JP2016178494A - Gateway device and communication method - Google Patents

Abstract

PROBLEM TO BE SOLVED: To enable communication using a local address between a terminal and an opposite node through a public network.SOLUTION: A gateway device 2 includes: a local address transfer table storage unit 21 which stores a local address transfer table composed of an entry including a local address group identifier, an opposite node identifier, and a logical interface identifier; a determination unit 22 which determines whether or not both address types included in a transmission source address part and a transmission destination address part in the header of an input packet are values indicating a local address; and a processing unit 23 which acquires, from the local address transfer table, an entry logical interface identifier including the local address group identifier and the opposite node identifier included in the transmission destination address part of the input packet, to output the input packet to a logical interface indicated by the acquired logical interface identifier.SELECTED DRAWING: Figure 2

Description

  The present invention relates to a gateway device and a communication method that enable communication using a local address.

  2. Description of the Related Art Conventionally, a technique is known in which a terminal communicates with an opposite node with which a communication partner is communicating using a local address (local IP address) within a LAN (Local Area Network). For example, Patent Document 1 below discloses a system in which a mobile terminal communicates with an opposite node such as another device or gateway device using a link local address in a home network.

JP 2002-84317 A

  However, a mobile terminal connected to a public network such as a mobile communication network cannot communicate with a specific opposite node other than the gateway device using a local address. In this case, the mobile terminal may use a function that can be used only for communication using a local address, for example, which is invalidated as a security risk is high or has a wide influence range outside the subnet. Can not.

  Therefore, the present invention has been made in view of such problems, and provides a gateway device and a communication method that enable communication using a local address between a terminal and an opposite node via a public network. Objective.

  In order to solve the above-described problem, a gateway device of the present invention is a gateway device that is a communication between a terminal and an opposite node facing the terminal and relays communication via a public network, and a gateway device different from the gateway device Is a gateway device that performs communication through a tunnel established with another relay device including the logical interface for the tunnel, and the source address of the header of the input packet input to the gateway device Local address group identifier for identifying a group of local addresses when the address type included in the header and the address type included in the destination address portion of the header are values indicating local addresses, Opposite node identifier for identifying In the local address forwarding table stored in the storage means, the local address group identifier included in the transmission destination address part of the input packet and the opposite address are included. Processing means for executing communication using a local address in a public network by acquiring a logical interface identifier of an entry including a node identifier and outputting an input packet to a logical interface indicated by the acquired logical interface identifier.

  According to such a gateway device, the address type included in the transmission source address part of the header of the input packet and the address type included in the transmission destination address part of the header are values indicating local addresses by the processing means. A local address group identifier for identifying a group of local addresses, a counter node identifier for identifying a counter node belonging to the group, and a logical interface identifier for identifying a logical interface used for communication with the counter node. The logical interface identifier of the entry including the local address group identifier and the opposite node identifier included in the transmission destination address part of the input packet is acquired and acquired in the local address forwarding table configured from the entries and stored in the storage means. By the input packet to the logical interface indicated by the physical interface identifier is output, communication using the local address in the public network is executed. With such a configuration, when both the address type included in the source address part and the destination address part of the header of the input packet are values indicating local addresses, the information included in the destination address part of the input packet and the local address An input packet is output to the logical interface based on the address transfer table, and communication through the tunnel is performed. That is, communication using a local address can be enabled between the terminal and the opposite node via the public network.

  In the gateway device of the present invention, the terminal may be a mobile terminal, and the mobile terminal and the gateway device may be connected via a mobile communication network. With this configuration, communication using a local address can be enabled between the mobile terminal and the opposite node via the mobile communication network.

  In the gateway apparatus of the present invention, the processing means stores an entry including a local address group identifier and a counter node identifier included in the destination address portion of the input packet in the local address forwarding table stored in the storage means. If not, the input packet may be output to the logical interface indicated by the logical interface identifier of the entry including the local address group identifier in the local address forwarding table. By adopting such a configuration, even when an entry including the local address group identifier and the opposite node identifier included in the transmission destination address part of the input packet is not stored in the local address transfer table, By outputting the input packet to the logical interface indicated by the logical interface identifier of the entry including the local address group identifier included in the transmission destination address part by, for example, broadcasting, the input packet can be reliably transferred to the opposite node.

  In the gateway device of the present invention, the processing means determines whether or not the local address group identifier included in the transmission source address portion of the input packet matches the local address group identifier included in the transmission destination address portion of the input packet. It may be determined that the output process is performed if they match, and the output process is not performed if they do not match. By adopting such a configuration, it is possible to select the output processing target only by comparing the local address group identifiers included in the source address part and the destination address part of the input packet, thereby reducing the load of the output process and performing the output process. The speed can be increased.

  In the gateway device of the present invention, the processing means includes a local address group identifier included in a transmission source address part of the input packet and a logical interface of the input source of the input packet in the local address transfer table stored in the storage means. It may be determined whether or not an entry including the logical interface identifier to be identified is stored. If the entry is stored, output processing is performed, and if not stored, output processing is not performed. With this configuration, only input packets that satisfy the conditions based on the local address transfer table can be output, so that only input packets that satisfy a predetermined condition can be transferred reliably.

  In the gateway device of the present invention, the processing means determines whether or not an entry including a logical interface identifier for identifying a logical interface that is an input source of the input packet is stored in the local address transfer table stored in the storage means. If it is determined and stored, output processing is performed, and if not stored, output processing is not performed. By adopting such a configuration, if such a configuration is adopted, only input packets that satisfy the conditions based on the local address forwarding table can be output, so that only input packets that satisfy a predetermined condition can be reliably transferred. Can do.

  Further, in the gateway device of the present invention, when the processing unit stores an entry including a logical interface identifier for identifying a logical interface that is an input source of the input packet in the local address transfer table stored in the storage unit, In the local address transfer table, it is determined whether an entry that includes the same local address group identifier as the local address group identifier of the entry and is different from the entry is stored. If it is not stored, the output process may not be performed. With this configuration, only input packets that satisfy the conditions based on the local address transfer table can be output, so that only input packets that satisfy a predetermined condition can be transferred reliably.

  Further, in the gateway device of the present invention, from the control device for storing a local address group participating node identifier table in which a node identifier for identifying a node and a local address group identifier for identifying a group of local addresses to which the node belongs are associated. A node identifier that identifies the node that has made a connection request to the control device, and a local address group identifier that is associated with the node identifier that identifies the node that has made the connection request in the local address group participating node identifier table When the tunnel setting request is received by the receiving means and the receiving means, a logical interface for the tunnel is created, and the local address group identifier and node identifier included in the tunnel setting request are An entry containing the logical interface identifier that identifies a logical interface, and additional means for adding to the local address forwarding table stored in the storage unit may further include a you created. If such a configuration is adopted, an entry is added to the local address forwarding table based on the local address group participating node identifier table stored in the control device, so that the user of the terminal does not make a special setting for the terminal itself. The communication using the local address can be performed with the opposite node.

  By the way, the present invention can be described as an invention of a gateway apparatus as described above, and can also be described as an invention of a communication method as follows. This is substantially the same invention only in different categories, and has the same operations and effects.

  That is, the communication method according to the present invention is a communication between a terminal and an opposite node facing the terminal, which relays communication via a public network, and other gateway devices including a gateway device different from the gateway device. A communication method executed by a gateway device that performs communication via a tunnel established with a relay device using a logical interface for the tunnel, and transmits a header of an input packet input to the gateway device A local address group identifier that identifies a group of local addresses when both the address type included in the original address portion and the address type included in the destination address portion of the header are values indicating local addresses. Counter node identifier for identifying the counter node and the counter node A local address group identifier included in the transmission destination address portion of the input packet in the local address transfer table stored in the storage means, and including a logical interface identifier for identifying a logical interface used when communicating with It includes a processing step of executing communication using a local address in the public network by acquiring the logical interface identifier of the entry including the opposite node identifier and outputting the input packet to the logical interface indicated by the acquired logical interface identifier.

  ADVANTAGE OF THE INVENTION According to this invention, communication using a local address can be enabled between a terminal and an opposite node via a public network.

1 is a system configuration diagram of a communication system according to a first embodiment of the present invention. It is a functional block diagram of the control apparatus and gateway apparatus which concern on 1st Embodiment of this invention. It is a figure which shows the hardware constitutions of the control apparatus and gateway apparatus which concern on 1st Embodiment of this invention. It is a figure which shows the example of a table of a local address group participating node identifier table. It is a figure which shows the example of a table of a local address transfer table. It is a figure which shows the example of a format of a packet header. It is a figure which shows the example of a format of an address part. It is a flowchart figure which shows the process performed by the process part of the gateway apparatus which concerns on 1st Embodiment of this invention. It is a sequence diagram which shows the process at the time of the communication path establishment performed with the communication system which concerns on 1st Embodiment of this invention. It is a sequence diagram which shows the process (communication method) at the time of communication with the mobile terminal and opposite node which are performed with the communication system which concerns on 1st Embodiment of this invention. It is a figure which shows the modification using a local address relay apparatus. It is a figure which shows the modification using a hierarchical gateway apparatus. It is a figure which shows the modification using the gateway apparatus which served as the function of another apparatus. It is a flowchart figure which shows the process performed by the process part of the gateway apparatus which concerns on 2nd Embodiment of this invention. It is a functional block diagram of the control apparatus and gateway apparatus which concern on 3rd Embodiment.

  Hereinafter, preferred embodiments of a gateway device and a communication method according to the present invention will be described in detail with reference to the drawings. In the description of the drawings, the same elements are denoted by the same reference numerals, and redundant description is omitted.

[First Embodiment]
FIG. 1 is a system configuration diagram of a communication system 7 according to the first embodiment of the present invention. As shown in FIG. 1, the communication system 7 includes a control device 1 (control device), a gateway device 2 (gateway device), a terminal accommodating device 3, a mobile terminal 4 (terminal), a fixed terminal 5, an external public network N1, a mobile The mobile communication network N2 (mobile communication network) and the fixed communication network N3 are included.

  The control device 1 is a computer device that receives instructions from an administrator or user of the communication system 7 and controls various devices included in the communication system 7 based on the received instructions. The control device 1 receives a connection request from a node (such as the mobile terminal 4 and the fixed terminal 5) included in the communication system 7, and controls various devices included in the communication system 7 based on the received connection request. Details of the control device 1 will be described later.

  The gateway device 2 is a computer device having a function of a general gateway device connected between general public networks (external public network N1, mobile communication network N2, fixed system communication network N3, etc.). The gateway device 2 further includes a function for enabling communication using a local address. The gateway device 2 relays communication between the mobile terminal 4 connected to the mobile communication network N2 and an opposite node (the mobile terminal 4 or the fixed terminal 5) facing the mobile terminal 4, and other relays. Communication via a tunnel established with an apparatus (an apparatus that relays communication such as another different gateway apparatus 2 or terminal accommodating apparatus 3) is performed using a logical interface created for the tunnel. Details of the gateway device 2 will be described later.

  The terminal accommodating device 3 is a computer device for accommodating terminals (such as the mobile terminal 4 and the fixed terminal 5). The terminal accommodating device 3 becomes a terminating device on the terminal side of the tunnel when the accommodating terminal and the gateway device 2 establish a tunnel (communication path). A specific example of the terminal accommodating device 3 is a base station.

  The mobile terminal 4 is a computer terminal capable of mobile communication via the mobile communication network N2. Specific examples of the mobile terminal 4 include a smartphone and a mobile phone.

  The fixed terminal 5 is a computer terminal capable of network communication via the fixed communication network N3. Specific examples of the fixed terminal 5 include a PC (Personal Computer) device and a server device installed in a home or office.

  The external public network N1 (public network) is a general external public network, and a specific example is the Internet. The mobile communication network N2 (public network) and the fixed communication network N3 (public network) are a general mobile communication network and a fixed communication network, respectively, and are networks constructed by telecommunications carriers.

  In the present embodiment, a mechanism in which a certain mobile terminal 4 or fixed terminal 5 included in the communication system 7 communicates with another mobile terminal 4 or fixed terminal 5 using a local address via the gateway device 2. Will be described.

  FIG. 2 is a functional block diagram of the control device 1 and the gateway device 2. As shown in FIG. 2, the control device 1 includes a control unit 10 and a local address group participation node identifier table storage unit 11. The gateway device 2 includes a control unit 20 (reception unit, addition unit), a local address transfer table storage unit 21 (storage unit), a determination unit 22 (determination unit), a processing unit 23 (processing unit), and an existing packet relay processing unit. 24 is comprised.

  In the functional block diagram of the gateway device 2 in FIG. 2, for convenience of explanation, physical interfaces (physical IFs 1 and 2) and logical interfaces (logical IFs 0 to 3) are illustrated. For example, when the gateway device 2 establishes a tunnel with the counterpart device, the input packet input to the gateway device 2 through the tunnel is subjected to the existing tunnel processing via the physical interface and transferred to the corresponding logical interface. . Then, the input packet is transferred from the logical interface to the determination unit 22, and the determination unit 22, the processing unit 23, and the existing packet relay processing unit 24 perform processing related to the packet. It is transferred to the partner device via the interface.

  The control device 1 and the gateway device 2 are configured by hardware such as a CPU. FIG. 3 is a diagram illustrating an example of a hardware configuration of the control device 1 and the gateway device 2. As shown in FIG. 3, the control device 1 and the gateway device 2 shown in FIG. 2 physically include a CPU 100, a RAM 101 and a ROM 102 as main storage devices, an input / output device 103 such as a display, a communication module 104, and The computer system includes an auxiliary storage device 105 and the like.

  The functions of the functional blocks of the control device 1 and the gateway device 2 shown in FIG. 2 are entered under the control of the CPU 100 by loading predetermined computer software on the hardware such as the CPU 100 and the RAM 101 shown in FIG. This is realized by operating the output device 103, the communication module 104, and the auxiliary storage device 105, and reading and writing data in the RAM 101.

  Hereinafter, each functional block of the control apparatus 1 shown in FIG. 2 will be described.

  The control unit 10 receives a registration request for an entry in a local address group participating node identifier table described later from an administrator or user of the communication system 7. The registration request includes a terminal identifier (node identifier) for identifying a node and a local address group identifier (local address group identifier) for identifying a group of local addresses to which the node belongs. When the control unit 10 receives the registration request, the local address group participation node identifier table stored in the local address group participation node identifier table storage unit 11 includes an entry including the terminal identifier and the local address group identifier included in the registration request. Add (update) to.

  The control unit 10 also accepts a connection request from a node (mobile terminal 4 or fixed terminal 5). When receiving the connection request, the control unit 10 performs control for establishing a tunnel between the terminal accommodating device 3 accommodating the node and the corresponding gateway device 2. This control is the same as that for general tunnel establishment, but data necessary for communication using local addresses, such as local address group identifiers, when giving control instructions to other devices. Send additional.

  The local address group participating node identifier table storage unit 11 stores a local address group participating node identifier table in which a terminal identifier for identifying a node is associated with a local address group identifier for identifying a group of local addresses to which the node belongs. To do. FIG. 4 is a diagram showing a table example of the local address group participating node identifier table. In the example of the table shown in FIG. 4, a group whose local address group identifier is “1” includes nodes whose terminal identifiers are “mobile terminal 1”, “mobile terminal 2”, and “mobile terminal 4”. Indicates that

  Next, each functional block of the gateway device 2 shown in FIG. 2 will be described.

  The control unit 20 mainly performs control at the time of tunnel establishment based on a control instruction from the control unit 10 of the control device 1. For example, the control unit 20 includes a terminal address identification value (node identifier) for identifying a node that has made a connection request to the control / control device 1 from the control device 1, and a local address group participation node identifier table The storage unit 11 receives the tunnel setting request including the local address group identifier associated with the terminal address identification value for identifying the node that has made the connection request. When the tunnel setting request is received, the control unit 20 creates a logical interface for the tunnel, and identifies the local address group identifier and terminal address identification value included in the tunnel setting request and the created logical interface. An entry including the interface identifier is added to the local address transfer table stored by the local address transfer table storage unit 21 described later. Other specific control contents of the control unit 20 will be described in the description using a sequence diagram shown in FIG. 9 described later.

  The local address transfer table storage unit 21 communicates with a local address group identifier for identifying a group of local addresses, a terminal address identification value (opposite node identifier) for identifying a counter node belonging to the group, and the counter node. A local address forwarding table is stored that includes entries including logical interface identifiers for identifying logical interfaces used for the. FIG. 5 is a diagram illustrating a table example of the local address transfer table.

  The determination unit 22 is a value in which both the address type included in the transmission source address portion of the header of the input packet input to the gateway device 2 and the address type included in the transmission destination address portion of the header indicate local addresses. It is determined whether or not there is. When determining that both are values indicating a local address, the determining unit 22 transmits the input packet to the processing unit 23, and when determining that it is not, the determining unit 22 transmits the input packet to the existing packet relay processing unit 24.

  FIG. 6 is a diagram illustrating a format example of a packet header such as an input packet. As shown in FIG. 6, the packet header includes a tunnel header portion, an IP header portion, and an upper layer header portion. The IP header portion includes a destination address portion and a source address portion.

  FIG. 7 is a diagram showing a format example of the address part. As shown in FIG. 7A, the address part includes a subnet prefix. The format example shown in FIG. 7B is a detailed format example of a packet used in the present embodiment. As shown in FIG. 7B, the subnet prefix includes an address type and a local address group identifier. The address type includes a value indicating the type of address of the packet. Specific examples of the address type include a value indicating a local address and a value indicating another address. Further, as shown in FIG. 7B, a terminal address identification value for identifying the opposite node is included in the address part other than the subnet prefix. The format example shown in FIG. 7C is a detailed format example of a packet used in the second embodiment to be described later.

  When the determination unit 22 determines that both are values indicating a local address, the processing unit 23 uses the local address transfer table stored by the local address transfer table storage unit 21 (transmitted from the determination unit 22). The logical interface identifier of the entry including the local address group identifier and the terminal address identification value included in the destination address portion of the input packet is acquired, and the input packet is output to the logical interface indicated by the acquired logical interface identifier (output processing) Thus, communication using a local address is executed on the public network.

  When the local address transfer table stored by the local address transfer table storage unit 21 does not store the entry including the local address group identifier and the terminal address identifier included in the transmission destination address part of the input packet. May output the input packet to the logical interface indicated by the logical interface identifier of the entry including the local address group identifier in the local address forwarding table.

  The processing unit 23 determines whether or not the local address group identifier included in the transmission source address portion of the input packet matches the local address group identifier included in the transmission destination address portion of the input packet. Performs an output process, and if they do not match, the output process need not be performed.

  The processing unit 23 identifies, in the local address transfer table stored by the local address transfer table storage unit 21, the local address group identifier included in the source address part of the input packet and the logical interface of the input source of the input packet It is determined whether or not an entry including a logical interface identifier is stored. If the entry is stored, the output process is performed. If the entry is not stored, the output process may not be performed.

  Details of the processing by the processing unit 23 described above will be described in the description using the flowchart shown in FIG.

  In the existing packet relay processing unit 24, the determination unit 22 indicates that at least one of the address type included in the transmission source address portion of the header of the input packet and the address type included in the transmission destination address portion of the header indicates a local address. When it is determined that the value is not a value, the existing packet relay process is performed on the input packet (transmitted from the determination unit 22).

  Next, processing executed by the processing unit 23 of the gateway device 2 will be described using the flowchart shown in FIG.

  First, an input packet arrives at the processing unit 23 (step S1). Next, the processing unit 23 collates the local address group identifier of the packet header transmission destination address part with the local address group identifier of the packet header transmission source address part (step S2). Next, it is determined by the processing unit 23 whether or not the collation in S2 matches (step S3). If it is determined that they match in S3, the processing unit 23 subsequently converts the local address group identifier of the packet header transmission source address part and the logical interface identifier that identifies the logical interface of the packet input source into the local address transfer table. An entry that matches the local address group identifier and the logical interface identifier in the local address transfer table stored by the storage unit 21 is searched (step S4). Next, the processing unit 23 determines whether or not there is an entry by the search in S4 (step S5).

  If it is determined in S5 that there is an entry, the processing unit 23 subsequently has a set of the logical interface to which the packet is input, the terminal address identification value of the packet header source address part of the packet, and the local address group identifier. It is determined whether the entry is in the local address transfer table stored by the local address transfer table storage unit 21. If there is no entry, the entry is added (step S6). Next, the processing unit 23 searches the local address transfer table stored by the local address transfer table storage unit 21 using the local address group identifier of the packet header destination address part and the terminal address identification value as keys (step) S7). Next, the processing unit 23 determines whether or not there is an entry by the search in S7 (step S8).

  If it is determined in S8 that there is an entry, the processing unit 23 subsequently outputs a packet from the logical interface indicated by the logical interface identifier of the entry obtained in S7 (step S9), and the process is terminated. On the other hand, if it is determined in S8 that there is no entry, the processing unit 23 indicates the logical interface identifier of the entry whose terminal address identifier of the local address transfer table stored by the local address transfer table storage unit 21 is “BROADCAST”. The packet is output from the logical interface (excluding the packet input source logical interface) (step S10), and the process ends. If it is determined that there is no match in S3, or if it is determined that there is no entry in S5, the processing unit 23 discards the packet (step S11), and the process ends.

  Next, processing at the time of establishing a communication path executed in the communication system 7 will be described with reference to a sequence diagram shown in FIG.

  First, a registration request for a local address group participating node identifier table is transmitted from the administrator or user of the communication system 7 to the control device 1 (step S20). The registration request includes a local address group identifier and a terminal identifier. Next, the local address group participating node identifier table is registered (updated) by the control device 1 based on the registration request received in S20 (step S21).

  Next, a connection request is transmitted from the mobile terminal 4 to the control device 1 (step S22). The connection request includes the terminal identifier of the mobile terminal 4. Next, the control device 1 determines a terminal address identification value from the terminal identifier included in the connection request received in S22 (step S23). For example, the control apparatus 1 inputs a terminal identifier into a random function, and determines the output value as a terminal address identification value. The control device 1 may use the terminal identifier as the terminal address identification value as it is, but if the bit width of the terminal identifier is wide and does not fit in the packet header, the terminal address identification such that the bit width fits in the packet header. Determine the value.

  Next, a tunnel setting request is transmitted from the control device 1 to the gateway device 2 (step S24). The tunnel setting request includes a local address group identifier, a terminal address identification value, and an existing tunnel setting related request. Next, a logical interface (tunnel) is created in the gateway device 2, and an entry is added to the local address transfer table stored by the local address transfer table storage unit 21 (step S25). The added entries are an entry in which a value passed from the control device 1 is set as a terminal address identification value and an entry in which “BROADCAST” is set. Next, an existing tunnel setting related response is transmitted from the gateway device 2 to the control device 1 (step S26). Next, an existing tunnel setting-related request is transmitted from the control device 1 to the terminal accommodating device 3 (step S27). Next, an existing tunnel setting related response is transmitted from the terminal accommodating device 3 to the control device 1 (step S28). Next, a response indicating that a communication path has been established is transmitted from the control device 1 to the mobile terminal 4 (step S29). This response includes a local address group identifier and a terminal address identification value.

  Through the processes of S22 to S29 described above, a communication path using a local address starting from the mobile terminal 3 is established. A similar process is performed on the fixed terminal 4 to establish a communication path using a local address with the mobile terminal 4 as a base point (step S30).

  Next, a gateway device connection tunnel setting request is transmitted from the control device 1 to the gateway device 2 (step S31). The gateway device connection tunnel setting request includes an opposing gateway device identifier and a local address group identifier. Next, the gateway device 2 establishes a communication path using a local address between the gateway devices (step S32). The above is the processing at the time of establishing the communication path executed in the communication system 7.

  Next, processing (communication method) at the time of communication between the mobile terminal and the opposite node executed in the communication system 7 will be described using the sequence diagram shown in FIG.

  First, a packet is transmitted from the mobile terminal 4 to the terminal accommodating device 3 (addressed to the local address of the fixed terminal 5) (step S40) and transmitted to the gateway device 2. It is assumed that the mobile terminal 4 has acquired the local address of the fixed terminal 5 in advance using an existing protocol using name resolution or broadcast. Next, the gateway device 2 executes the processing by the processing unit 23 described above (step S41). Next, based on the process of S41, the packet is transferred from the gateway device 2 to the fixed terminal 5 which is the opposite node via the terminal accommodating device 3 (step S42).

  Similarly, next, a packet is transmitted from the fixed terminal 5 to the terminal accommodating device 3 (addressed to the local address of the mobile terminal 4) (step S43) and transmitted to the gateway device 2. It is assumed that the fixed terminal 5 has acquired the local address of the mobile terminal 4 in advance using an existing protocol using name resolution or broadcast. Next, in the gateway apparatus 2, the process by the above-mentioned process part 23 is performed (step S44). Next, based on the process of S44, the packet is transferred from the gateway device 2 to the mobile terminal 4 that is the opposite node via the terminal accommodating device 3 (step S45).

  Next, the effect of the gateway apparatus 2 comprised like 1st Embodiment is demonstrated.

  According to the gateway device 2 of the present embodiment, first, the determination unit 22 determines that the address type included in the source address part of the header of the input packet and the address type included in the destination address part of the header are both It is determined whether or not the value indicates a local address. Next, when the processing unit 23 determines that both are values indicating a local address by the determination unit 22, the transmission destination address of the input packet in the local address transfer table stored by the local address transfer table storage unit 21. The logical interface identifier of the entry including the local address group identifier and the terminal address identification value included in the part is acquired, and the input packet is output to the logical interface indicated by the acquired logical interface identifier. The communication used is executed. With such a configuration, when both the address type included in the source address part and the destination address part of the header of the input packet are values indicating local addresses, the information included in the destination address part of the input packet and the local address An input packet is output to the logical interface based on the address transfer table, and communication through the tunnel is performed. That is, communication using a local address can be enabled between the mobile terminal connected to the mobile communication network and the opposite node via the mobile communication network.

  Moreover, according to the gateway apparatus 2 of this embodiment, communication using a local address can be enabled between the mobile terminal 4 and the opposite node via the mobile communication network N2.

  Further, according to the gateway device 2 of the present embodiment, the processing unit 23 includes the local address group identifier included in the destination address portion of the input packet in the local address transfer table stored by the local address transfer table storage unit 21. When the entry including the terminal address identification value is not stored, the input packet may be output to the logical interface indicated by the logical interface identifier of the entry including the local address group identifier in the local address transfer table. By adopting such a configuration, even if an entry including the local address group identifier and the terminal address identification value included in the transmission destination address portion of the input packet is not stored in the local address transfer table, the input is performed in the local address transfer table. By outputting the input packet to the logical interface indicated by the logical interface identifier of the entry including the local address group identifier included in the transmission destination address portion of the packet, for example, by broadcasting, the input packet can be reliably transferred to the opposite node.

  Further, according to the gateway device 2 of the present embodiment, the processing unit 23 includes a local address group identifier included in the source address part of the input packet, and a local address group identifier included in the destination address part of the input packet. It is possible to determine whether or not the two match, and if they match, output processing is performed, and if they do not match, output processing is not performed. By adopting such a configuration, it is possible to select the output processing target only by comparing the local address group identifiers included in the source address part and the destination address part of the input packet, thereby reducing the load of the output process and performing the output process. The speed can be increased.

  Further, according to the gateway device 2 of the present embodiment, the processing unit 23 includes the local address group identifier included in the source address portion of the input packet in the local address transfer table stored by the local address transfer table storage unit 21. , It is determined whether or not an entry including a logical interface identifier for identifying a logical interface that is an input source of the input packet is stored. If the entry is stored, output processing is performed. If not, output processing is performed. It is good also as not doing. With this configuration, only input packets that satisfy the conditions based on the local address transfer table can be output, so that only input packets that satisfy a predetermined condition can be transferred reliably.

  Further, according to the gateway device 2 of the present embodiment, a local address group participating node identifier table in which a terminal identifier for identifying a node and a local address group identifier for identifying a group of local addresses to which the node belongs is associated. Corresponding to the terminal identifier that identifies the node that has made a connection request to the control device 1 from the stored control device 1 and the terminal identifier that identifies the node that has made the connection request in the local address group participation node identifier table When the tunnel setting request is received by the control unit 20 that receives the tunnel setting request including the specified local address group identifier, a logical interface for the tunnel is created and the local setting included in the tunnel setting request is generated. Address group identifier and (terminal identification A control unit 20 for adding an entry including a terminal address identification value (determined based on) and a logical interface identifier for identifying the created logical interface to the local address transfer table stored by the local address transfer table storage unit 21; , May be further provided. If such a configuration is adopted, an entry is added to the local address forwarding table based on the local address group participating node identifier table stored in the control device 1, so that the user of the mobile terminal 4 makes a special setting for the terminal itself. It is possible to perform communication using the local address with the opposite node via the mobile communication network without performing the above.

[Modification]
Then, the modification of 1st Embodiment is demonstrated using FIGS. Similar modifications can be made for a second embodiment described later.

  As illustrated in FIG. 11, the communication system 7 may further include a local address relay device 6 that relays between a plurality of gateway devices 2. In this case, the control device 1 transmits to the gateway device 2 shown in FIG. 11 an inter-gateway device connection tunnel setting request including the opposite local address relay device identifier and the local address group identifier, and the local address shown in FIG. The relay device 6 transmits the gateway device connection tunnel setting request including the opposite gateway device identifier and the local address group identifier.

  Moreover, as shown in FIG. 12, the communication system 7 may arrange | position the gateway apparatus 2 hierarchically. In this case, the control device 1 performs a tunnel setting established between the gateway device 2 and the terminal accommodating device 3 between the gateway device 2 and the gateway device 2.

  Further, as shown in FIG. 13, the communication system 7 may use a device that also functions as another device, such as causing the gateway device 2 to function as the terminal accommodating device 3.

[Second Embodiment]
Next, the communication system 7a according to the second embodiment of the present invention will be described. The communication system 7a is substantially the same as the communication system 7 according to the first embodiment of the present invention, and only the differences will be described. The communication system 7 uses a local address for communication, but the communication system 7a uses a link local address. The link local address is an IP address that allows communication only in the network area (segment) to which the link local address belongs.

  The format example shown in FIG. 7C is a detailed format example of a packet used in the second embodiment. As shown in FIG. 7C, the subnet prefix includes an address type and an arbitrary value. The address type includes a value indicating the type of address of the packet. Specific examples of the address type include a value indicating a link local address and a value indicating another address.

  System configuration diagram of communication system 7a, functional block diagram, diagram showing hardware configuration, diagram showing a table example of a local address group participating node identifier table, diagram showing a table example of a link local address forwarding table, when establishing a communication path The sequence diagram showing the process and the sequence diagram showing the process at the time of communication between the mobile terminal and the opposite node are the same as FIGS. 1, 2, 3, 4, 5, 9 and 10 of the first embodiment, respectively ( “A” is added to the reference sign in the drawing of the first embodiment, and “local address” is replaced with “link local address”).

  The processing unit 23a determines whether or not an entry including a logical interface identifier for identifying a logical interface that is an input source of the input packet is stored in the link local address transfer table stored by the link local address transfer table storage unit 21a. If it is stored, output processing is performed. If it is not stored, output processing need not be performed. The processing unit 23a also stores an entry including a logical interface identifier for identifying a logical interface that is an input source of an input packet in the link local address transfer table stored by the link local address transfer table storage unit 21a. In the link local address transfer table, it is determined whether an entry that includes the same link local address group identifier as the link local address group identifier of the entry and is different from the entry is stored. Performs an output process, and if it is not stored, the output process need not be performed.

  Next, processing executed by the processing unit 23a of the gateway device 2a in the second embodiment will be described using the flowchart shown in FIG.

  First, an input packet arrives at the processing unit 23a (step S50). Next, the processing unit 23a duplicates the packet (step S51). For the duplicated packet, the processing for the packet addressed to the existing link local address is executed. Here, some of the packets addressed to the link local address must be received by the gateway device 2a for network control. Some of such packets are received only by the gateway device 2a. In some cases, it is necessary to broadcast to other devices. Subsequent to S51, an entry whose logical interface identifier for identifying the logical interface of the packet input source matches the logical interface identifier of the link local address transfer table stored by the link local address transfer table storage unit 21a is entered by the processing unit 23a. Search is performed (step S52). Next, the processing unit 23a determines whether or not there is an entry by the search in S52 (step S53).

  If it is determined in S53 that there is an entry, then the processing unit 23a, the logical interface identifier for identifying the logical interface to which the packet is input, the terminal address identification value in the packet header transmission source address portion of the packet, and the local address group It is determined whether there is an entry having a pair with an identifier in the link local address transfer table stored by the link local address transfer table storage unit 21. If there is no entry, the entry is added to the entry (step S54). Next, the list of entries having the link local address group identifier having the same value as the link local address group identifier of the entry obtained in S52 by the processing unit 23a is stored in the link local address forwarding table storage unit 21a. Search is made from the transfer table (excludes the entry obtained by the process of S52 in the result) (step S55). Next, the processing unit 23a determines whether or not there is an entry by the search in S55 (step S56).

  If it is determined in S56 that there is an entry, the processing unit 23a subsequently determines whether there is an entry B having the terminal address identification value of the transmission destination address part of the packet in the entry list A obtained in S55. (Step S57). Next, the processing unit 23a determines whether or not there is an entry by the search in S57 (step S58). If it is determined in S58 that there is an entry, then the processing unit 23a outputs a packet from the logical interface indicated by the logical interface identifier of entry B obtained in S57 (step S59), and the process is terminated. If it is determined in S58 that there is no entry, the processing unit 23a subsequently outputs a packet from the logical interface indicated by the logical interface identifier whose terminal address identifier is “BROADCAST” among the entries in the list A (step S60). The process is terminated. If it is determined that there is no entry in S53, or if it is determined that there is no entry in S56, the processing unit 23a discards the packet (step S61), and the process is terminated.

  Next, the effect of the gateway apparatus 2a comprised like 2nd Embodiment is demonstrated.

  According to the gateway device 2a of the present embodiment, the processing unit 23a uses the logical interface identifier for identifying the logical interface that is the input source of the input packet in the link local address transfer table stored by the link local address transfer table storage unit 21a. It is also possible to determine whether or not the entry including it is stored. If it is stored, the output process is performed, and if it is not stored, the output process is not performed. By adopting such a configuration, if such a configuration is adopted, only input packets that satisfy the condition based on the link local address forwarding table can be output, so that only input packets that satisfy a predetermined condition are reliably transferred. be able to.

  Further, according to the gateway device 2a of the present embodiment, the processing unit 23a uses the logical interface that identifies the logical interface that is the input source of the input packet in the link local address transfer table stored by the link local address transfer table storage unit 21a. If an entry including an identifier is stored, whether or not an entry that includes the same local address group identifier as the local address group identifier of the entry and is different from the entry is stored in the link local address forwarding table If it is stored, output processing is performed, and if it is not stored, output processing is not performed. With this configuration, only input packets that satisfy the conditions based on the link local address forwarding table can be output, so that only input packets that satisfy a predetermined condition can be reliably transferred.

[Third Embodiment]
Next, the control device 1b and the gateway device 2b according to the third embodiment of the present invention will be described. FIG. 15 is a functional block diagram of the control device 1b and the gateway device 2b according to the third embodiment of the present invention. As shown in FIG. 15, the control device 1b includes both functional blocks of the control device 1 according to the first embodiment of the present invention and the control device 1a according to the second embodiment of the present invention. The gateway device 2b includes functional blocks of both the gateway device 2 according to the first embodiment of the invention and the gateway device 2a according to the second embodiment of the present invention. As described above, the control device 1b and the gateway device 2b have a combined function, and a detailed description thereof will be omitted. Only the points will be described below.

  In the gateway device 2b, the input packet is first input to the determination unit 22a, and the address type included in the transmission source address part of the header of the input packet and the address type included in the transmission destination address part of the header are both linked. If the value indicates a local address, the processing unit 23a performs processing related to the link local address. On the other hand, when both are not values indicating the link local address, the input packet is subsequently input to the determination unit 22, and the address type included in the source address part of the header of the input packet and the destination address part of the header When the address type included in each is a value indicating a local address, the processing unit 23 performs processing related to the local address. On the other hand, if both are not values indicating the local address, then the input packet is input to the existing packet relay processing unit 24 and the existing packet relay processing is performed.

[Summary]
In the prior art, a mobile terminal connected to a public mobile communication network cannot communicate with a specific opposite node excluding a gateway device using a local address. For example, a mobile terminal cannot use a function that is invalidated as having a high security risk or having a wide influence range outside the subnet. There is also a method of setting a tunnel between the mobile terminal and the opposite node and using a local address, but it takes time for the user of the mobile terminal to set the mobile terminal himself.

  The control device 1 and the gateway device 2 of the present embodiment provide a method for exchanging packets having a local address between a specific mobile terminal 4 and an opposite node in a public network, and a control method therefor. The gateway device 2 has a function of exchanging packets only between the mobile terminal 4 given the same local address prefix value and the opposite node, and the control device 1 has such a local address prefix value. For each terminal group. Further, the gateway device 2a of the present embodiment has a function of exchanging only packets with grouped packets whose address given to the packet is a link local address, and exchanges the link local address with the control device 1a. It has a function of managing terminal groups.

  According to the control device 1, the control device 1 a, the gateway device 2, and the gateway device 2 a of the present embodiment, subnet communication using a local address can be performed on the public network. For example, it is possible to use a function that is invalidated because the mobile terminal 4 or the opposite node has a high security risk or has a wide influence range outside the subnet. In addition, since the setting for performing communication using the local address can be automatically performed by the gateway device 2 (a) and the control device 1 (a), the user of the mobile terminal 4 can connect to the mobile terminal 4. There is no need to set it yourself.

  DESCRIPTION OF SYMBOLS 1 ... Control apparatus, 2 ... Gateway apparatus, 3 ... Terminal accommodation apparatus, 4 ... Mobile terminal, 5 ... Fixed terminal, 6 ... Local address relay apparatus, 7 ... Communication system, 10 ... Control part, 11 ... Local address group participation Node identifier table storage unit, 20 ... control unit, 21 ... local address transfer table storage unit, 22 ... determination unit, 23 ... processing unit, 24 ... existing packet relay processing unit, N1 ... external public network, N2 ... mobile communication network , N3: Fixed communication network, N4: Home network.

Claims (9)

A tunnel established between a gateway device that is a communication between a terminal and an opposite node facing the terminal and relays communication via the public network, and another relay device including a gateway device different from the gateway device. A gateway device that performs communication via the logical interface for the tunnel,
When both the address type included in the source address part of the header of the input packet input to the gateway device and the address type included in the destination address part of the header are values indicating local addresses, Consists of entries including a local address group identifier for identifying a group, a counter node identifier for identifying a counter node belonging to the group, and a logical interface identifier for identifying a logical interface used when communicating with the counter node In the local address forwarding table stored in the means, a logical interface identifier of an entry including a local address group identifier and a counter node identifier included in the transmission destination address part of the input packet is acquired, and the acquired logical interface is acquired. Scan identifier by outputting the input packet to the logical interface shown, the gateway device comprising a processing means for performing communication using the local address in the public network.   The gateway device according to claim 1, wherein the terminal is a mobile terminal, and the mobile terminal and the gateway device are connected via a mobile communication network.   In the local address forwarding table stored in the storage means, the processing means, if an entry including a local address group identifier and a counter node identifier included in the transmission destination address portion of the input packet is not stored, The gateway apparatus according to claim 1 or 2, wherein the input packet is output to a logical interface indicated by a logical interface identifier of an entry including the local address group identifier in the local address forwarding table.   The processing means determines whether or not a local address group identifier included in the transmission source address part of the input packet matches a local address group identifier included in the transmission destination address part of the input packet, The gateway device according to any one of claims 1 to 3, wherein the output processing is performed when they match, and the output processing is not performed when they do not match.   In the local address transfer table stored in the storage means, the processing means includes a local address group identifier included in the source address part of the input packet and a logical interface identifier for identifying a logical interface of the input source of the input packet The entry processing is determined whether it is stored, and if it is stored, the output processing is performed, and if it is not stored, the output processing is not performed. The gateway device described.   The processing means determines whether or not an entry including a logical interface identifier for identifying a logical interface that is an input source of the input packet is stored in the local address transfer table stored in the storage means. The gateway apparatus according to any one of claims 1 to 3, wherein the output process is performed when the data is stored, and the output process is not performed when the data is not stored.   In the local address transfer table stored in the storage unit, the processing unit stores, in the local address transfer table, an entry including a logical interface identifier that identifies a logical interface that is an input source of the input packet. , It is determined whether or not an entry that includes the same local address group identifier as the local address group identifier of the entry and is different from the entry is stored. The gateway device according to claim 6, wherein when there is no output, the output process is not performed. A connection request to the control device from the control device that stores a local address group participating node identifier table in which a node identifier that identifies the node and a local address group identifier that identifies a group of local addresses to which the node belongs is associated Receiving means for receiving a tunnel setting request including a node identifier for identifying the node that performed the connection, and a local address group identifier associated with the node identifier for identifying the node that performed the connection request in the local address group participating node identifier table When,
When a tunnel setting request is received by the receiving means, a logical interface for the tunnel is created, and includes a local address group identifier and a node identifier included in the tunnel setting request, and a logical interface identifier for identifying the created logical interface Adding means for adding an entry to the local address forwarding table stored in the storage means;
The gateway device according to any one of claims 1 to 7, further comprising: A tunnel established between a gateway device that is a communication between a terminal and an opposite node facing the terminal and relays communication via the public network, and another relay device including a gateway device different from the gateway device. A communication method executed by a gateway device that performs communication via the logical interface for the tunnel,
When both the address type included in the source address part of the header of the input packet input to the gateway device and the address type included in the destination address part of the header are values indicating local addresses, Consists of entries including a local address group identifier for identifying a group, a counter node identifier for identifying a counter node belonging to the group, and a logical interface identifier for identifying a logical interface used when communicating with the counter node In the local address forwarding table stored in the means, a logical interface identifier of an entry including a local address group identifier and a counter node identifier included in the transmission destination address part of the input packet is acquired, and the acquired logical interface is acquired. Scan identifier by outputting the input packet to the logical interface shown, the communication method including the process step of executing the communication using the local address in the public network.

Images