, any terminal device that has been set for communication to establish a VPN session with the internal network can access the internal network. In other words, there is a possibility that a third party may illegally access an in-house network from an external environment via a VPN router using an unspecified terminal device. In addition, the mobile terminal in which the above communication settings remain may be lost by the user or stolen by a third party. In this case as well, there is a possibility that a mobile terminal illegally acquired by a third party may illegally access an in-house network from the external environment via the VPN router.

  The present invention has been made to solve the above-described problems, and can easily access a local network from an external environment with a VPN, and limit the VPN connection target to a regular terminal device. An object is to provide a VPN router, a communication system, and a communication program.

  A VPN router according to a first aspect of the present invention is a VPN router that is locally connected to one terminal device and connected to another terminal device and a server that manages a VPN session via a network, Authentication information generating means for generating first authentication information unique to the one terminal device when receiving a connection request, which is an instruction for requesting connection to the other terminal device, from the one terminal device; and the authentication information First authentication information transmitting means for transmitting the first authentication information generated by the generating means to the one terminal device, and first authentication information for storing the first authentication information generated by the authentication information generating means An instruction for requesting authentication of whether or not the one terminal device is an establishment target of the VPN session, which is transmitted from the one terminal device to the server; When receiving an authentication request relay unit that relays an authentication request including the first authentication information and an information request that is an instruction to request the first authentication information from the server, the first authentication information storage unit A second authentication information transmitting means for transmitting the stored first authentication information to the server; and when receiving an instruction to establish the VPN session from the server, the one terminal device and the other on the network Session establishing means for establishing the VPN session for connecting to the terminal device.

  According to the first aspect, when a connection request is transmitted from one terminal device to the VPN router, the first authentication information is generated and stored in the VPN router, and the first authentication information is transmitted from the VPN router to the one terminal device. Sent to. When an authentication request including the first authentication information is transmitted from one terminal device, the authentication request is relayed toward the server by the VPN router. When the information request is transmitted from the server to the VPN router, the first authentication information stored in the VPN router is transmitted to the server. When a VPN session establishment instruction is transmitted from the server to the VPN router, a VPN session connecting one terminal device and another terminal device is established. Thereby, it is possible to easily access the local network from the external environment with the VPN, and it is possible to limit the VPN connection target to a regular terminal device.

  1st aspect WHEREIN: About the said 1st authentication information memorize | stored in the said 1st authentication information storage means, the elapsed time measurement means which measures the elapsed time from the time produced | generated by the said authentication information generation means, The said VPN session Status information storage means for storing status information indicating the status of the one terminal device, and status setting means for setting the status information to the first state when the authentication information is generated by the authentication information generating means; A status changing unit that changes the status information from the first state to the second state when the elapsed time is equal to or longer than a predetermined time, and the second authentication information transmitting unit sends the information request from the server. When the status information is in the first state at the time of reception, the first authentication information is transmitted while the status information is in the first state. If the scan information is the second state may cancel the transmission of the first authentication information.

  According to this, when the elapsed time from when the first authentication information is generated until the information request is received is equal to or longer than a predetermined time, the status information is changed from the first state to the second state. Transmission of authentication information is canceled. Therefore, it is possible to suppress a delay in processing executed in the VPN router, and to reduce the possibility of an unauthorized operation by a third party intervening.

  In the first aspect, the connection request includes second authentication information set in the one terminal device, and stores the second authentication information registered in advance in association with the one terminal device. When the connection request is received from the authentication information storage means and the one terminal device, the second authentication information included in the connection request and the second authentication information stored in the second authentication information storage means Terminal authentication means for determining whether or not and the authentication information generating means generates the first authentication information when the terminal authentication means determines that the second authentication information matches. On the other hand, if the terminal authentication means determines that the second authentication information does not match, the generation of the first authentication information may be stopped.

  According to this, an authentication process using the first authentication information is executed in the server, and an authentication process using the second authentication information is executed in the VPN router. That is, since the authentication process using different authentication information is executed by different devices, security is improved. When the authentication process using the second authentication information fails, the generation of the first authentication information is stopped, so that a delay in the process executed by the VPN router can be suppressed.

  In the first aspect, the connection request includes information indicating a service that the one terminal device requests to provide, an address storage unit that stores an address of the other terminal device that can provide the service, and the connection request The one terminal device specifies the service that the one terminal device seeks to provide based on the information indicating the service included in the address, and the address of the other terminal device that can provide the specified service is stored in the address storage Address specifying means for specifying with reference to means, and the session establishing means may establish the VPN session based on the address specified by the address specifying means. According to this, the VPN router can specify the connection destination address of the VPN session according to the service received from another terminal device.

  In the first aspect, the first authentication information transmitting means transmits identification information unique to the VPN router to the one terminal device together with the first authentication information, and the authentication request may include the identification information. Good. According to this, the VPN router to which one terminal device is connected can be specified by the server based on the VPN router identification information included in the authentication request.

  In the first aspect, the first authentication information may be an authentication key that is randomly generated every time the connection request is received. Thereby, it is possible to make the server specify whether one terminal device and the terminal device connected to the VPN router are the same.

  A communication system according to a second aspect of the present invention includes a server for managing a VPN session, a local connection with one terminal device, and a VPN router connected to another terminal device and the server via a network. When the VPN router receives a connection request that is an instruction for requesting connection to the other terminal device from the one terminal device, the VPN router transmits authentication information specific to the one terminal device. Authentication information generating means to be generated, first authentication information transmitting means for transmitting the authentication information generated by the authentication information generating means to the one terminal device, and the authentication information generated by the authentication information generating means Authentication information storage means for storing the authentication information, and the one terminal device transmitted from the one terminal device to the server confirms the VPN session. An instruction for requesting authentication as to whether or not the authentication target is received, an authentication request relay means for relaying an authentication request including the authentication information, and an information request which is an instruction for requesting the authentication information from the server A second authentication information transmitting means for transmitting the authentication information stored in the authentication information storage means to the server; and when receiving an instruction for establishing the VPN session from the server, the first information on the network Session establishing means for establishing the VPN session connecting the terminal device and the other terminal device, and when the server receives the authentication request from the one terminal device, the server requests the information request to the VPN router. Information request transmitting means for transmitting the authentication information, and when receiving the authentication information from the VPN router, the authentication information included in the authentication request, A session authentication means for determining whether or not the authentication information received from the PN router matches; and an establishment for transmitting the establishment instruction to the VPN router when the authentication information is determined to match by the session authentication means Instruction transmission means.

  According to the second aspect, when a connection request is transmitted from one terminal device to the VPN router, the first authentication information is generated and stored in the VPN router, and the first authentication information is transmitted from the VPN router to the one terminal device. Sent to. When an authentication request including the first authentication information is transmitted from one terminal device, the authentication request is relayed toward the server by the VPN router. When the information request is transmitted from the server to the VPN router, the first authentication information stored in the VPN router is transmitted to the server. When a VPN session establishment instruction is transmitted from the server to the VPN router, a VPN session connecting one terminal device and another terminal device is established. Thereby, it is possible to easily access the local network from the external environment with the VPN, and it is possible to limit the VPN connection target to a regular terminal device.

  A communication program according to the third aspect of the present invention is a computer that is a VPN router locally connected to one terminal device and connected to another terminal device and a server that manages a VPN session via a network. An authentication information generating step of generating authentication information unique to the one terminal device when receiving a connection request that is an instruction for requesting connection to the other terminal device from the one terminal device; and generating the authentication information A first authentication information transmitting step for transmitting the authentication information generated by the step to the one terminal device; and an authentication information storing step for storing the authentication information generated by the authentication information generating step in a storage device; The one terminal device transmitted from the one terminal device to the server is the VPN session establishment target. An authentication request relay step for relaying an authentication request including the authentication information, and an information request that is an instruction for requesting the authentication information from the server. A second authentication information transmission step of transmitting the authentication information stored in the information device to the server; and when receiving an instruction to establish the VPN session from the server, the one terminal device and the A session establishing step of establishing the VPN session for connecting to another terminal device.

  According to the third aspect, when a connection request is transmitted from one terminal device to the VPN router, the first authentication information is generated and stored in the VPN router, and the first authentication information is transmitted from the VPN router to the one terminal device. Sent to. When an authentication request including the first authentication information is transmitted from one terminal device, the authentication request is relayed toward the server by the VPN router. When the information request is transmitted from the server to the VPN router, the first authentication information stored in the VPN router is transmitted to the server. When a VPN session establishment instruction is transmitted from the server to the VPN router, a VPN session connecting one terminal device and another terminal device is established. Thereby, it is possible to easily access the local network from the external environment with the VPN, and it is possible to limit the VPN connection target to a regular terminal device.

1 is a diagram illustrating an overall configuration of a communication system 1. FIG. 2 is a block diagram showing an electrical configuration of a VPN router 8. FIG. It is a figure which shows the data structure of the session management table. 4 is a diagram showing a data configuration of a connection destination management table 120. FIG. 3 is a block diagram showing an electrical configuration of a server 3. FIG. It is a figure which shows the data structure of the authentication information management table. 3 is a timing chart showing the flow of various data in the communication system 1. 7 is a flowchart of main processing executed by the VPN router 8. It is a flowchart of a VPN connection process. FIG. 10 is a continuation of the flowchart shown in FIG. 9. It is another figure which shows the data structure of the session management table 110. 4 is a flowchart of main processing executed by the server 3. It is another figure which shows the data structure of the session management table 110.

  Embodiments of the present invention will be described with reference to the drawings. The drawings to be referred to are used to explain technical features that can be adopted by the present invention, and are merely illustrative examples.

  With reference to FIG. 1, an overall configuration of a communication system 1 according to the present embodiment will be described. The communication system 1 has a configuration in which an external terminal device can be connected to a specific local network via a VPN. A communication system 1 illustrated in FIG. 1 includes a PC (Personal Computer) 2, a server 3, a LAN (Local Area Network) 4, a VPN router 5, the Internet 6, a portable terminal 7, a VPN router 8, and the like.

  The PC 2 is installed at the head office of the company to which the user belongs. The LAN 4 is a local network of the head office to which devices such as the PC 2, a server (not shown), and a printer (not shown) are connected. The VPN router 5 is a known VPN router installed at the head office, and relays data communication between the LAN 4 and an external network. The PC 2 can access the Internet 6 via the VPN router 5.

  The portable terminal 7 is a small and lightweight terminal device, such as a notebook PC, a PDA (Personal Digital Assistant), an electronic paper terminal, or the like. The VPN router 8 is a small and lightweight VPN router and has the same function as a known VPN router. The user can carry the portable terminal 7 and the VPN router 8 and use them on the go.

  For example, when the destination is an environment that can connect to the Internet 6, the user connects the mobile terminal 7 and the VPN router 8, and connects the VPN router 8 and the Internet 6. The VPN router 8 relays data communication between the mobile terminal 7 and an external network (that is, the Internet 6). As a result, the mobile terminal 7 can access the Internet 6 via the VPN router 8.

  In the present embodiment, a case where a user who is away from home accesses the LAN 4 of the head office using the mobile terminal 7 and refers to a file stored in the PC 2 is illustrated. The VPN router 5 at the head office permits access to the device connected to the LAN 4 only to an external terminal for which a VPN session has been established by a known security function. That is, only when a VPN session is established between the mobile terminal 7 and the PC 2, the mobile terminal 7 and the PC 2 can communicate with each other through the VPN, and the user can refer to a file stored in the PC 2.

  The server 3 is a known server connected to the Internet 6. The server 3 determines whether or not establishment of a VPN session should be permitted for an external terminal that requests access to the LAN 4 (that is, whether or not access to the LAN 4 should be permitted). Processing related to the establishment of the VPN session will be described later separately.

  The electrical configuration of the VPN router 8 will be described with reference to FIG. Although not described, the electrical configuration of the VPN router 5 is the same as that of the VPN router 8.

  The VPN router 8 includes a CPU 81 that controls the VPN router 8. A ROM 82, a RAM 83, a flash memory 84, a LAN interface 85, a wireless LAN interface 86, a WAN interface 87, a USB interface 88, and an LED display unit 89 are connected to the CPU 81 via a bus 80. Although not shown, the VPN router 8 includes a battery for supplying power. The ROM 82 stores a program that causes the CPU 80 to execute main processing (see FIG. 8). The flash memory 84 stores a session management table 110 and a connection destination management table 120, details of which will be described later.

  The LAN interface 85 includes a port to which a LAN cable (not shown) is connected, and transmits / receives data to / from an external device via the LAN cable. The wireless LAN interface 86 includes an antenna (not shown) and transmits / receives data to / from an external device by wireless communication. The WAN interface 87 includes a port to which a WAN cable (not shown) is connected, and transmits / receives data to / from the wide area network via the WAN cable. The USB interface 88 includes a port to which a USB cable (not shown) is connected, and transmits / receives data to / from an external device via the USB cable. The LED display unit 89 notifies the operation state of the VPN router 8 by the light emission pattern and light emission color of the LED (not shown).

  In the present embodiment, when the user connects the portable terminal 7 to the VPN router 8, the user can make a wired connection using a LAN cable or a USB cable, or a wireless connection using a wireless LAN. For example, the mobile terminal 7 and the VPN router 8 may be connected in a suitable manner according to the function and structure of the mobile terminal 7. When the user connects the VPN router 8 to the Internet 6, the user may make a wired connection using a WAN cable or a LAN cable, a connection via an access point using a wireless LAN, or a wireless connection via a 3G line. it can. For example, the VPN router 8 and the Internet 6 may be connected in a suitable manner according to the connection environment of the place where the user is away from home.

  The data configuration of the session management table 110 will be described with reference to FIG. In the session management table 110, a record including a data item related to a VPN session is registered for each legitimate terminal device. A legitimate terminal device is a terminal device that is permitted to connect to the VPN router 8. Hereinafter, the record registered in the session management table 110 is referred to as a session management record. In the example illustrated in FIG. 3, the session management record of the mobile terminal 7 is registered in the session management table 110. This session management record includes, as data items, the MAC address and IP address of the mobile terminal 7, the terminal ID and password set in the mobile terminal 7, the session state, the authentication key, the key generation date and time, and the like. .

  The session state indicates a processing state relating to the VPN session (that is, a progress status of a VPN connection process described later) as one of “idle”, “waiting for authentication”, “during VPN communication”, and “lock”. Specifically, “idle” indicates a state in which VPN connection processing (see FIGS. 9 and 10) can be started in response to a request from the mobile terminal 7. “Waiting for authentication” indicates a state of waiting for completion of later-described key authentication related to the mobile terminal 7. “VPN communication in progress” indicates a state in which a VPN session for the mobile terminal 7 is established. “Lock” indicates a state in which the VPN session for the mobile terminal 7 is restricted.

  The authentication key is authentication information that is randomly generated every time the VPN connection process (see FIGS. 9 and 10) is executed. The key generation date / time indicates the date / time when the authentication key was generated. As shown in FIG. 3, when the session state is “idle”, since the VPN connection processing (see FIGS. 9 and 10) has not started, the authentication key and the key generation date and time are not set.

  The data configuration of the connection destination management table 120 will be described with reference to FIG. In the connection destination management table 120, a record including a data item related to the connection destination of the VPN session is registered for each legitimate terminal device. Hereinafter, the record registered in the connection destination management table 120 is referred to as a connection destination management record. In the example illustrated in FIG. 4, the connection destination management record of the mobile terminal 7 is registered in the connection destination management table 120. This connection destination management record includes, as data items, the MAC address and IP address of the mobile terminal 7, service information, and the like.

  The service information is information related to a service provided by the service providing device, and includes a service ID, a provider address, and a certificate as data items. The service providing device is a device that provides various services to a legitimate terminal device through VPN communication. The service ID is an ID that identifies a service provided by the service providing device. The source address is the IP address of the service providing device. The certificate is authentication information necessary for receiving the provision of the service.

  In the present embodiment, the user browses the file on the PC 2 using the mobile terminal 7. Therefore, information related to the file providing service of the PC 2 is set in the service information of the mobile terminal 7. Specifically, the service ID is an ID that identifies the file providing service of the PC 2. The source address is the IP address of PC2. The certificate is authentication information necessary for receiving the file providing service of the PC 2.

  The electrical configuration of the server 3 will be described with reference to FIG. The server 3 includes a CPU 31 that controls the server 3. A ROM 32, a RAM 33, an HDD (Hard Disk Drive) 34, a LAN interface 35, and an input / output unit 36 are connected to the CPU 31 via a bus 30. An input device 37 exemplified by a mouse and a keyboard and a display 38 are connected to the input / output unit 36. The server 3 is connected to the Internet 6 via a LAN cable connected to the LAN interface 35. The HDD 34 stores a program for causing the CPU 30 to execute main processing (see FIG. 12) and an authentication information management table 130.

  The data configuration of the authentication information management table 130 will be described with reference to FIG. In the authentication information management table 130, a record including a data item related to center authentication is registered for each regular VPN router. The regular VPN router is a VPN router that is permitted to establish a VPN with the VPN router 5 at the head office. The center authentication is an authentication process executed by the server 3 and includes device authentication and key authentication described later. Hereinafter, the record registered in the authentication information management table 130 is referred to as an authentication management record.

  In the example shown in FIG. 6, the authentication management record of the VPN router 8 is registered in the authentication information management table 130. This authentication management record includes, as data items, a router ID set in the VPN router 8, a terminal ID and password set in the mobile terminal 7, an authentication state, an authentication key, and the like. The authentication state indicates a state relating to center authentication described later by “normal” or “locked”. Specifically, “normal” indicates a state in which center authentication relating to the VPN router 8 can be executed. “Lock” indicates a state where center authentication relating to the VPN router 8 is restricted. The authentication key is the latest authentication key acquired from the VPN router 8.

  With reference to FIG. 7, an outline of the overall processing of the communication system 1 will be described. In the following description, a terminal device that requests establishment of a VPN session is referred to as a target terminal. The VPN router to which the target terminal is connected is called the target router. In this embodiment, the portable terminal 7 is a target terminal, and the VPN router 8 is a target router.

  For example, when the user browses the file on the PC 2 using the mobile terminal 7, the mobile terminal 7 transmits a VPN connection request to the VPN router 8 (T 1). The VPN connection request is a signal for requesting the target router to establish a VPN session for connecting the target terminal and the service providing device. When receiving the VPN connection request, the VPN router 8 executes local authentication for determining whether or not the mobile terminal 7 is a legitimate terminal device. The VPN router 8 generates and stores the authentication key of the mobile terminal 7 when the local authentication is successful. The VPN router 8 transmits a center authentication instruction to the mobile terminal 7 (T2). The center authentication instruction is a signal that instructs the target terminal that the target terminal receives center authentication of the server 3, and includes at least the authentication key of the mobile terminal 7.

  When receiving the center authentication instruction, the portable terminal 7 transmits a center authentication request to the server 3 (T3). The center authentication request is a signal for requesting the server 3 to execute center authentication for the target terminal, and includes at least the authentication key received from the VPN router 8. The VPN router 8 relays the center authentication request transmitted from the mobile terminal 7 toward the server 3.

  When receiving the center authentication request, the server 3 transmits an authentication key request to the VPN router 8 (T4). The authentication key request is a signal that requests the target router for the authentication key of the target terminal. When the VPN router 8 receives the authentication key request, the VPN router 8 transmits the authentication key stored in itself to the server 3 (T5). The server 3 executes key authentication for collating the authentication key received from the mobile terminal 7 with the authentication key received from the VPN router 8.

  When the key authentication is successful, the server 3 transmits a session establishment instruction to the VPN router 8 (T6), and transmits an authentication success notification to the mobile terminal 7 (T7). The session establishment instruction is a signal that instructs the target router to establish a VPN session that connects the target terminal and the service providing device. The authentication success notification is a signal for notifying the target terminal that the center authentication requested from the target terminal is successful.

  Upon receiving the session establishment instruction, the VPN router 8 establishes a VPN session that connects the portable terminal 7 and the PC 2 (T8). VPN communication is executed between the portable terminal 7 and the PC 2 by a known tunneling process executed by the VPN router 5 and the VPN router 8 (T9). Thereby, the portable terminal 7 can access PC2 by VPN communication, and the user can browse the file of PC2 from an external environment.

  With reference to FIGS. 8-13, the detail of the process respectively performed by the VPN router 8 and the server 3 among the whole processes of the communication system 1 mentioned above is demonstrated. Hereinafter, in order to facilitate understanding, description will be made with reference to the timing chart shown in FIG. 7 as appropriate.

  With reference to FIG. 8, the main process executed by the VPN router 8 will be described. The main process (see FIG. 8) is continuously executed by the CPU 81 based on the program stored in the ROM 82 until the VPN router 8 is turned off.

  In the main process of the VPN router 8, it is first determined whether or not a packet addressed to itself is received (S1). Specifically, when the VPN router 8 receives the packet and the destination address included in the received packet matches the IP address of the VPN router 8, it is determined that the packet addressed to itself is received (S1: YES). In this case, it is determined whether the received packet is a VPN connection request (S3). When the received packet is a VPN connection request (S3: YES), a VPN connection process (S5) described later is called and executed.

  If the received packet is not a VPN connection request (S3: NO), other processing is executed according to the received packet (S7). For example, when the received packet is an update instruction for the session management table 110, the session management record is updated according to the update instruction. When the received packet is an instruction to update the connection destination management table 120, the connection destination management record is updated according to the update instruction.

  If the VPN router 8 has not received the packet, or if the destination address included in the received packet does not match the IP address of the VPN router 8, it is determined that the packet addressed to itself has not been received (S1: NO). ). In this case, the process proceeds to step S9. Even after execution of step S5 or step S7, the process proceeds to step S9.

  In step S9, it is determined whether a packet addressed to another device has been received. Specifically, when the VPN router 8 receives the packet and the destination address included in the received packet does not match the IP address of the VPN router 8, it is determined that the packet addressed to another device has been received (S9: YES). In this case, it is determined whether VPN communication is being executed between the packet transmission source and the packet transmission destination (S11). The VPN router 8 grasps the target device of the VPN session when performing VPN communication with other VPN routers. For example, whether or not VPN communication is being performed can be determined based on whether or not the target device of the VPN session matches the packet transmission source and the packet transmission destination.

  When VPN communication is being executed (S11: YES), a known tunneling process is executed (S13). That is, the received packet is transferred via the VPN. On the other hand, when VPN communication is not being executed (S11: NO), a known packet relay process is executed (S15). That is, the received packet is transferred by the same routing control as a known router.

  If the VPN router 8 has not received a packet, or if the destination address included in the received packet matches the IP address of the VPN router 8, it is determined that a packet addressed to another device has not been received (S9: NO). ). In this case, the process returns to step S1. Even after execution of step S13 or step S15, the process returns to step S1.

  In this embodiment, in order to receive the file providing service of the PC 2, the user operates the portable terminal 7 to input an instruction to execute VPN connection to the PC 2. At this time, the user inputs the terminal ID “000001” and password “******” of the mobile terminal 7 and the service ID “S001” indicating the file providing service of the PC 2. The portable terminal 7 transmits a VPN connection request including the information input by the user and the address of the portable terminal 7 to the VPN router 8 (see T1 in FIG. 7). The address of the mobile terminal 7 is, for example, the IP address “202.213.xxx.xxx” or the MAC address “00-11-22-33-44-55”. When the VPN router 8 receives the VPN connection request of the mobile terminal 7, it starts the following VPN connection processing (S1: YES, S3: YES, S5).

  The VPN connection process (S5) will be described with reference to FIG. 9 and FIG. In the VPN connection process, it is first determined whether or not the target terminal is registered in the VPN router 8 (S31). Specifically, it is determined whether or not a record in which an address included in the VPN connection request is set (that is, a session management record of the target terminal) is registered in the session management table 110. When the session management record of the target terminal is registered (S31: YES), it is determined whether or not the session state included in the session management record of the target terminal is “idle” (S33). When the session state is “idle” (S33: YES), a local authentication process is executed (S35).

  In the local authentication process (S35), the terminal ID and password included in the VPN connection request are compared with the terminal ID and password included in the session management record of the target terminal. Based on the collation result, it is determined whether or not the local authentication is successful (S37). If the local authentication is successful (S37: YES), a random authentication key is generated by a known method (S39). The authentication key generated in step S39 is stored in the flash memory 84 as an authentication key included in the session management record of the target terminal (S41).

  A center authentication instruction including the authentication key generated in step S39 and the router ID of the VPN router 8 is transmitted to the target terminal (S43). The session state included in the session management record of the target terminal is set to “waiting for authentication” (S45). The elapsed time calculated from the time of transmission of the center authentication instruction is started by a timer not shown (S47).

  When the session management record of the target terminal is not registered (S31: NO), or when the session state is not “idle” (S33: NO), an error is transmitted to the target terminal (S51). If the local authentication fails (S37: NO), the session state included in the session management record of the target terminal is set to “lock” (S49). An error is transmitted to the target terminal (S51), and the VPN connection process is terminated. The target terminal that has received the error in step S49 is notified of the failure to establish the VPN session.

  In the present embodiment, the session management record of the mobile terminal 7 is registered in the session management table 110, and the session state is “idle” (see FIG. 4). The terminal ID and the password included in the VPN connection request match the terminal ID “000001” and the password “******” included in the session management record of the mobile terminal 7. Therefore, the VPN router 8 that has received the VPN connection request generates an authentication key “qegecsz”. As shown in FIG. 11, in the session management record of the portable terminal 7, the authentication key “qegecsz” is set, and the session state is updated from “idle” to “waiting for authentication”. The VPN router 8 transmits a center authentication instruction including the authentication key “qegecsz” and the router ID “R001” to the mobile terminal 7 (see T3 in FIG. 7).

  The mobile terminal 7 that has received the center authentication instruction sends a center authentication request including the terminal ID “000001”, the password “******”, the authentication key “qgecsz”, and the router ID “R001” to the server 3. (See T3 in FIG. 7). The terminal ID and password included in the center authentication request may be input again to the mobile terminal 7 by the user, or the terminal ID and password input at the time of the VPN connection request may be automatically set. At this time, the VPN router 8 transfers the center authentication request received from the mobile terminal 7 to the server 3 by packet relay processing (S9: YES, S11: NO, S15).

  With reference to FIG. 12, the main process executed by the server 3 will be described. The main process (see FIG. 12) is continuously executed by the CPU 31 until the server 3 is turned off based on a program stored in the HDD 34.

  In the main process of the server 3, it is first determined whether or not a center authentication request has been received (S101). When the center authentication request is received (S101: YES), it is determined whether or not the target router is registered in the server 3 (S103). Specifically, it is determined whether or not a record in which the router ID included in the center authentication request is set (that is, the authentication management record of the target router) is registered in the authentication information management table 130. When the authentication management record of the target router is registered (S103: YES), it is determined whether or not the authentication state included in the authentication management record of the target router is “normal” (S105). If the authentication state is “normal” (S105: YES), device authentication processing is executed (S107).

  In the device authentication process (S107), the terminal ID and password included in the center authentication request are checked against the terminal ID and password included in the authentication management record of the target router. Based on the comparison result, it is determined whether the device authentication is successful (S109). When the device authentication is successful (S109: YES), the authentication key included in the center authentication request is stored in the HDD 34 as the authentication key included in the authentication management record of the target server (S111). An authentication key request is transmitted to the target router (S113). The elapsed time calculated from the transmission of the center authentication request is started by a timer not shown (S115).

  In the present embodiment, the authentication management record of the VPN router 8 is registered in the authentication information management table 130, and the authentication state is “normal” (see FIG. 6). The terminal ID and password included in the center authentication request match the terminal ID and password included in the authentication management record of the VPN router 8. Therefore, the server 3 that has received the center authentication request sets the authentication key “qececsz” in the authentication management record of the VPN router 8 (see FIG. 6). Further, an authentication key request for requesting the authentication key of the portable terminal 7 is transmitted to the VPN router 8 (see T4 in FIG. 7).

  As shown in FIGS. 9 and 10, in the VPN connection process, after execution of step S47, it is determined whether an authentication key request has been received (S53). If an authentication key request has not been received (S53: NO), it is determined whether or not a timeout has occurred (S55). Specifically, it is determined whether or not the elapsed time at which the count was started in step S47 has passed a predetermined time (for example, 10 seconds). When the elapsed time has passed the predetermined time (S55: YES), the session state included in the session management record of the target terminal is set to “lock” (S57). If it is not a timeout (S55: NO), the process returns to step S53.

  When an authentication key request is received (S55: YES), or after execution of step S57, it is determined whether or not the session state included in the session management record of the target terminal is “waiting for authentication” (S58). When the session state is “waiting for authentication” (S58: YES), the authentication key included in the session management record of the target terminal is read from the flash memory 84 (S59). The authentication key read in step S59 is transmitted to the server 3 (S61).

  When the session state is set to “lock” in step S57, it is determined that the session state is not “waiting for authentication” (S58: NO), and the VPN connection process is terminated. In the present embodiment, the VPN router 8 that has received the authentication key request transmits the authentication key “qgecsz” and the router ID “R001” to the server 3 (see T5 in FIG. 7).

  As shown in FIG. 12, in the main process of the server 3, after execution of step S115, it is determined whether or not a timeout has occurred (S117). Specifically, it is determined whether or not the elapsed time at which the count is started in step S115 has passed a predetermined time (for example, 10 seconds). If the elapsed time has not passed the predetermined time (S117: NO), it is determined whether an authentication key has been received (S119). When the authentication key is received (S119: YES), it is determined whether or not the authentication key received in step 119 matches the authentication key included in the authentication management record of the target router (S121). If the authentication keys match (S121: YES), a session establishment instruction is transmitted to the target router (S123), and an authentication success notification is transmitted to the target terminal (S125).

  If the authentication key has not been received (S119: NO), the process returns to step S117. When the device authentication has failed (S109: NO), the elapsed time has passed the predetermined time (S117: YES), and the authentication keys do not match (S121: NO), the authentication management record of the target router, respectively Is set to “locked” (S127). An error is transmitted to the target terminal and the target router (S129). The target terminal that has received the error in step S129 is notified of the failure to establish the VPN session. After execution of step S125 or step S129, the process returns to step 101. Even when the center authentication request has not been received (S101: YES), the process returns to step 101.

  In the present embodiment, the authentication key included in the authentication management record of the VPN router 8 and the authentication key received from the VPN router 8 both match with “qececsz”. Therefore, the server 3 that has received the authentication key transmits a session establishment instruction to the VPN router 8 (see T6 in FIG. 7), and transmits an authentication success notification to the mobile terminal 7 (see T7 in FIG. 7). In the portable terminal 7 that has received the authentication success notification, the establishment success of the VPN session is notified.

  As shown in FIGS. 9 and 10, in the VPN connection process, it is determined whether or not an error has been received after the execution of step S61 (S63). If no error has been received (S63: NO), it is determined whether a session establishment instruction has been received (S65). When a session establishment instruction is received (S65: YES), a VPN connection destination is specified (S67). Specifically, referring to the connection destination management table 120, service information is read from a record including the address of the target terminal (that is, the connection destination management record of the target terminal). Based on this service information, the provider address and certificate corresponding to the service ID included in the VPN connection request are specified.

  A VPN session for connecting the target terminal and the service providing device is established by a known VPN session establishment process (S69). When the VPN session is established, the session state included in the session management record of the target terminal is set to “VPN communication in progress” (S71). After execution of step S71, it is determined whether a VPN end instruction has been received (S73). The VPN end instruction is a signal transmitted from the target terminal to the target router when the user instructs the end of VPN communication at the target terminal.

  When the VPN termination instruction is received (S73: YES), the VPN session connecting the target terminal and the service providing device is disconnected by a known VPN session disconnection process (S75). When the VPN session is disconnected, the session state included in the session management record of the target terminal is set to “idle” (S77), and the VPN connection process is terminated.

  If the VPN end instruction has not been received (S73: NO), the process returns to step S73. If the session establishment instruction has not been received (S65: NO), the process returns to step S63. When an error is received (S63: YES), it indicates that the server 3 has failed in center authentication or has timed out. Therefore, the session state included in the session management record of the target terminal is set to “locked” (S79), and the VPN connection process is terminated.

  In this embodiment, the connection destination management record of the mobile terminal 7 is registered in the connection destination management table 120, and includes service information related to the file providing service of the PC 2 (see FIG. 4). Therefore, the VPN router 8 that has received the session establishment instruction establishes a session for connecting the mobile terminal 7 and the PC 2 by communication control performed with the VPN router 5 (see T8 in FIG. 7). As shown in FIG. 13, in the session management record of the mobile terminal 7, the session state is updated from “Waiting for authentication” to “VPN communication in progress”. As a result, the portable terminal 7 and the PC 2 can execute VPN communication via the VPN router 5 and the VPN router 8 (see T9 in FIG. 7). That is, the portable terminal 7 can receive the file providing service of the PC 2 via the VPN.

  As described above, according to the present embodiment, the VPN router 8 that has received the VPN connection request from the mobile terminal 7 generates and stores an authentication key, and sends a center authentication instruction including the authentication key to the mobile terminal 7. Send. The mobile terminal 7 that has received the center authentication instruction transmits a center authentication request including an authentication key to the server 3 via the VPN router 8. The server 3 that has received the center authentication request requests the VPN router 8 for the authentication key of the portable terminal 7 and acquires the authentication key stored in the VPN router 8. When the authentication key received from the mobile terminal 7 matches the authentication key acquired from the VPN router 8, the server 3 transmits a session establishment instruction to the VPN router 8. The VPN router 8 that has received the session establishment instruction establishes a VPN session for connecting the mobile terminal 7 and the PC 2. Thereby, the user of the portable terminal 7 can easily access the PC 2 from the external environment via the VPN, and can limit the VPN connection target to a regular terminal device.

  Specifically, in the VPN router 8, regular terminal devices are managed by the session management table 110. When the VPN router 8 receives a VPN connection request from an unauthorized terminal device, the VPN router 8 rejects the establishment of the VPN session (S31: NO). In the server 3, regular VPN routers are managed by the authentication information management table 130. When the server 3 receives the center authentication request from the terminal device connected to the unauthorized VPN router, the server 3 rejects the establishment of the VPN session (S103: NO).

  Therefore, the VPN connection target to the LAN 4 of the head office can be limited to a regular terminal device connected to a regular VPN router. For example, it is possible to prevent a VPN session from being established in an unauthorized terminal device connected to the VPN router 8. It is possible to prevent a VPN session from being established in the mobile terminal 7 connected to an unauthorized VPN router.

  The server 3 determines whether or not the authentication key received from the target router matches the authentication key received from the target terminal (S121). Thereby, the server 3 can specify correctly whether the object terminal and the terminal device connected to the object router are the same. During the execution of the process related to the establishment of the VPN session, for example, even when a third party performs a replacement or unauthorized operation of the mobile terminal 7 or the VPN router 8, the establishment of the VPN session can be restricted.

  In the server 3, when the device authentication fails (S109: NO) or the authentication keys do not match (S121: NO), the session state is set to “lock” (S127), and an error is transmitted to the target router. (S129). When the center authentication request is received from the target terminal connected to the target router whose session state is set to “locked”, the process returns to step S101 (S105: NO, S129), and the VPN session is not established. Thereby, the possibility that a VPN session is established for a terminal device connected to an unauthorized VPN router that has failed in authentication can be reduced.

  In the VPN router 8, when the local authentication fails (S37: NO) or when an error is received from the server 3 (S63: YES), the session state is set to “locked” (S49, S79). When a VPN connection request is received from the target terminal whose session state is set to “locked”, the VPN connection process is terminated (S33: NO, S51), and thus the VPN session is not established. This can reduce the risk of establishing a VPN session for an unauthorized terminal device that has failed authentication.

  In the server 3, when a timeout occurs (S117: YES), the session state is set to “locked” (S127), and an error is transmitted to the target router (S129). In the VPN router 8, when a timeout occurs (S55: YES) or an error is received from the server 3 (S63: YES), the session state is set to “locked” (S57, S79). For example, when a third party replaces the portable terminal 7 or the VPN router 8 or performs an illegal operation, a process relating to the establishment of the VPN session is delayed, and the timeout may occur as described above. Therefore, the possibility that a VPN session is established for an unauthorized terminal device that has timed out can be reduced.

  In the server 3, when a timeout occurs (S117: YES), the process returns to step S101. In the VPN router 8, when a timeout occurs (S55: YES) or when an error is received from the server 3 (S63: YES), the VPN connection process is terminated. That is, when a timeout occurs, the process ends without establishing a VPN session. Therefore, it is possible to suppress a delay in processing related to establishment of a VPN session, and it is possible to reduce a possibility that an unauthorized operation by a third party intervenes.

  In the VPN router 8, local authentication (S35) using the terminal ID and password is executed. The server 3 performs center authentication (S121) using an authentication key. That is, since authentication processing using different authentication information is executed by different devices, security can be improved. Furthermore, when the local authentication fails (S37: NO), the process ends without generating an authentication key, so that the process for establishing the VPN session can be speeded up.

  For example, when establishing a VPN session for connecting the portable terminal 7 and the PC 2, the user only needs to set a terminal ID and a password on the portable terminal 7. Therefore, the user can easily access the LAN 4 of the head office by VPN from the external environment.

  In the above embodiment, the portable terminal 7 corresponds to “one terminal device” of the present invention. The PC 2 corresponds to “another terminal device” of the present invention. The CPU 81 executing step S39 corresponds to the “authentication information generating unit” of the present invention. The CPU 81 executing step S43 corresponds to the “first authentication information transmitting unit” of the present invention. The flash memory 84 corresponds to the “authentication information transmitting unit” and the “first authentication information storage unit” of the present invention. The CPU 81 executing step S15 corresponds to the “authentication request relay unit” of the present invention. The CPU 81 executing step S59 corresponds to the “second authentication information transmitting unit” of the present invention. The CPU 81 executing step S69 corresponds to the “session establishment means” of the present invention. The CPU 81 executing step S47 corresponds to the “elapsed time measuring means” of the present invention. The session management table 110 corresponds to the “status information storage unit” and the “second authentication information storage unit” of the present invention. The CPU 81 executing step S45 corresponds to the “state setting unit” of the present invention. The CPU 81 executing step S57 corresponds to the “state changing unit” of the present invention. The CPU 81 executing step S35 corresponds to the “terminal authentication unit” of the present invention. The connection destination management table 120 corresponds to the “address storage unit” of the present invention. The CPU 81 executing step S67 corresponds to the “address specifying means” of the present invention.

  The CPU 31 executing step S113 corresponds to the “information request transmitting unit” of the present invention. The CPU 31 executing step S121 corresponds to the “session authentication unit” of the present invention. The CPU 31 executing step S123 corresponds to the “establishment instruction transmission unit” of the present invention. The program stored in the ROM 82 corresponds to the “communication program” of the present invention. Step S39 corresponds to the “authentication information generation step” of the present invention. Step S43 corresponds to the “first authentication information transmission step” of the present invention. Step S41 corresponds to the “authentication information storage step” of the present invention. Step S15 corresponds to the “authentication request relay step” of the present invention. Step S59 corresponds to the “second authentication information transmission step” of the present invention. Step S69 corresponds to the “session establishment step” of the present invention.

  In addition, this invention is not limited to the said embodiment, The change in the range which does not change the summary of invention is possible. In the above embodiment, the user inputs the terminal ID and the password with the mobile terminal 7. Instead, at least one of the terminal ID and the password may be registered in the mobile terminal 7 in advance. In this case, for example, the terminal ID can be automatically set in the VPN connection request transmitted from the mobile terminal 7.

  In the above embodiment, only the session management record of the mobile terminal 7 is registered in the session management table 110, but a plurality of session management records may be registered in the session management table 110. For example, when there is a possibility that the VPN router 8 is shared by a plurality of terminal devices, a session management record for each terminal device may be registered in the session management table 110.

  In the above embodiment, only the connection destination management record of the portable terminal 7 is registered in the connection destination management table 120, but a plurality of connection destination management records may be registered in the connection destination management table 120. For example, when there is a possibility that the VPN router 8 is shared by a plurality of terminal devices, a connection destination management record for each terminal device may be registered in the connection destination management table 120. The connection destination management record may include a plurality of service information. For example, when there is a possibility that the mobile terminal 7 is provided with various services, service information for each service may be set in the connection destination management record.

  In the above embodiment, only the authentication management record of the VPN router 8 is registered in the authentication information management table 130, but a plurality of authentication management records may be registered in the authentication information management table 130. For example, when there are a plurality of regular VPN routers, an authentication management record for each VPN router may be registered in the authentication information management table 130. When the VPN router 8 is shared by a plurality of terminal devices, it is preferable that the authentication management record of the VPN router 8 is registered in the authentication information management table 130 for each terminal.

  In the above embodiment, only the mobile terminal 7 is connected to the VPN router 8, but a plurality of terminal devices may be connected to the VPN router 8. In this case, a VPN connection process (see FIGS. 9 and 10) is executed for each terminal device, so that a VPN session can be established for each terminal device.

1 Communication system 2 PC
3 Server 4 LAN
5 VPN router 6 Internet 7 Mobile terminal 8 VPN router 31 CPU
34 HDD
81 CPU
82 ROM
83 RAM
84 Flash memory 85 LAN interface 86 Wireless LAN interface 87 WAN interface 88 USB interface 89 LED display unit 110 Session management table 120 Connection management table 130 Authentication information management table

Claims (8)

A VPN router that is locally connected to one terminal device and connected to a server that manages a VPN session with another terminal device via a network,
An authentication information generating means for generating first authentication information unique to the one terminal device when receiving a connection request which is an instruction to request connection to the other terminal device from the one terminal device;
First authentication information transmitting means for transmitting the first authentication information generated by the authentication information generating means to the one terminal device;
First authentication information storage means for storing the first authentication information generated by the authentication information generation means;
An instruction that is sent from the one terminal device to the server and requests authentication of whether or not the one terminal device is an establishment target of the VPN session, and includes the authentication including the first authentication information An authentication request relay means for relaying the request;
Second authentication information transmission for transmitting the first authentication information stored in the first authentication information storage means to the server when an information request that is an instruction to request the first authentication information is received from the server Means,
Session establishment means for establishing the VPN session for connecting the one terminal device and the other terminal device on the network when receiving an instruction to establish the VPN session from the server. VPN router to do. For the first authentication information stored in the first authentication information storage means, an elapsed time measuring means for measuring an elapsed time from the time point generated by the authentication information generating means;
Status information storage means for storing status information indicating the state of the one terminal device related to the VPN session;
State setting means for setting the status information to a first state when the authentication information is generated by the authentication information generating means;
When the elapsed time is equal to or longer than a predetermined time, the status information includes a status change unit that changes the status information from the first status to the second status,
When the status information is in the first state at the time when the information request is received from the server, the second authentication information transmitting means executes transmission of the first authentication information, while the status information is The VPN router according to claim 1, wherein in the second state, the transmission of the first authentication information is stopped. The connection request includes second authentication information set in the one terminal device,
Second authentication information storage means for storing the second authentication information registered in advance in association with the one terminal device;
If the connection request is received from the one terminal device, whether or not the second authentication information included in the connection request matches the second authentication information stored in the second authentication information storage unit Terminal authentication means for determining whether or not
The authentication information generating unit generates the first authentication information when the terminal authentication unit determines that the second authentication information matches, while the terminal authentication unit does not match the second authentication information. The VPN router according to claim 1 or 2, wherein when it is determined, the generation of the first authentication information is stopped. The connection request includes information indicating a service that the one terminal device requests to provide,
Address storage means for storing an address of the other terminal device capable of providing the service;
Based on information indicating the service included in the connection request, the one terminal device specifies the service to be provided, and the address of the other terminal device capable of providing the specified service is determined. Address specifying means for specifying with reference to the address storage means,
4. The VPN router according to claim 1, wherein the session establishing unit establishes the VPN session based on the address specified by the address specifying unit. 5. The first authentication information transmitting means transmits identification information unique to the VPN router to the one terminal device together with the first authentication information,
The VPN router according to claim 1, wherein the authentication request includes the identification information.   The VPN router according to claim 1, wherein the first authentication information is an authentication key that is randomly generated every time the connection request is received. A communication system including a server for managing a VPN session, a local connection with one terminal device, and a VPN router connected to another terminal device and the server via a network,
The VPN router
When receiving a connection request, which is an instruction to request connection to the other terminal device, from the one terminal device, authentication information generating means for generating authentication information unique to the one terminal device;
First authentication information transmitting means for transmitting the authentication information generated by the authentication information generating means to the one terminal device;
Authentication information storage means for storing the authentication information generated by the authentication information generation means;
An instruction transmitted from the one terminal device to the server to request authentication of whether or not the one terminal device is an establishment target of the VPN session, and an authentication request including the authentication information Authentication request relay means for relaying;
A second authentication information transmission unit that transmits the authentication information stored in the authentication information storage unit to the server when an information request that is an instruction to request the authentication information is received from the server;
Session establishment means for establishing the VPN session for connecting the one terminal device and the other terminal device on the network when receiving an instruction to establish the VPN session from the server;
The server
An information request transmitting means for transmitting the information request to the VPN router when the authentication request is received from the one terminal device;
Session authentication means for determining whether or not the authentication information included in the authentication request matches the authentication information received from the VPN router when the authentication information is received from the VPN router;
A communication system comprising: an establishment instruction transmission means for transmitting the establishment instruction to the VPN router when the session authentication means determines that the authentication information matches. To a computer that is a VPN router that is locally connected to one terminal device and connected to a server that manages a VPN session with another terminal device via a network,
An authentication information generation step of generating authentication information unique to the one terminal device when receiving a connection request that is an instruction for requesting connection to the other terminal device from the one terminal device;
A first authentication information transmission step of transmitting the authentication information generated by the authentication information generation step to the one terminal device;
An authentication information storage step of storing the authentication information generated by the authentication information generation step in a storage device;
An instruction transmitted from the one terminal device to the server to request authentication of whether or not the one terminal device is an establishment target of the VPN session, and an authentication request including the authentication information An authentication request relay step to relay;
A second authentication information transmission step of transmitting the authentication information stored in the information device to the server when receiving an information request that is an instruction to request the authentication information from the server;
A session establishment step of establishing the VPN session for connecting the one terminal device and the other terminal device on the network when the VPN session establishment instruction is received from the server; Communication program.

Images