JP2013201618A - Information registration and acquisition system - Google Patents

Abstract

[PROBLEMS] To safely register a user's private information with a third party without preparing a database server with an authentication function and obtain the information via the Internet.
An information registering means 2 serving as a public server stores the IP addresses of database servers 1a and 1b functioning as a DNS server, which is a registration destination of its own host name, in a registration destination storage unit 7, and remotely The predetermined information 5 required for access is encrypted by the encryptor 6, and the registration function unit 8 sends a DNS registration request to the IP addresses of the servers 1 a and 1 b using the ciphertext as an apparent IP address of the host name of the information registration means 2. To do. The information acquisition unit 3 serving as a client stores the name resolution request destination in the name storage unit 9 with the same contents as the registration destination storage unit 7, and is acquired from the servers 1 a and 1 b by the resolver 10 when accessing the information registration unit 2. The apparent IP address is restored to the predetermined information 12 by the decoder 11.
[Selection] Figure 1

Description

  The present invention relates to an information registration and acquisition system for registering data in a predetermined database server by means of user information registration means via a network and acquiring data from the predetermined database server via the Internet by means of user information acquisition means. About.

  DDNS (Dynamic Updates in the Domain Name System specified in RFC2136) is used as an address resolution method used when a home PC or the like is disclosed as a Web server using a constant connection service. In DDNS, an IP (Internet Protocol) address, which is a string of characters and numbers that is difficult for humans to remember, is associated with a host name consisting of an easily understandable character string that is uniquely specified by the user, and managed by the DDNS server. A terminal that remotely accesses a home PC or the like from the outside can request the DDNS server for name resolution and obtain an IP address from the host name. When an IP address to be paid out such as a PC from a provider is dynamically assigned, there is a possibility that the IP address may be irregularly changed every time the PC or the like is connected to the Internet connection service network of the provider. By registering a newly assigned IP address to the DDNS server for each connection, remote access with the same host name is possible even if the IP address is changed (for example, Patent Documents 1 and 2).

JP 2011-108232 A JP 2004-120123 A

  However, DDNS is generally a service open to the Internet, and anyone who knows a host name can obtain an IP address registered in a DDNS server. Information related to an open database server such as a DDNS server in the case of private information that the user wants to conceal from the Internet but the user wants to acquire via the Internet, such as when acquiring the address of a VPN responder that is used privately It is not appropriate from the viewpoint of security to register. For such registration, a database server with a user authentication function had to be prepared.

  Therefore, the problem to be solved by the present invention is that a user's private information can be safely registered with a third party and prepared via the Internet without preparing a database server with an authentication function. That is.

  In order to solve the above-mentioned problems, the present invention basically uses a DDNS server as a database server, and a mechanism for securely registering user private information in a DDNS server with respect to a third party. By implementing it in the means, a database server with an authentication function is unnecessary. That is, the information registration means stores a registration destination in which its own host name is associated with the IP address of the DDNS server to be registered, encrypts predetermined information to be acquired by the information acquisition means, and A DNS registration request that makes the ciphertext look like an IP address corresponding to its own host name is transmitted to a predetermined DDNS server. For this reason, the host name assigned to the information registration unit and the apparent IP address are registered in the DDNS server, and the predetermined information itself is not registered. If it is private predetermined information, the user of the information registration means and the user of the information acquisition means are limited to those who have the same access authority. Therefore, the information registration means can be allowed to share information related to the registration destination and hold information for decoding into the predetermined information. That is, the information acquisition unit stores the same host name as the registration destination stored in the information registration unit, transmits a name resolution request for the stored host name by a resolver, and passes through a DNS (Domain Name System) to a predetermined value. The fake IP address registered in the DDNS server is acquired, and the fake IP address is decoded into the predetermined information. Therefore, the user of the information acquisition device can acquire the predetermined information via the Internet. Even if a third party who does not have an information acquisition device can request a name resolution of the host name of the information registration means from any terminal, it can only obtain a meaningless fake IP address and know the predetermined information. It is not possible. Therefore, the user's private information can be safely registered in the DDNS server with respect to a third party.

  The inquiry destination to which the resolver sends the name resolution request for the host name can be arbitrarily determined from among the name servers belonging to the DNS. Specifically, the route server and the route located at the top of the DNS Either a DNS server that manages a domain lower than the server or the predetermined DNS server may be used. When a predetermined DDNS server is used as an inquiry destination, it is possible to save a waiting time until a fake IP address is acquired, compared to a case where a query is recursively made from a root server to a lower DNS server.

  Specifically, the information acquisition unit stores information in which the host name and the IP address of the DDNS server are associated with the same registration destination as the information registration unit, that is, the information registration unit, and the resolver If the name resolution request for the host name is transmitted to the predetermined DDNS server, the waiting time can be saved.

  When allowing another DNS server to intervene between the information acquisition means and the DNS server, the DNS server is a TTL (cache time) in the DNS server that relays and holds the response in the DNS response to the name resolution request. It is preferable to reply by specifying a relatively short value for (Time To Live). In particular, when information is frequently updated by the information registration means, the TTL is set to zero. Thereby, the reachability of the name resolution request to the DDNS server is reliable because there is no fear of being blocked by a cache use response by another DNS cache server. Therefore, since it is always resolved by the DDNS server and sent back to the information acquisition means, the information acquisition means can surely acquire the latest apparent IP address.

  If there are a plurality of registration destinations by the information registering means, a plurality of fake IP addresses can be created from the ciphertext, and the ciphertext can be distributed and registered to a plurality of registration destinations. It becomes difficult. Moreover, even if the ciphertext is larger than the IP address size, the existing DDNS server can be used. As a pattern for creating a plurality of registration destinations, a combination A of one host name and IP addresses of a plurality of DDNS servers, a combination B of a plurality of host names and an IP address of a DDNS server, and a plurality of host names And a one-to-one combination C of IP addresses of a plurality of DDNS servers.

  For example, when the information acquisition unit stores the same registration destination as the registration destination stored in the information registration unit, any of the combinations A to C can be adopted. Therefore, the information registration unit stores a plurality of the registration destinations, divides the ciphertext into the plurality of pieces, creates a fake IP address from each divided data, and uses the fake IP addresses as the plurality of registration destinations. The distributed registration can be realized by assigning them one by one and transmitting the registration request.

  On the other hand, when the information acquisition unit stores only the host name related to the registration destination stored in the information registration unit, the combination A in which only one host name can be used cannot be adopted. In this case, if the combination B or C is adopted, the distributed registration can be realized without storing the IP address of the DDNS server related to the registration destination in the information acquisition unit. Specifically, the information registration unit stores a plurality of the host names, divides the ciphertext into the plurality, creates a fake IP address from each divided data, and sets the fake IP addresses to the plurality The distributed registration can be realized by allocating the registration requests one by one and transmitting the registration request.

  The present invention uses DDNS as a method for accessing a global IP address of an information registration unit used for private use from the Internet, and allows a third party who does not have access authority to the global IP address to an information registration unit. Can be used to prevent access. That is, the information registration unit has a global IP address, and the predetermined information may be connection information used for remote access to the information registration unit via the Internet. If the predetermined information is limited to the connection information for remote access in this way, the size of the ciphertext can be suppressed, and the number of host names to be reserved for the information registration means and the resource consumption of the DDNS server can be suppressed. The global IP address of the information registration means may be either dynamic or fixed. However, even if it is dynamically assigned, the information registration means is a DDNS client. An automatic process of encrypting and re-registering with the DDNS server is possible.

  For example, it is preferable that the information registering unit changes the standby port number opened for remote access at every elapse of a predetermined time. Thereby, the attack to the standby port from the outside can be avoided after a predetermined time. If the information registration means transmits the DNS registration request by encrypting the predetermined information including the changed standby port number and expiration date, even if it is a dynamic standby port number, information acquisition is possible. The means can know the standby port accessible to the information registration means from the standby port number and the expiration date in the restored connection information.

  When the global IP address of the information registration unit is an IPv4 address that is dynamically assigned, DDNS of an existing IPv4 network that is widely used can be used. Even when the global IP address is a dynamic or fixed IPv6 address, the present invention can be applied by appropriately using an IPv4 or IPv6 DDNS server.

  As described above, the present invention provides an information registration and acquisition system comprising information registration means for connecting to a predetermined database server via a network and information acquisition means for connecting to the predetermined database server via the Internet. The database server is a DDNS server, and the information registration unit includes a registration-side server storage unit that stores a registration destination in which a host name assigned to itself is associated with an IP address of the database server, and the information acquisition unit includes A DNS registration request that pretends the ciphertext obtained by the encryptor as an IP address is transmitted to the encryptor that encrypts predetermined information to be acquired and the IP address of the database server stored as the registration destination. A registration function unit, and the information acquisition unit is the same as the registration-side server storage unit An acquisition-side name storage unit that stores a host name, a resolver that transmits a name resolution request for a host name stored in the acquisition-side name storage unit, and the apparent IP address acquired by the resolver is decoded into the predetermined information By adopting a configuration that includes a decoder that converts data, the user's private information can be safely registered with a third party and obtained via the Internet without preparing a database server with an authentication function. be able to.

Functional block diagram showing the overall configuration of the information registration and acquisition system according to the embodiment The figure which shows typically the network structure of the information registration and acquisition system which concerns on embodiment The conceptual diagram of the management table of the registration side server memory | storage part and acquisition side name memory | storage part which concerns on embodiment The flowchart figure which the information registration means which concerns on embodiment registers with a DDNS server The flowchart figure in which the registration function part which concerns on embodiment updates the registration to a DDNS server The flowchart figure in which the information acquisition means which concerns on embodiment acquires connection information Functional block diagram showing information transmission of connection information according to the embodiment FIG. 6 is a flowchart corresponding to FIG. 6 in the modification of the embodiment. Functional block diagram corresponding to FIG. 8 in a modification of the embodiment Conceptual diagram of the management table corresponding to FIG. 3 in the modification of the embodiment

  Hereinafter, an embodiment of an information registration and acquisition system according to the present invention (hereinafter simply referred to as “this system”) will be described with reference to the drawings. As shown in FIG. 1 and FIG. 2, the system includes information registration means 2 for connecting to DDNS servers 1a, 1b... As predetermined database servers via a network, and the predetermined DDNS servers 1a, 1b,. The information acquisition means 3 is connected to the Internet via the Internet.

  The information registration unit 2 is connected to the Internet. The information registration unit 2 has a predetermined host name, and is dynamically assigned a global IP address by PPPoE (PPP over Ethernet) connection or DHCP (Dynamic Host Configuration Protocol) (hereinafter, this global IP address is simply “dynamic”). IP address "). For example, the information registration unit 2 includes a communication device such as a personal computer at a user's house or a gateway device. The information registration means 2 becomes a client terminal that uses the services of the DDNS servers 1a, 1b,... And functions such as software installed in the information acquisition means 3 that remotely accesses itself via the Internet. It becomes a server published on the Internet for the purpose of providing it to the Internet.

  The information registration means 2 has a standby port control unit 4 that controls the change of the standby port number. The standby port number is a number that identifies a logical port that can be opened for remote access from the information acquisition means 3 (hereinafter simply referred to as “port number”). The standby port control unit 4 changes the standby port number opened to the Internet at every elapse of a predetermined time. Specifically, the standby port control unit 4 uses the standby port used by the information acquisition unit 3 for remote access to the information registration unit 2 among predetermined port numbers that can be set for the WAN-side communication port of the information registration unit 2. The port number included in the connection information 5 is set as a standby port for remote access until the expiration date of the connection information 5, and the standby port setting is updated when the connection information 5 is updated.

  The connection information 5 includes a dynamic IP address assigned to the information registration means 2 and a standby port number. In addition, route information, user ID, password, and a key necessary for identification when these are variable Etc. can be included in the connection information 5. The route information is an address of a specific server in a route for accessing the target server via the specific server. The information registration unit 2 collects necessary information such as the assigned dynamic IP address, the standby port number set by the standby port control unit 4, and the expiration date, and generates connection information 5.

  Further, the information registration unit 2 includes an encryptor 6 that encrypts predetermined information to be acquired by the information acquisition unit 3. The predetermined information includes the generated connection information 5. The key information necessary for this encryption is registered in the information registration means 2. The encryption method is not particularly limited.

  The information registration means 2 has a registration-side server storage unit 7 that manages its own host name and IP addresses of the DDNS servers 1a, 1b,. The information registration unit 2 receives the registration of the host name of the information registration unit 2 in the registration-side server storage unit 7 and the registration of the IP address of the DDNS server corresponding to the registration destination from the user of the information registration unit 2. It has become. The registration-side server storage unit 7 stores the registration destination by a management table that associates the host name assigned to the information registration unit 2 with the IP addresses of the DDNS servers 1a, 1b,. The management table includes, for example, as shown in FIGS. 1 and 3, the host name assigned to the information registration means 2 (item name “host name” in the figure), the IP address of the DDNS server for registering the host name (FIG. Owns the item name "DDNS server address"). The host name of the information registration unit 2 is the full domain name (FQDN) of the TCP / IP network. The registration-side server storage unit 7 stores a registration destination for each host name for all host names assigned to the information registration unit 2 by using the management table. The management table also possesses order information (item name “No.” in FIG. 3) used for distributed registration of the ciphertext obtained by the encryptor 6 in FIG. 1 at a plurality of registration destinations. For example, the registration destination of “No. 1” in FIG. 3 is the host name of “●●● 1.co.jp” in FIG. 3 and the IP address of the DDNS server 1a in FIG. The information is associated with “10.10.1.1.1”. In the example shown in FIG. 1-No. 3 is a one-to-one combination of three host names and three DDNS server IP addresses. 4-No. 5 is a combination of two host names and the IP address of one DDNS server, and registration destination No. 5 relating to the five host names. 1-No. 5 presupposes that the ciphertext of the connection information 5 is distributedly registered in the three DDNS servers 1a, 1b.

  Further, the information registration means 2 shown in FIG. 1 has a registration function unit 8 that transmits a ciphertext obtained by the encryptor 6 to a predetermined DNS server 1a, 1b,. Yes. The registration function unit 8 transmits the registration request that makes the ciphertext look like an IP address to the IP addresses of the DDNS servers 1a, 1b,... Stored as registration destinations by the registration-side server storage unit 7. Specifically, the registration function unit 8 divides the ciphertext into the number of registration destinations stored in the registration-side server storage unit 7, creates a fake IP address from each piece of divided data, and uses these fake IP addresses. .. Are assigned one by one to registration destinations corresponding to the “No” order stored in the registration-side server storage unit 7, and a registration request is transmitted to the IP addresses of the corresponding DDNS servers 1 a, 1 b,.

  FIG. 4 illustrates a flowchart until the information registration unit 2 transmits a DNS registration request to the IP addresses of the DDNS servers 1a, 1b,. The information registration unit 2 generates the connection information 5 and the expiration date of the connection information 5 and inputs them to the encryptor 6 (S1). The encryptor 6 creates a ciphertext obtained by encrypting the input connection information 5 and the like, and passes it to the registration function unit 3 (S2). The registration function unit 3 confirms the size of the passed ciphertext (S3).

  When the size of the ciphertext “ABCDCFEGFHIJ” is larger than the IP address in (S3), the registration function unit 3 converts the ciphertext to the IP address size “ A. B. C. D "," E. F. G. H ", and" G. H. 1.1 "are divided," 1 "is added to the shortage portion (S4), and the registration-side server storage unit 7 , The host name to be associated is set for each fake IP address (that is, the ciphertext fragment), and the IP addresses of the DDNS servers 1a, 1b,. The registration request is transmitted to the IP address of each DDNS server 1a, 1b,... (S6).

  If the size of the ciphertext “ABC” is smaller than the IP address in (S3), the registration function unit 3 adds “1” to the deficient portion of the ciphertext and converts the ciphertext to the IP address size “ A. B. C. 1 "(S7). Thereafter, the process proceeds to (S5) and (S6).

  Further, when the size of the ciphertext “ABC” is the same as the IP address in (S3), the registration function unit 3 proceeds to the processing in (S5) and (S6).

  The DNS servers 1a, 1b,... That have received the registration request from the information registration means 2 are, as usual, the host name and IP address included in the registration request message (this IP address is obtained by the recording function unit 8 inquiring). The generated pseudo IP address) is associated and registered in its own table, and an answer to be included in the name resolution response message is generated with reference to this table.

  As described above, when the size of the ciphertext becomes larger than one IP address, the registration function unit 3 divides the ciphertext into IP address sizes, and a plurality of host names or a plurality of DDNS servers 1a, 1b is registered. At that time, a combination of the host name and any one of the registered DNS servers 1a, 1b,... Is managed in the registration-side server storage unit 7. When the ciphertext size is larger than the IP address, the ciphertext is divided and associated with a plurality of host names registered in one DDNS server, and registered in a plurality of DDNS servers 1a, 1b,. It is possible to adopt either one of the methods for dividing and associating the ciphertext with the same host name, or to use these methods in combination.

  Further, the registration function unit 8 is triggered by the update of the item information in the connection information, for example, when the dynamic IP address assigned to the information registration unit 2 is updated by DHCP or the like, and the procedure (S1 ) To (S7) to re-register the connection information 5 and the like with the DDNS servers 1a, 1b,.

  Further, as illustrated in the flowchart of FIG. 5, the registration function unit 8 monitors the expiration date of the connection information 5 registered in the DDNS servers 1a, 1b,... At any time (S11), and immediately before the expiration date. At the timing, the port number information and the expiration date are changed (S12), and the connection information 5 and the like are re-registered in the DDNS servers 1a, 1b,... (S13) with the above-described procedures (S1) to (S7). Yes.

  The standby port control unit 4, the encryption device 6, the registration-side server storage unit 7, and the registration function unit 8 shown in FIG. 1 are implemented as a computer program in the information registration unit 2. By executing the program, the encryptor 6 and the like are configured on hardware resources such as an arithmetic processing unit, a storage device, and a network interface provided in the information registration unit 2.

  On the other hand, as shown in FIGS. 1 and 2, the information acquisition means 3 is composed of a communication device connected to the Internet. For example, the information acquisition unit 3 includes a terminal such as a mobile phone or a personal computer. The information acquisition unit 3 is a client terminal that uses the services of the DDNS servers 1a, 1b,... And a client that uses the function of the information registration unit 2 that is remotely accessed via the Internet.

  The information acquisition means 3 has an acquisition-side name storage unit 9 that stores the same registration destination as the registration-side server storage unit 7. The acquisition-side name storage unit 9 has the same management table (see FIG. 3) as that stored in the registration-side server storage unit 7, and each registration destination of the registration-side server storage unit 7 is each registration in the acquisition-side name storage unit 9. There is a one-to-one correspondence with the previous one. The information acquisition means 3 receives the registration of the host name of the information registration means 2 in the acquisition name storage unit 9 and the registration of the IP address of the DDNS server corresponding to this registration destination from the user of the information acquisition means 3. It has become. The user of the information acquisition unit 3 is a person who has the same access authority as the user of the information registration unit 2, for example, the same person.

  Moreover, the information acquisition means 3 respond | corresponds to the IP address of the said DDNS server 1a, 1b ... with respect to the IP address of the DDNS server 1a, 1b ... of the registration destination memorize | stored in the acquisition side name memory | storage part 9. The resolver 10 transmits a name resolution request of the attached host name. The resolver 10 sends name resolution requests to all the DDNS servers 1a, 1b,... Registered by the information registration unit 2, and the IP address (registered fake IP address) according to the DNS protocol included in each response message. ) To obtain the full ciphertext.

  Further, the information acquisition unit 3 includes a decoder 11 that decrypts the ciphertext acquired by the resolver 10. The connection information 12 obtained by the decryption has the same information as the connection information 5. Key information necessary for decryption is registered in the information acquisition means 3. The information acquisition unit 3 remotely accesses the information registration unit 2 by appropriately using the information of each item included in the connection information 12. The key information is registered in the information acquisition unit 3 and the information registration unit 2 by appropriate means such as user distribution of the registered information registration unit, installation by a program installed on a medium or download, text input by a user operation, and the like. Just do it.

  FIG. 6 illustrates a flowchart until the information acquisition unit 3 acquires the connection information 12. The resolver 10 refers to the acquisition-side name storage unit 9 and acquires the IP addresses of the DDNS servers 1a, 1b,... Stored as registration destinations in the management table (S21). Next, the resolver 10 transmits a name resolution request for the host name associated with the acquired IP address of the DDNS servers 1a, 1b,... (S22). The DDNS servers 1a, 1b,... Respond to the resolver 10 with the requested IP address (sham IP address) with reference to their correspondence table (S23). The information acquisition means 3 integrates IP addresses (sham IP addresses) corresponding to the host names included in the response messages of the DDNS servers 1a, 1b,... According to the order “No.” in the acquisition side name storage unit 9. The ciphertext is restored (S24). The information acquisition means 3 inputs the restored ciphertext into the decryptor 11 (S25). The decryptor 11 decrypts the ciphertext using the registered decryption key (S26), whereby the information acquisition unit 3 acquires the connection information 12 (S27).

  The information acquisition unit 3 performs (S21) to (S27) every time the connection to the information registration unit 2 is performed. The resolver 10 also has a function of monitoring the expiration date of the connection information 12 that has already been acquired and starting the processing from (S21) again when the expiration date has expired.

  The acquisition-side name storage unit 9, the resolver 10, and the decoder 11 are implemented as a computer program in the information acquisition unit 3, and the information acquisition unit 3 is executed by executing the computer program on the arithmetic processing unit of the information acquisition unit 3. The acquisition-side name storage unit 9 and the like are configured on hardware resources such as an arithmetic processing device, a storage device, and a network interface.

  Information transmission from registration of connection information 5 to acquisition of connection information 12 when the embodiment of FIG. 1 is applied to IPv4 (Internet Protocol Version 4) DDNS will be described with reference to FIGS. The connection information 5 and 12 according to this embodiment includes a port number expiration date, a port number, a dynamic IP address, route information, a user ID, and a password. The port number is valid for 3600 seconds. A case where the port number is set to 1024 is illustrated. The case where the dynamic IP address is assigned to “192.168.24.1” is illustrated. The route information is exemplified when “192.168.24.3” is set. The user ID and password are unique identification information used for authentication of remote access by the information registration unit 2, and are exemplified when set to “15” and “2947437”, respectively. A case where host names A to D are assigned to the information registration unit 2 is illustrated. Host name A is No. 1 (refer to FIG. 3 as appropriate) and host name B is No. This corresponds to the host name of 2.

  As shown in FIG. 7, the information registration means 2 shown in FIG. 1 includes a port number expiration date “0E 10”, a port number “04 00”, an assigned dynamic IP address “C0 A8 18 01”, route information Information in which “C0 A8 18 03”, user ID “0F”, and password “2C F9 6D” are arranged is assumed to be plaintext in the drawing. The encryptor 6 generates the ciphertext in the figure by encryption that adds the cipher key in the figure to the plaintext in correspondence with the digits. The registration function unit 8 divides the ciphertext into IP address sizes (4 bytes in the case of IPv4), and uses “0F 12 07 04” as an apparent IP address for the host name A and an apparent IP address for the host name B. “C5 AE 1F 09”, “C9 B8 29 15” as the IP address of the host name C, “22 40 01 0E” as the IP address of the host name D, and the IP address of the host name E “C5 AE 1F 09” is generated. The registration function unit 8 transmits a registration request of the host name A and the apparent IP address “0F 12 07 04” to the IP address of the registration destination DDNS server 1a associated with the registration-side server storage unit 7, The name B is transmitted in the same manner. As a result, the ciphertext in the figure is distributed and registered in five registration destinations.

  As shown in FIG. 7, the information acquisition means 3 shown in FIG. 1 holds a decryption key that is the same as the encryption key, and an acquisition-side name storage unit 10 that has the same registration contents as the management table of the registration-side server storage unit 7. Yes. The resolver 10 transmits name resolution requests for the corresponding host names A to E to all of the predetermined DDNS servers 1a and 1b stored as registration destinations in the acquisition-side name storage unit 9. The decryptor 11 restores the ciphertext according to the integration order stored in the acquisition-side name storage unit 9 from the five apparent IP addresses acquired by the resolver 10, and decrypts the plaintext, that is, the connection information 12. Return to.

  As described above, this system registers the ciphertext in which the data size of the connection information 5 and 12 used for remote access to the information registration unit 2 is larger than the IP address in the DDNS servers 1a, 1b,. By dividing the data into compatible IP address sizes and registering the ciphertext in a distributed manner, a character string that does not function as connection information from the outside can be used as an apparent IP address of the host name assigned to the information registration means 2 Can be registered in the DDNS servers 1a, 1b,. Therefore, it is not necessary to add functions to the existing DDNS servers 1a, 1b,..., Connection information 5, 12 can be securely registered and acquired, and the existing DDNS servers 1a, 1b,. When doing so, unauthorized access to the information registration means 2 from a third party can be prevented.

  In addition, this system sets an expiration date for the connection information 5 and 12, and when the expiration date expires, by re-registering the connection information 5 and 12 with the changed port number, an attack targeted at a specific port can be prevented. The information behind the network interface of the information registration means 2 can be protected.

  A modification example of this system will be described with reference to FIGS. Only the changes will be described below. As shown in FIGS. 8 and 10, the acquisition-side name storage unit 9 according to this modification example has a registration destination No. Only the host names corresponding to 1 to 5 are stored in the management table.

  As shown in FIGS. 8 and 9, when the resolver 10 acquires the host name stored in the acquisition-side name storage unit 9 (S21), it becomes a default server in a PC (personal computer) equipped with information acquisition means. A host name name resolution request is transmitted to an arbitrary DNS server on the DNS that has been preset or notified by DHCP (S22). DNS servers other than the DNS servers 1a, 1b,... Shown in FIG. 9 belong to the DNS on the Internet, and are DNS content servers or full resolvers that manage their zone domains and IP addresses in a correspondence table. ing. The DNS server 1a, 1b,... Returns a cache time: TTL (Time To Live) in the DNS server that relays and holds the response in the DNS response to the name resolution request, specifying 0 seconds. For this reason, the response of the DDNS servers 1a, 1b,... Is not cached in other DNS servers, and the name resolution request from the resolver 10 is finally sent through one or more DNS servers on the Internet. .. Are sent to the DDNS servers 1a, 1b,... And the replies from the DDNS servers 1a, 1b,... Reach the resolver 10 via the DNS servers. Therefore, the information acquisition unit 3 can reliably acquire the latest apparent IP address.

  Comparing this modified example with the system shown in FIGS. 1 and 3, this modified example is excellent in that only the host name is stored in the acquisition-side name storage unit 9 as shown in FIG. 1, the system shown in FIG. 3 restores the connection information 12 by eliminating the search and transfer processes in each DNS server interposed between the resolver 10 and the DNS servers 1a, 1b,... It is excellent in that the time until it can be shortened.

  The technical scope of the present invention is not limited to the above-described embodiment, but includes all modifications within the scope of the technical idea based on the description of the scope of claims. For example, for a user who uses a service related to this system, information that holds in advance a registration-side server storage unit and an acquisition-side name storage unit in which the host name used by the user, the IP address of the DDNS server, etc. are registered Registration means and information acquisition means may be provided. In addition, by executing a program provided from a servicer or a program downloaded from a servicer, information input means and information acquisition means by a user in advance through manual input via a predetermined user interface provided in a personal computer or mobile phone, A host name to be used, a DDNS server, or the like may be registered. In this case, it is assumed that the user registers in the information registration unit and the information acquisition unit with the contents of the same management table. It is also possible to apply this system to DDNS that supports IPv6.

DESCRIPTION OF SYMBOLS 1a, 1b DDNS server 2 Information registration means 3 Information acquisition means 4 Standby port control part 5, 12 Connection information 6 Encryption 7 Registration side server storage part 8 Registration function part 9 Acquisition side name storage part 10 Resolver 11 Decoder

Claims (8)

Information registration means for connecting to a predetermined database server via a network;
In an information registration and acquisition system comprising information acquisition means connected to the predetermined database server via the Internet,
The database server comprises a DDNS server,
The information registration means
A registration-side server storage unit that stores a registration destination in which a host name assigned to the host server is associated with an IP address of the database server;
An encryption device for encrypting predetermined information to be acquired by the information acquisition means;
A registration function unit that transmits a DNS registration request that looks like an IP address of a ciphertext obtained by the encryptor to an IP address of a database server stored as the registration destination;
The information acquisition means includes
An acquisition-side name storage unit that stores the same host name as the registration-side server storage unit;
A resolver for transmitting a name resolution request of the host name stored in the acquisition-side name storage unit;
A decoder that decodes the sham IP address acquired by the resolver into the predetermined information;
An information registration and acquisition system characterized by that. The acquisition-side name storage unit stores the same registration destination as the registration-side server storage unit,
The information registration and acquisition system according to claim 1, wherein the resolver transmits a name resolution request for a host name associated with the IP address to an IP address of the database server stored in the acquisition-side name storage unit. .   The information registration and acquisition system according to claim 1, wherein the database server returns a DNS response to the name resolution request by specifying TTL 0 seconds. The registration-side server storage unit stores a plurality of the registration destinations,
The registration function unit divides the ciphertext into a plurality of pieces, creates a fake IP address from each piece of divided data, and assigns the fake IP addresses to the plurality of registration destinations one by one and transmits the registration request. The information registration and acquisition system according to claim 2. The registration-side server storage unit stores a plurality of the host names,
The registration function unit divides the ciphertext into a plurality of pieces, creates a fake IP address from each piece of divided data, and assigns the fake IP addresses to the plurality of registration destinations one by one and transmits the registration request. The information registration and acquisition system according to claim 1 or 3. The information registration means has a global IP address,
6. The information registration and acquisition system according to claim 1, wherein the predetermined information includes connection information used for remote access to the information registration unit via the Internet.   The information registration means changes a standby port number opened for remote access at every elapse of a predetermined time, encrypts the predetermined information including the changed standby port number and expiration date, and sends a registration request for the DNS. The information registration and acquisition system according to claim 6 for transmission.   The information registration and acquisition system according to claim 6 or 7, wherein the global IP address is an IPv4 address dynamically assigned.

Images