JP2013115778A - Relay server and relay communication system - Google Patents

Abstract

PROBLEM TO BE SOLVED: To provide a relay server that enables a relay communication system allowing a user to know a flow of communication performed via a routing session.SOLUTION: A first relay server located in a first LAN stores a first routing target address and a second routing target address. The first relay server stores a notification condition being a condition for notifying of packet reception. The first relay server sends the first routing target address to a second relay server and receives a second routing target address from the second relay server to establish a routing session with the second relay server. The first relay server controls packet routing by using the exchanged routing target address. Upon receiving a packet from the routing session or the first LAN, the first relay server determines whether the notification condition is met and sends notification if the notification condition is met.

Description

  The present invention mainly relates to a relay server that enables communication between devices connected to different LANs (Local Area Networks).

  2. Description of the Related Art Conventionally, a communication technique called a virtual private network (VPN) that performs communication between LANs installed at physically separated locations is known. In the example shown in Patent Document 1, a relay server, a communication terminal, and the like are connected to each of a plurality of LANs installed at physically separated positions. A communication terminal can transmit a packet to a communication terminal connected to another LAN using this VPN. Specifically, a packet transmitted by a communication terminal is first sent to a relay server in the same LAN. This relay server transmits (transfers) the packet to the relay server in the same LAN as the destination communication terminal via the Internet. The relay server that receives this packet transmits (transfers) the packet to the destination communication terminal.

  By using this VPN, other remote LANs can be used as if they were directly connected networks.

JP 2010-268312 A

  By the way, when performing communication using VPN, there is a possibility that unauthorized access is performed from an unregistered device. This unauthorized access leaks information in the worst case. Further, even when accessing from a registered device, it is not preferable in terms of information management that, for example, information such as personal information or a trade secret is acquired by an unauthorized user.

  Thus, when communicating using VPN, the structure which can grasp | ascertain the flow of communication was desired from a viewpoint of security.

  The present invention has been made in view of the above circumstances, and a main object thereof is to provide a relay server capable of constructing a relay communication system capable of grasping the flow of communication performed via a routing session.

Means and effects for solving the problems

  The problems to be solved by the present invention are as described above. Next, means for solving the problems and the effects thereof will be described.

  According to a first aspect of the present invention, a relay server having the following configuration is provided. That is, the relay server includes an address filter information storage unit, a notification condition storage unit, and a control unit. The address filter information storage unit is located in the first LAN (the relay server) is capable of transferring packets, and the first routing target address that is the address of the first routing target device and the second relay server located in the second LAN Stores the second routing target address that is the address of the second routing target device that can transfer the packet. The notification condition storage unit stores a notification condition that is a condition for notifying that a packet has been received. The control unit transmits the first routing target address to the second relay server, receives the second routing target address from the second relay server, and establishes a routing session with the second relay server. When receiving a packet destined for the second routing target device from the first routing target device, the control unit transfers the packet to the second relay server via the routing session. When receiving a packet destined for the first routing target address from the routing session, the control unit transfers the packet to the destination first routing target device. The control unit determines whether or not the notification condition is satisfied when a packet is received from the routing session or the first LAN, and performs notification when it is determined that the notification condition is satisfied.

  Thereby, the user can know that there existed communication which satisfy | fills notification conditions among the communications performed by a relay communication system. Therefore, the user can grasp the communication to which attention should be paid from the viewpoint of security, such as access from an unregistered terminal. Therefore, the user can prevent information leakage. In addition, even if information is leaked, the user can immediately take action to prevent the situation from expanding.

  In the relay server, it is preferable that the notification condition stored in the notification condition storage unit and the notification condition stored in the second relay server are equal.

  As a result, the conditions under which the notification is performed can be made the same in the relay communication system, so that unified management can be performed. In addition to the relay server of the present invention, other relay servers monitor access. Therefore, packets that do not reach the relay server of the present invention can be monitored.

  In the relay server, the control unit preferably transmits the notification condition together with the first routing target address to the second relay server.

  Thereby, compared with the case where notification conditions are transmitted independently, communication between relay servers can be simplified.

  In the relay server, when it is determined that the notification condition is satisfied, the control unit preferably notifies both the terminal belonging to the first LAN and the terminal belonging to the second LAN.

  As a result, it is possible to notify more terminals that there is an access from an unregistered terminal. Therefore, for example, even when the installation location of the first LAN is unattended or when there is no user who can respond to the notification at the installation location of the first LAN, it is possible to respond immediately to the notification.

  In the relay server, when the control unit determines that the notification condition is satisfied and makes a notification, the control unit preferably records the notification content.

  As a result, the user or the like can analyze the recorded past notification contents and deal with a suspicious access or the like based on the analysis result.

  According to the 2nd viewpoint of this invention, the relay communication system of the following structures is provided. That is, the relay communication system includes a first relay server and a second relay server. The relay server located in the first LAN includes an address filter information storage unit, a notification condition storage unit, and a control unit. The address filter information storage unit includes a first routing target address that is an address of a first routing target device to which the first relay server can transfer a packet, and the second relay server located in a second LAN transfers the packet. And a second routing target address that is an address of a possible second routing target device. The notification condition storage unit stores a notification condition that is a condition for notifying that a packet has been received. The control unit transmits the first routing target address to the second relay server, receives the second routing target address from the second relay server, and establishes a routing session with the second relay server. When receiving a packet destined for the second routing target device from the first routing target device, the control unit transfers the packet to the second relay server via the routing session. When receiving a packet destined for the first routing target address from the routing session, the control unit transfers the packet to the destination first routing target device. The control unit determines whether or not the notification condition is satisfied when a packet is received from the routing session or the first LAN, and performs notification when it is determined that the notification condition is satisfied.

  Thereby, the user can know that there existed communication which satisfy | fills notification conditions among the communications performed by a relay communication system. Therefore, the user can grasp the communication to which attention should be paid from the viewpoint of security, such as access from an unregistered terminal. Therefore, the user can prevent information leakage. In addition, even if information is leaked, the user can immediately take action to prevent the situation from expanding.

BRIEF DESCRIPTION OF THE DRAWINGS Explanatory drawing which shows the whole structure of the relay communication system which concerns on one Embodiment of this invention. The functional block diagram of a relay server. The figure which shows the content of relay group information. The figure which shows the content of relay server information. The figure which shows the content of client terminal information. The figure which shows the content of VPN group information. The figure which shows the content of the address filter information registered beforehand in each relay server. The figure which shows the content which an address filter information storage part memorize | stores after VPN construction. The figure which shows the content of notification conditions. The figure which shows the content of the notification log. The flowchart which shows the setting performed to a relay server beforehand. The flowchart which shows the process which produces a VPN group. The flowchart which shows the process which builds VPN. The flowchart which shows the process which builds VPN. The flowchart which shows routing control when a packet is received from LAN. The flowchart which shows routing control when a packet is received from a routing session.

  Next, embodiments of the present invention will be described with reference to the drawings. First, an overview of the relay communication system 100 of the present embodiment will be described with reference to FIG. FIG. 1 is an explanatory diagram showing the overall configuration of the relay communication system 100 according to the present embodiment.

  As shown in FIG. 1, this relay communication system 100 includes a plurality of LANs 10, 20, and 30 connected to a wide area network (WAN) 80. Each of the LANs 10, 20, and 30 is a relatively small network constructed in a limited place. Further, the LANs 10, 20, and 30 are arranged at locations that are physically separated from each other. In the present embodiment, the Internet is used as the WAN 80.

  Each LAN will be specifically described below. As shown in FIG. 1, a relay server (second relay server) 1, operation PCs 11 and 12 as second routing target devices, and a client terminal 13 are connected to a LAN (second LAN) 10. . A relay server 2, an operation PC 21, and a client terminal 22 are connected to the LAN 20. Connected to the LAN (first LAN) 30 are a relay server (first relay server) 3, target terminals 31, 32 and 33 as first routing target devices, and a client terminal 34.

  Since each of the relay servers 1, 2, and 3 is connected not only to the LANs 10, 20, and 30 but also to the WAN 80, it can communicate with devices connected to the same LAN and is also arranged in another LAN. It is also possible to communicate with the relay server. The operation PCs 11, 12, and 21 are personal computers that are operated by an operator, for example. The target terminals 31, 32, and 33 are personal computers or file servers. For example, the operator operates the operation PC 11 or the like to request predetermined data from the target terminal 31 or the like, and the target terminal 31 It is assumed that the stored content of is updated. The client terminals 13, 22, and 34 are configured by, for example, a personal computer, and can communicate with each other via the relay servers 1, 2, and 3 to which the client terminals 13, 22, and 34 belong.

  Next, a detailed configuration of the relay servers 1, 2, and 3 will be described with reference to FIG. FIG. 2 is a functional block diagram of the relay server 3. Since the relay server 3 has substantially the same configuration as the relay servers 1 and 2, the relay server 3 will be mainly described below.

  As illustrated in FIG. 2, the relay server 3 includes a storage unit 50, a control unit 60, and an interface unit 70.

  The interface unit 70 performs communication with terminals in the LAN 10. The interface unit 70 performs communication with the WAN 80. The interface unit 70 performs an appropriate process on the packet received from the LAN 30 or the WAN 80 and outputs the packet to the control unit 60.

  The control unit 60 is a CPU having control and calculation functions, for example, and can execute various processes by a program read from the storage unit 50. The control unit 60 can control various communications according to protocols such as TCP / IP, UDP, and SIP. Specifically, the control unit 60 determines a destination of the received packet based on information indicated by the packet and information stored in the storage unit 50, and transmits the packet to the determined destination. Moreover, the control part 60 can update the memory content of the memory | storage part 50 based on the information received from the other terminal.

  The storage unit 50 is composed of, for example, a hard disk or a nonvolatile RAM, and can store various data. The storage unit 50 includes a relay group information storage unit 51, a relay server information storage unit 52, a client terminal information storage unit 53, a VPN group information storage unit 54, an address filter information storage unit 55, and a notification condition storage unit 56. And a notification log storage unit 57. Hereinafter, the contents stored in the storage unit 50 will be described with reference to FIGS. FIGS. 3 to 10 are diagrams mainly showing the contents stored in the storage unit 50 of the relay server 3.

  The relay group information storage unit 51 stores relay group information indicating a relay group and a relay server that constitutes the relay group.

  As shown in FIG. 3, in the relay group information, a group tag and a site tag of a child element whose parent element is the group tag are described. In the group tag, group information 511 related to the relay group is described. As the group information 511, relay group identification information (“id”), last update time (“lastmod”), and relay group name (“name”) are described. In the site tag, group configuration information 512 related to the relay server that configures the relay group is described. In this group configuration information 512, identification information (“id”) of the relay server is described. Further, additional relay groups can be created. In this case, unique identification information different from other relay groups is given to the new relay group. As a result, settings such as data exchange only within a specific relay group are possible.

  This relay group information is shared between the relay servers 1, 2, and 3 that constitute the relay group. When a process for changing a relay group is performed in a certain relay server, the fact is transmitted to the other relay server and the relay group information is updated. In this way, relay group information is dynamically shared.

  The relay server information storage unit 52 stores relay server information indicating an outline of a relay server that performs relay communication and a client terminal that belongs to the relay server.

  In the relay server information shown in FIG. 4, a site tag described for each relay server and a node tag of a child element whose parent element is the site tag are described. In the site tag, server information 521 regarding the relay server 1 is described. As the server information 521, relay server identification information (“id”), a relay server name (“name”), and activation information (“stat”) are described. When the content of “stat” is “active”, it indicates that the relay server is logged in to the relay communication system 100, and when stat is blank, it indicates that the log-off is being performed. In a node tag that is a child element of the site tag, affiliation information 522 indicating a client terminal belonging to the relay server is described. The belonging information 522 includes the name of the relay group to which it belongs (“group”), the identification information of the client terminal (“id”), the name of the client terminal (“name”), and the identification information of the relay server to which it belongs. ("Site"). When the client terminal is not logged in to the relay communication system 100, “site” is blank.

  Note that the communication by the relay group is performed as follows based on the relay group information and the relay server information. For example, when a packet is transmitted from the client terminal 13 to the client terminal 22, the client terminal 13 first transmits the packet to the relay server 1 that is a relay server to which the client terminal 13 is connected. The relay server capable of exchanging packets can be grasped based on the above relay group information, and the identification information of the client terminal belonging to the relay server and the connection possibility can be determined based on the above relay server information. I can grasp it. Based on these pieces of information, the relay server 1 transfers the packet to the relay server 2 that is a relay server to which the client terminal 22 is connected. The relay server 2 that has received this packet transfers the packet to the client terminal 22. Thus, relay communication can be performed between the client terminals 13 and 22.

  As with the relay group information, the relay server information is shared between the relay servers 1, 2, and 3 that constitute the relay group. When a process for changing the relay server information is performed in a certain relay server, the fact is transmitted to the other relay server and the relay server information is updated. In this way, the relay server information is dynamically shared.

  The client terminal information storage unit 53 stores client terminal information that is detailed information about the client terminal. Note that the relay servers 1, 2, and 3 store only client terminal information related to client terminals belonging to the relay server. Since the client terminal 34 belongs to the relay server 3, only the client terminal information about the client terminal 34 is stored in the client terminal information storage unit 53 provided in the relay server 3.

  The client terminal information stored in the client terminal information storage unit 53 of the relay server 3 is shown in FIG. Similarly, the client terminal information stored in the relay server 1 is shown in FIG. 5A, and the client terminal information stored in the relay server 2 is shown in FIG. 5B.

  In the client terminal information shown in FIG. 5, a node tag is described. The node tag includes a private IP address (“addr”) of the client terminal, a name of the relay group to which the client terminal belongs (“group”), identification information (“id”), a name (“name”), a relay A password for logging in to the server (“pass”) and port information (“port”) are described.

  The VPN group information storage unit 54 stores VPN group information, which is information related to a VPN group configured by a relay server and a device selected as a routing point from the client terminal (hereinafter referred to as a routing device). ing. By establishing a routing session between routing devices belonging to the same VPN group, communication using VPN can be started.

  In the VPN group information shown in FIG. 6, a vnet tag is described. In this vnet tag, VPN group basic information 541, routing point information 542, and routing session information 543 are described. The VPN group basic information 541 includes a relay group name (“group”) to which the VPN group belongs, a VPN group identification information (“id”), a last update time (“lastmod”), and a VPN group name. ("Name"). The routing point information 542 describes identification information of a routing device that performs routing when communication is performed between VPN groups. In the example of FIG. 6, a relay server 1 and a relay server 3 are described as routing devices. The routing session information 543 describes routing devices connected to each other in the VPN group. In the routing session information 543, the routing device first performs communication control (“sp (start point)”) in the routing session establishment process for establishing the VPN in the VPN group and starting communication, and its communication. It is determined separately for the side to be controlled “ep (end point)”. In the following description, a routing device that first performs communication control for establishing a routing session may be referred to as a “start point”, and a routing device that receives the communication control may be referred to as a “end point”.

  It can be seen from the VPN group information shown in FIG. 6 that the VPN group (VPN-GROUP 1) is composed of the relay server 1 and the relay server 3. It can also be seen that at the start of this VPN group, communication control for establishing a routing session from the relay server 3 to the relay server 1 is performed.

  This VPN group information is also shared between the relay servers 1 and 3 belonging to the same VPN group, like the relay server information and the relay group information. When a process for changing VPN group information is performed in a certain relay server, the fact is transmitted to other relay servers belonging to the same VPN group, and the VPN group information is updated. In this way, VPN group information is dynamically shared. The process for creating this VPN group will be described later.

  The address filter information storage unit 55 stores address filter information that is information used when performing routing control using VPN. The address filter information storage unit 55 stores information (address filter information of the relay server 3) indicating a device (routing target device) to which the relay server 3 itself can directly transmit a packet before the VPN is constructed. The address filter information includes the address of the routing target device (routing target address) and the name of the routing target device.

  FIG. 7C shows an example of address filter information registered in advance in the relay server 3 itself. In this example, it is described that devices to which the relay server 3 can directly transmit packets are the target terminals 31, 32, and 33. 7A shows the address filter information registered in advance in the relay server 1, and FIG. 7B shows the address filter information registered in advance in the relay server 2.

  As described above, the address filter information storage unit 55 of the relay server 3 stores only the address filter information shown in FIG. 7C before constructing the VPN. Then, when establishing a routing session with the relay server 1, for example, the relay server 3 transmits address filter information (FIG. 7C) registered in advance to the relay server 1 and also from the relay server 1. Address filter information (FIG. 7A) is received. Then, the relay server 3 stores the address filter information of the relay server 1 in the address filter information storage unit 55 in association with the identification information of the relay server 1.

  As a result, the contents shown in FIG. 8 are stored in the address filter information storage unit 55 of the relay server 3. The same information is also stored in the address filter information storage unit 55 of the relay server 1. Then, the relay servers 1 and 3 perform routing control based on the acquired address (detailed control will be described later). Hereinafter, the routing target address included in the address filter information of the relay server 3 is referred to as a first routing target address, and the routing target address included in the address filter information of the relay server 1 is referred to as a second routing target address. is there.

  The notification condition storage unit 56 stores notification conditions as shown in FIG. The notification condition defines whether to notify the user that a packet has been received. That is, when the relay server 3 receives a packet, the relay server 3 determines whether the received packet satisfies the notification condition, and notifies the user when it determines that the notification condition is satisfied.

  Note that the relay server 3 transmits a notification condition to the relay server 1 when constructing a VPN with the relay server 1, for example. Then, the relay servers 1 and 3 monitor packets using the same notification conditions. In addition, when a packet is transmitted via both of the relay servers 1 and 3, only one of the notifications is performed in order to prevent duplication of notification.

  In the present embodiment, as shown in FIG. 9, a destination address, a transmission source address, a data amount, and a communication time are registered as condition items of the notification condition. In the destination address and the source address, an unregistered address (an address not described in the address filter information after the exchange) is registered in order to detect that there is an access from an unknown terminal. In the present embodiment, it is assumed that important information such as personal information and trade secrets is stored in the target terminal 33. Therefore, in order to grasp the access to the target terminal 33, the address of the target terminal 33 is also registered as a notification condition. Further, when the amount of data is large and when the communication time is long, unnecessary access may be performed, and thus it is registered as a notification condition.

  The notification log storage unit 57 records the notification log shown in FIG. The notification log is information that records the content of notification performed when the notification condition is satisfied. As shown in FIG. 10, the notification log includes a notification ID, a notification source, a notification time, a notification content, and the like. In the notification ID column, an ID for identifying the notification is described. In the notification source column, the routing device that made the notification is described. The notification time column describes the time at which the notification was made. In the notification content column, a condition item of the satisfied notification condition, a destination address, a transmission source address, and the like are described. In addition, when a packet is transmitted via both of the relay servers 1 and 3, it is assumed that one of the notification logs is created to prevent the notification logs from being duplicated.

  Next, preparation for performing communication using VPN will be described. First, the setting performed in advance on the relay server will be described with reference to FIG. 11, and the flow when creating a VPN group will be described with reference to FIG. FIG. 11 is a flowchart showing settings to be made to the relay server in advance. FIG. 12 is a flowchart showing processing for creating a VPN group. In the following, the relay server 3 is taken as an example, and the settings performed on the relay server 3 and the processing executed by the relay server 3 will be described. It is assumed that the process can be executed.

  The setting to be made in advance in the relay server 3 includes registration of address filter information of the relay server 3 (S101). This registration is performed by a user using the relay communication system 100 by inputting an address (first routing target address) of a device or the like designated as a routing target device and a name by a predetermined method. Here, it is assumed that the user has input the addresses and names of the target terminals 31, 32, and 33. The registered address filter information is stored in the address filter information storage unit 55.

  Next, the user registers the notification condition (S102). The notification conditions registered here are stored only in the notification condition storage unit 56 of the relay server 3.

  It is necessary to register address filter information for each routing device. Therefore, the user also inputs the routing target address to the relay servers 1 and 2 and registers the address filter information. On the other hand, in this embodiment, the notification condition registered in the relay server 3 is transmitted to another relay server. Therefore, registration of the notification condition by the user is performed only for the relay server 3.

  Hereinafter, the flow when creating a VPN group will be described. First, the user can display a VPN group setting screen by operating the client terminals 13, 22, 34, and the like. Here, a case where setting is performed using the client terminal 34 will be described. On the setting screen displayed on the client terminal 34, a plurality of relay groups to which the client terminal 34 belongs are displayed. The user selects a relay group for which a VPN group is to be constructed from the plurality of relay groups (S201).

  When a relay group is selected, a list of identification information of relay servers and client terminals that belong to the selected relay group and that can function as a routing point is displayed on the screen of the client terminal 34 (S202). Then, the user selects a relay server and a client terminal that function as a routing point in the VPN group to be constructed (S203). In this description, it is assumed that the relay server 1 and the relay server 3 are selected by the user.

  Then, based on the identification information of the selected relay server, the identification information of the routing point and the routing session information are created (S204). The VPN group information shown in FIG. 6 is created by adding VPN group identification information or the like to these pieces of information. The client terminal 34 transmits this VPN group information to the relay servers 1 and 3 belonging to the same VPN group (S205). Then, the relay servers 1 and 3 store the received VPN group information in the VPN group information storage unit 54. Thus, the VPN group construction process is completed.

  Next, a flow until communication using VPN is started in the constructed VPN group will be described with reference to FIGS. 13 and 14. FIG. 13 and FIG. 14 are flowcharts showing processing performed until communication using VPN is started.

  The user can display the constructed VPN group on the screen by operating the client terminal 13 or the operation PC 11 or the like. Then, by selecting an appropriate VPN group from the displayed VPN groups (S301), a process for constructing the VPN can be performed. In this description, an example will be described in which the relay server 3 performs the start process of the VPN group created above (a VPN group composed of the relay servers 1 and 3).

  The relay server 3 first reads out address filter information associated with itself (S302). The information read here is the content registered in S101 (the content shown in FIG. 7C). Next, the relay server 3 reads the routing points belonging to the selected VPN group (S303). Thereby, the relay server 1 is read based on the content of the VPN group information shown in FIG.

  Based on the relay server information, the relay server 3 first determines whether the relay server 1 is logged in (“stat” is active or blank) (S304). According to the relay server information shown in FIG. 4, since the relay server 1 is logged in, the relay server 3 transmits a VPN group start command together with the VPN group identification information to the relay server 1 (S305).

  When the relay server 3 receives a response from the relay server 1 in response to the start command (S306), the relay server 1 registers the relay server 1 as a routing point that is ready to construct a VPN (S307).

  Next, the relay server 3 determines whether there is another device belonging to the same VPN group (S308). Since the currently created VPN group is composed of only the relay server 1 and the relay server 3, there is no other device. If there is another device, the relay server 3 performs the processing of S304 to S307 this time for the device.

  Next, the relay server 3 extracts routing session information from the contents stored in the VPN group information storage unit 54 (S309 in FIG. 14). Then, the relay server 3 refers to the extracted routing session information, and determines whether or not a routing session starting from itself is described (S310). In the routing session information of FIG. 6, it is described that in the routing session to be established between the relay server 1 and the relay server 3, itself (the relay server 3) is the starting point.

  Therefore, the relay server 3 performs communication control for establishing a routing session with the relay server 1 (S311). When performing this communication control, as described above, the address filter information is exchanged (S312), and a notification condition is transmitted from the relay server 3 to the relay server 1 (S312). Accordingly, the contents shown in FIG. 8 are stored in the address filter information storage unit 55 of the relay servers 1 and 3. Further, the contents shown in FIG. 9 are stored in the notification condition storage unit 56 of the relay servers 1 and 3.

  As described above, in this embodiment, when a VPN is constructed, each routing device exchanges (acquires) address filter information with other routing devices. Therefore, it is possible to construct a VPN using the latest address filter information. it can. Therefore, even if the address filter information is changed in some routing devices at the stage before the VPN start, the VPN can be constructed and communication can be started with the change reflected in all the routing devices. Inconsistency in routing can be prevented, and reliability can be improved.

  In the present embodiment, the notification condition registered in the relay server 3 is transmitted to the relay server 1, so that it is not necessary to register the notification condition in the relay server 1. Furthermore, since the notification conditions of the relay server 3 and the relay server 1 can be made the same, unified management can be performed. Alternatively, the notification condition registered in the relay server 3 and the notification condition registered in the relay server 1 are exchanged in the same manner as the address filter information (so that the notification condition of the communication partner is added while leaving the own notification condition) ( Acquisition), it is possible to perform unified management for the entire relay communication system even if notification conditions are individually registered in each relay server.

  Next, the relay server 3 performs the process of S310 again. Since the currently created VPN group is composed of only the relay server 1 and the relay server 3, other routing sessions are not described in the VPN group information. Accordingly, the relay server 3 starts packet routing control (S313). If there is another routing session, the relay server 3 performs the processes of S311 and S312 again.

  Further, although not described in the flowchart of FIG. 14, even if there is no routing session that is the connection start point in S <b> 310 (when it is the routing end point), the routing device from the routing device that is the start point Under the communication control, routing session establishment processing and address filter information exchange are performed.

  Each routing device does not perform the initial communication control for establishing a routing session unless the routing session information indicates that it is the starting point. The routing session can be established with simple control.

  Next, control performed when the relay server 3 routes a packet will be described with reference to FIGS. 15 and 16. FIG. 15 is a flowchart showing the routing control performed by the relay server 3 when a packet is received from the LAN 30. FIG. 16 is a flowchart showing the routing control performed by the relay server 3 when a packet is received from the routing session.

  First, a process performed when the relay server 3 receives a packet from the LAN 30 will be described. The relay server 3 stands by until a packet is received from the LAN 30 (S401). When a packet is received from the LAN 30, first, it is determined whether or not the destination of the packet is the own device (relay server 3) (S402). The relay server 3 receives the packet when the destination of the packet is its own device (S403). On the other hand, if the destination of the packet is other than its own, the relay server 3 determines whether the notification setting is valid (S404). In the present embodiment, the notification condition is set in the relay server 3, so the notification setting is effective. Note that if the notification setting is not valid, the relay server 3 skips the following processes of S405 and S406.

  Next, the relay server 3 determines whether or not the received packet satisfies the notification condition (S405). If the notification condition is not satisfied, the following process of S406 is skipped. On the other hand, when the received packet satisfies the notification condition, the relay server 3 notifies a predetermined device in the LAN 10 and the LAN 30 (S406). This notification can be performed by e-mail, or may be notified to the user by displaying a message on a management screen or the like of the relay communication system. By confirming this notification, the user can grasp the communication performed using the VPN.

  Further, the relay server 3 creates a log of notification contents before and after making this notification, and stores it in the notification log storage unit 57 (S406). Note that the relay server 3 may not only store the notification content in the notification log storage unit 57 included in the own server, but also transmit the notification content to another relay server 1 and store the notification content in the notification log storage unit 57.

  Next, the relay server 3 compares the destination address of the received packet with the address filter information (see FIG. 8) (S407). When the destination address is not registered in the address filter information, the relay server 3 discards the packet (S408). On the other hand, when the destination address is registered in the address filter information, the relay server 3 transmits a packet to the routing session corresponding to the address filter information (S409). For example, when the destination address of the packet is (200.1.40.10), since this address is associated with the relay server 1 as shown in FIG. 8, the relay server 3 sends the packet to the relay server. Send to 1.

  By performing the processing as described above, it is possible to perform notification based on the notification condition and routing based on the address filter information for the packet received from the LAN 30.

  As shown in S408, the routing device does not transmit the packet to other routing devices when the destination address of the packet is not registered. Therefore, for example, when the relay server 1 performs the process of S408, the relay server 3 cannot detect that a packet whose destination address is unregistered (a packet to be notified) is transmitted. In this regard, in the present embodiment, not only the relay server 3 but also the relay server 1 is configured to perform notification under the same notification conditions, so that packet detection failure can be prevented and security can be improved.

  Next, processing performed when the relay server 3 receives a packet from the routing session will be described. The relay server 3 stands by until a packet is received from the routing session (S501). Then, when receiving the packet, the relay server 3 determines whether the notification setting is valid (S502). In the present embodiment, the notification condition is set in the relay server 3, so the notification setting is effective. Note that if the notification setting is not valid, the relay server 3 skips the processing of S503 and S504.

  Next, the relay server 3 determines whether or not the received packet satisfies the notification condition (S503). If the notification condition is not satisfied, the following process of S504 is skipped. On the other hand, when the received packet satisfies the notification condition, the relay server 3 notifies a predetermined device in the LAN 10 and the LAN 30 and stores the notification content in the notification log storage unit 57 (S504).

  Next, the relay server 3 compares the destination address of the received packet with the address filter information (see FIG. 8), and the packet destination address is registered in association with its own address filter information. It is determined whether or not there is (S505). When the destination address of the packet is registered in association with its own address filter information, the relay server 3 transfers the packet to the device (target terminals 31, 32, 33) indicated by the destination (S506).

  Further, when the destination address is not registered in association with the address filter information of the own device, the relay server 3 determines whether or not the destination address is registered in association with the address filter information of another routing device. (S507). When the destination address is registered in association with the address filter information of another routing device, the relay server 3 transmits a packet to the routing session corresponding to the address filter information (S508).

  On the other hand, when the destination address is not registered in the address filter information of another routing device, the relay server 3 discards the packet (S509).

  By performing the processing as described above, it is possible to perform notification based on the notification condition and routing based on the address filter information for the packet received from the routing session.

  In addition, by receiving notification from the relay server 3 (or the relay server 1), the user grasps that there is communication that the source address or destination address is an unregistered address, communication to the target terminal 33, and the like. can do. In particular, since a notification log is created in the present embodiment, the user can take action by referring to the notification log in consideration of past notification contents.

  Hereinafter, a method of using the notification log will be briefly described. For example, if there is frequent access from the same source address, there is a possibility that someone is trying to invade the VPN. Further, when the target terminal 33 is accessed more than necessary, unnecessary access may be performed. For example, by performing a predetermined response when the above is detected, it is possible to prevent information leakage.

  As described above, the relay server 3 of this embodiment includes the address filter information storage unit 55, the notification condition storage unit 56, and the control unit 60. The address filter information storage unit 55 stores the first routing target address and the second routing target address. The notification condition storage unit 56 stores a notification condition that is a condition for notifying that a packet has been received. The relay server 3 transmits the first routing target address to the relay server 1, receives the second routing target address from the relay server 1, and establishes a routing session with the relay server 1. When the relay server 3 receives a packet destined for the second routing target device from the first routing target device, the relay server 3 transfers the packet to the relay server 1 via the routing session. When the relay server 3 receives a packet destined for the first routing target address from the routing session, the relay server 3 transfers the packet to the destination first routing target device. The relay server 3 determines whether or not the notification condition is satisfied when a packet is received from the routing session or the LAN 30, and performs notification when it is determined that the notification condition is satisfied.

  Thereby, the user can know that there existed communication which satisfy | fills notification conditions among the communications performed using VPN. Therefore, the user can grasp the communication to which attention should be paid from the viewpoint of security, such as access from an unregistered terminal. Therefore, the user can prevent information leakage. In addition, even if information is leaked, the user can immediately take action to prevent the situation from expanding.

  In the present embodiment, the notification condition stored in the notification condition storage unit 56 of the relay server 3 is equal to the notification condition stored in the relay server 1.

  Thereby, since the conditions under which notification is performed can be made the same in the VPN group, unified management can be performed. Further, since the relay server 1 monitors access other than the relay server 3, packets that do not reach the relay server 3 can be monitored.

  In addition, the relay server 3 according to the present embodiment transmits a notification condition to the relay server 1 together with the first routing target address.

  Thereby, compared with the case where notification conditions are transmitted independently, communication between relay servers can be simplified.

  In addition, when it is determined that the notification condition is satisfied, the relay server 3 according to the present embodiment notifies both the terminal belonging to the LAN 30 and the terminal belonging to the LAN 10.

  As a result, it is possible to notify more terminals that there is an access from an unregistered terminal. Therefore, for example, even when the installation destination of the LAN 30 is unattended or when there is no user who can respond, a flexible response such that a user of another LAN 10 responds to the notification becomes possible.

  In addition, when the relay server 3 according to the present embodiment determines that the notification condition is satisfied and performs notification, the relay server 3 records the notification content.

  As a result, the user or the like can analyze the recorded past notification contents and deal with a suspicious access or the like based on the analysis result.

  The preferred embodiments and modifications of the present invention have been described above, but the above configuration can be modified as follows, for example.

  The notification method when the notification condition is satisfied is not limited to the above, and an appropriate method can be used. Further, the notification destination is not limited to both a device in the same LAN and a device in another LAN as in the above-described embodiment, and may be only one, for example.

  Packet monitoring may be performed only by the relay server 3 or may be performed using different notification conditions for the relay server 1 and the relay server 3.

  The notification condition may be other than the conditions shown in the above embodiment. For example, the time at which communication was performed may be added as a condition item. Further, the notification may be performed only when a plurality of conditions are satisfied. In addition, as a destination address or a source address of the notification condition, registration may be performed using not only individual addresses but also range-designated addresses (for example, addresses designated in segment units). The notification unit may transmit an e-mail from the relay server to a specific mail address, or may transmit notification information in a predetermined data format such as XML to a specific communication terminal in the LAN. However, notification may be made using a general-purpose network monitoring protocol such as SNMP.

  In the above configuration, the address filter information is exchanged almost simultaneously with the establishment of the routing session. On the other hand, the address filter information may be transmitted together with the transmission of the VPN group start command (S305) and the address filter information may be received together with the response (S306).

  In the above, only the relay server functions as a routing point. However, the client terminal may function as a routing point. Further, the number of routing points in the VPN group is not limited to two and may be three or more. One routing device may belong to a plurality of VPN groups.

  The format for storing the relay group information, relay server information, client terminal information, VPN group information, address filter information, etc. is not limited to the XML format, and each information can be stored in an appropriate format.

  Instead of the configuration of the above-described embodiment, an external server used for communication between each relay server may be installed on the Internet, and a communication may be performed by exhibiting a function as a SIP (Session Initiation Protocol) server. .

1 Relay server (second relay server)
3 Relay server (first relay server)
11, 12 Operation PC (second routing target device)
31, 32, 33 Target terminal (first routing target device)
10 LAN (second LAN)
30 LAN (first LAN)
55 Address Filter Information Storage Unit 56 Notification Condition Storage Unit 57 Notification Log Storage Unit 100 Relay Communication System

Claims (6)

A first routing target address that is an address of a first routing target device that is located in the first LAN and can transfer a packet, and an address of a second routing target device that can be transferred by a second relay server located in the second LAN An address filter information storage unit for storing the second routing target address,
A notification condition storage unit that stores a notification condition that is a condition for notifying that a packet has been received;
A control unit,
The controller is
A control for transmitting the first routing target address to the second relay server, receiving the second routing target address from the second relay server, and establishing a routing session with the second relay server;
When receiving a packet destined for the second routing target device from the first routing target device, transferring the packet to the second relay server via the routing session;
When receiving a packet destined for the first routing target address from the routing session, transferring the packet to the destination first routing target device;
Control for determining whether or not the notification condition is satisfied when a packet is received from the routing session or the first LAN, and performing notification when it is determined that the notification condition is satisfied;
The relay server characterized by performing. The relay server according to claim 1,
The relay server characterized in that the notification condition stored in the notification condition storage unit is equal to the notification condition stored in the second relay server. The relay server according to claim 2,
The control unit transmits the notification condition together with the first routing target address to the second relay server. A relay server according to any one of claims 1 to 3,
When the control unit determines that the notification condition is satisfied, the control unit performs notification to both the terminal belonging to the first LAN and the terminal belonging to the second LAN. The relay server according to any one of claims 1 to 4, wherein
The said control part records the said notification content, when it determines with satisfy | filling the said notification conditions and performs notification, The relay server characterized by the above-mentioned. In the relay communication system including the first relay server and the second relay server,
The relay server located in the first LAN is
A first routing target address which is an address of a first routing target device to which the first relay server can transfer a packet, and a second routing target device to which the second relay server located in the second LAN can transfer a packet. An address filter information storage unit that stores a second routing target address that is an address;
A notification condition storage unit that stores a notification condition that is a condition for notifying that a packet has been received;
A control unit;
With
The controller is
A control for transmitting the first routing target address to the second relay server, receiving the second routing target address from the second relay server, and establishing a routing session with the second relay server;
When receiving a packet destined for the second routing target device from the first routing target device, transferring the packet to the second relay server via the routing session;
When receiving a packet destined for the first routing target address from the routing session, transferring the packet to the destination first routing target device;
Control for determining whether or not the notification condition is satisfied when a packet is received from the routing session or the first LAN, and performing notification when it is determined that the notification condition is satisfied;
A relay communication system.

Images