JP4080402B2 - Name resolution / authentication method and apparatus - Google Patents

Description

  The present invention relates to a name resolution / authentication method and apparatus, and more particularly to a name resolution / authentication method and apparatus for providing information for authenticating a user who is a packet sender to a network that relays packets in an IP network. It is.

  In recent years, with the development of communication technology, the amount of information transmitted has increased more and more, and unauthorized access to the network by unauthorized users has also increased. Authentication is becoming increasingly important to solve this security problem.

DNS system (Domain Name System)
When performing IP communication, a user of a transmission source terminal generally designates a destination by a host name. In order to convert the host name into an IP address, a DNS system (hereinafter sometimes referred to as a DNS server) is used.

  The DNS system is a system that provides a service that enables a corresponding IP address to be obtained from a host name in a TCP / IP network environment, that is, provides “name resolution”. The DNS system manages a database that describes the correspondence between host names and IP addresses, and makes it possible to refer to IP addresses from host names in response to requests from clients. This allows the user to access the network by specifying the name of the host rather than an unrememberable IP address.

  The DNS system is a distributed database, and realizes the resolution of a huge number of names / IP addresses by the configuration called “domain tree”.

  FIG. 13 shows a domain tree, and there are a jp domain DNS server 710_1, a com domain DNS server 710_2, a net domain DNS server 710_3,... Constituting a top level domain hierarchy under the root node 700. For example, under the jp domain DNS server 710_1, there are a co domain DNS server 720_1, a ne domain DNS server 720_2, an ad domain DNS server 720_3, and so on.

  Further, for example, there is an “atmarkit” server 730 under the co domain DNS server 720_1, and there is a “forum” server 740 under the “atmarkit” server 730, and host information “host” under this “forum”. (192.XXY ”) 740_1a”, “www (192.XXX) 740_1b”, and so on.

  For example, name resolution for searching for IP address = “192.X.X.X” from domain name = “www.forum.atmarkit.co.jp” is performed in the following order.

 Step T10: The jpDNS server 710_1 searches for the co.jpDNS server 720_1.

 Step T11: The co.jp DNS server 720_1 searches the atmarkit.co.jp DNS server 730.

 Step T12: The atmarkit.co.jp DNS server 730 searches the forum.atmarkit.co.jp DNS server 740.

 Step T13: forum.atmarkit.co.jp DNS server 740 searches for www.forum.atmarkit.co.jp = IP address “www192.X.X.X”. As a result, the IP address “www192.X.X.X” of www.forum.atmarkit.co.jp has been resolved.

Authentication in the network
The authentication on the IP network provides the user with the service when an arbitrary service provider and an operator of the relay network recognize the validity of a certain procedure by the arbitrary user on the IP network. It is preferable.

  First, authentication on an IP network can be classified into the following (1) to (3) from the viewpoint of users and operators.

 (1) Authentication between sender and receiver: Authentication performed between sender and receiver of IP packets. Currently, user authentication is performed at the application layer such as e-commerce.

 (2) User-to-network operator authentication: Network layer authentication performed between a network operator and a user in order to provide a service related to IP packet relay to a legitimate user. For example, dial-up or ADSL users are authenticated by entering their user ID and password when connecting to the Internet with an ISP (Internet Service Provider) or ADSL provider.

 (3) Network operator authentication: Network layer authentication performed between network operators. For example, authentication of routing information exchanged between network operators.

  Here, the discussion in the name resolution / authentication method and apparatus will be focused on the authentication between the user and the network operator in (2).

  This network operator can be classified into the following (1) to (3).

 (1) User accommodation network: A network that provides a connection to a user (user terminal) after determining whether access is possible based on a contract with the user's own network.

 (2) Relay network: A network that relays packets from the user accommodation network to the service provider network. In this specification, since the relay network is a business unit, it is assumed that there are a plurality of relay networks.

 (3) Service provider network: A network having a network device (for example, a Web server) where packets are terminated.

  FIG. 14 shows a connection example of a user accommodation network, a relay network, and a service provider network. A user accommodation network 300 accommodating user terminals 310, relay networks 400_1 to 400_3, and a service provider network 500 having a Web server 510 are connected in series. The user terminal 310 connects to the user accommodation network 300 that has become accessible based on the contract, and transmits a packet. This packet is terminated at the Web server 510 via the relay networks 400_1 to 400_3 and the service provider network 500.

  Note that the classifications (1) to (3) of the network operators are merely packet transfer categories, and the same operator may serve a plurality of roles of the above classifications for business purposes. For example, when company A provides a user accommodation service and a Web server installation service, company A can be a user accommodation network or a service provider network.

  FIG. 15 summarizes conventional technologies related to authentication in the network layer, and there are PPPoE (PPP over Ethernet (registered trademark)), an authentication gateway, and RSVP / LDP authentication as authentication technologies.

  In the figure, “Usage example”, “Popularity”, and “Applicable network (user accommodation network, relay network, and service provider network)” of each technology are shown.

  PPPoE is a standard for checking user names and passwords such as dial-up connection (PPP connection) on a network such as Ethernet (registered trademark), and is used for authentication of ADSL contract users. . The authentication gateway is a technique for ensuring security by forcing a user to be authenticated before using the network, and is used for user authentication of a wireless LAN in a hot spot.

  RSVP / LDP authentication is an authentication technology between MPLS carriers, and performs authentication between MPLS relay networks that span between carriers, not user authentication.

  These conventional techniques are intended for authentication closed to a specific network (user accommodation network or relay network).

  In addition, as an example of a conventional network system that performs authentication, one or more of individual networks composed of a server device and a client device are connected to a network connection device, and a plurality of these network connection devices are connected to a backbone network. There is a network system in which a network management device is provided in the backbone network, and the management device has a control function for the entire backbone network (see Patent Document 1).

  Authentication in this network system is performed by a user authentication server provided in the network management apparatus. That is, the user authentication server determines whether or not a user in an individual network is allowed to make a request for a service in another individual network or a backbone network service. When the user authentication server authenticates as a valid user, the user authentication server sends a user certificate to the network connection apparatus that accommodates the individual network to which the user belongs.

  The network connection device manages the service request of the user based on the user certificate. That is, the network connection device registers whether or not the user who sent the service request is authenticated when the user in the individual network accommodated by the network connection device receives a service request for another network or the backbone network. Judgment is made based on the management table for each user.

This authentication system simply authenticates whether or not a service request can be made to another individual network or backbone network other than the individual network to which the user belongs, that is, the packet is sent to another individual network and the backbone network. It authenticates whether to relay to the network.
JP-A-9-64870

  In the above-described conventional user authentication technology, only authentication for each network operator is realized, and there is no method for performing user authentication at the network layer across a plurality of network operators. This is because the conventional relay network and service provider network provide only "Anywhere-to-Anywhere" packet relay based on the destination IP address, so for network operators in the user accommodation network, This is because there is only an option of whether or not to connect the user (that is, whether or not to relay the packet).

  From the viewpoint of “End-to-End” from the packet source to the destination, each network operator only relays the packet based on the destination address, and user authentication is performed on a Web browser, for example. It is realized by sender / receiver authentication in the application such as password entry.

  As a result, the following problems (1) and (2) occur.

 (1) End-to-end service at the network level cannot be provided. For example, it is difficult to provide bandwidth control to the user.

 (2) IP packets have arrived at the destination terminal, in other words, unnecessary packets have also arrived at the destination terminal. Therefore, it cannot be avoided that the node is exposed to an attack at the network level.

Prerequisites for Problem Solving Authentication (identification) required at the “End-to-End” network level across multiple network operators for solving these problems (1) and (2) is defined below.

 (1) User identification: Users who can receive services can be identified on the network.

 (2) Service identification: The ability to identify the service provider and the service to be received.

  Restrictions (1) and (2) for realizing the above authentication (1) and (2) are shown below.

 (1) The network operator performs the packet transfer without performing the authentication at the application level as usual, and determines the amount of the network resource to be provided for each packet flow.

 (2) The granularity of authentication is on a network carrier basis. That is, the minimum unit for authentication is a network operator.

  Considering the above definition of authentication (1) and (2) and constraints (1) and (2) for realizing it, the information (packets) required for authentication regardless of the type of network operator ) Will be described below from the user accommodation network 300 to the service provider network 500. Note that the authentication algorithm and the service itself provided as a result of authentication are not mentioned.

  First, in the IP network, since the address is uniquely assigned, the user can be specified if the source IP address is known. An FQDN (Fully Qualified Domain Name) is generally assigned to identify a service. For example, “www.Abc.com” is a web service provided by “Abc”.

  Therefore, the user identifier is a source IP address (hereinafter sometimes referred to as Src-IP), and the service identifier is a destination IP address obtained by name resolution from the FQDN (hereinafter sometimes referred to as Dst-IP). And

  Next, from the standpoints of network operators and users, operator requirements (1) to (3) and user requirements for solving the above problems (1) and (2) are shown below.

 Business Requirement (1): Authentication for flow identification can be performed before user packets start to flow.

 Operator requirement (2): Flow identification can be set dynamically in the router.

 Operator requirement (3): User / service identifier can be identified prior to user packet transmission.

  That is, the network operator performs authentication based on the user identifier and service identifier propagated by some means, and dynamically reflects the result on the router flow identification. Based on this flow identification, the router detects a combination of a specific user identifier and a service identifier, and provides a specific service to the authentication permitter.

  From the user's standpoint, since the relay network through which the route passes is determined by the IP route information, it is difficult for the user to perform authentication for each of the user accommodation network, the relay network, and the service provider accommodation network. Therefore, user requirements are as follows.

 User requirements: A single user authentication procedure must be able to authenticate the entire network through the service provider.

Problem where attention as prior art that may meet the network operator requirements (1) to (3), the DNS system described above is a negotiation technique performed on the network prior to the packet transmission from the user terminal To do.

  There are the following problems (1) and (2) in order to authenticate users and services while satisfying the above network requirements (1) to (3) and user requirements using the DNS system.

 Problem (1): The domain tree is independent of the relay network through which user IP packets pass.

 Problem (2): In the DNS system, there is no means for identifying the node that issued the name resolution request. That is, the IP address (user identifier) of the inquiring user terminal is not assigned to the packet between the DNS servers.

  Accordingly, the present invention provides a name resolution / authentication method and apparatus for providing information for authenticating a user who is a packet sender to a network operator that relays IP packets in an IP network. An object is to realize a name resolution method and apparatus associated with a network through which a packet passes. Next, an object is to perform user authentication and service authentication in the network based on the name resolution method and apparatus.

  As described in the above problem, first, a name resolution method associated with a network through which a user IP packet passes is described, and then a method for performing user authentication and service authentication in the network based on this method is described.

  Hereinafter, for example, a name resolution request and a name resolution response are referred to as an advanced name resolution request and an advanced name resolution response in order to distinguish them from conventional ones.

In order to solve the above problems, the name resolution / authentication apparatus method of the present invention is a name resolution / authentication method between name resolution / authentication apparatuses provided in each of a plurality of networks that relay IP packets, and is adjacent to each other. A first step of registering the IP address of the name resolution / authentication device to be sent, and a second step of sending an advanced DNS advertisement indicating the FQDN managed by the own device and the IP address of the own device to the neighboring device of the IP address And a third step of registering the FQDN indicated in the received advanced DNS advertisement and the IP address in association with each other when the FQDN indicated in the received advanced DNS advertisement is not registered .

  That is, in the first step, the IP address of an adjacent name resolution / authentication device (hereinafter, sometimes referred to as “advanced DNS (Domain Name System) server” to distinguish it from a conventional device) is, for example, Registered in DNS database. In the second step, adjacent name resolution of the IP address registered in the adjacent advanced DNS database is performed by using the advanced DNS information including the FQDN (Fully Qualified Domain Name) managed by the device and the IP address of the device. -Send to the authentication device.

  In the third step, when the FQDN of the advanced DNS information received from the adjacent name resolution / authentication device is not registered in the FQDN database, for example, the FQDN and the name resolution / authentication device (hereinafter referred to as the received advanced DNS information) The IP address of the following DNS is registered in the FQDN database.

  As a result, the name resolution / authentication apparatus can advertise the FQDN managed by the own apparatus and the IP address of the own apparatus to the adjacent name resolution / authentication apparatus using the advanced DNS advertisement. The adjacent name resolution / authentication device can perform name resolution by making a name resolution request for the registered FQDN to the name resolution / authentication device of the IP address registered in the FQDN database.

Further, the third step further, when the FQDN and the IP address indicated in the advanced DNS publicity received is not registered in association with the IP address of the advanced DNS publicity thus received its own device It is possible to forward the advanced DNS advertisement replaced with the IP address to the adjacent device of the IP address.

  That is, for example, a name resolution / authentication device that receives an Advanced DNS PR from an adjacent name resolution / authentication device replaces the IP address of the Advanced DNS PR with the IP address of its own device. • Transfer to the authentication device.

  As a result, the advanced DNS public information having the same FQDN is not transferred to the same name resolution / authentication apparatus. Further, the name resolution / authentication device sequentially forwards the advanced DNS public information, so that route information for transmitting an FQDN advanced name resolution request to be described later is registered in the FQDN database.

  As a result, by sequentially transferring the advanced name resolution request to the IP address corresponding to the FQDN in the FQDN database, the name resolution request is traced in the reverse direction along the transmission path of the advanced DNS public information, and the advanced name of the FQDN It is possible to transfer to a name resolution / authentication device that performs resolution.

Further, in the present invention , the advanced DNS public information further includes the number of name resolution / authentication devices passed by itself, and in the third step, further registers the number of passages in association with the FQDN. A fourth step of determining whether to register the FQDN of the advanced DNS PR and whether to transfer the advanced DNS PR based on the number of vias indicated by the advanced DNS PR and the registered number of vias. And further .

  That is, in the fourth step, based on the number of vias indicated by the advanced DNS public information and the registered number of vias, it is determined whether or not to register information regarding the FQDN of the advanced DNS public information, and whether or not to forward the advanced DNS public information. Can be determined. For example, when “advance number of advanced DNS information”> “number of registered information”, registration is not performed, and advanced DNS information is not transferred.

  Thereby, for example, the shortest path information to which the advanced DNS public information is transferred can be registered in the FQDN database, for example. It is also possible to register a plurality of route information to which the advanced DNS public information is transferred, for example, in the FQDN database.

  In the present invention, the fifth step of registering the authenticated source IP address in advance and the source IP address indicated in the received advanced name resolution request are registered as the authenticated source IP address. And a sixth step of registering the source IP address included in the advanced name resolution request in association with the IP address of the adjacent name resolution / authentication device that forwarded the advanced name resolution request. .

  That is, a transmission source IP address (user IP address, that is, user identifier) authenticated in advance is registered.

  In the sixth step, when the source IP address indicated in the received advanced name resolution request is registered in the authentication-permitted source IP address database, for example, the source IP address included in the advanced name resolution request And the IP address of the adjacent name resolution / authentication device that sent the advanced name resolution request are associated with each other and registered in, for example, the flow identification entry database.

  This makes it possible to authenticate this flow by performing flow identification based on the source IP address registered in the flow identification entry database.

  Further, by tracing the IP address of the adjacent name resolution / authentication device, for example, an advanced name resolution response to the advanced name resolution request can be transferred to the user who sent the advanced name resolution request.

  In the present invention described above, the seventh step of creating the advanced name resolution request obtained by converting the received name resolution request may further be provided before the sixth step.

  In other words, in the seventh step, a conventional name resolution request is received, an advanced name resolution request is added to which the IP address (user identifier) of the transmission source, for example, is added, and this request is given to the sixth step.

  As a result, a conventional name resolution request can be processed by the name resolution / authentication apparatus of the present invention.

  In the present invention, the sixth step may discard an advanced name resolution request in which the source IP address indicated in the received advanced name resolution request is not the source IP address registered for authentication. it can.

  This makes it possible to refuse, for example, reception of an advanced name resolution request from a user terminal having an unauthenticated source IP address.

  In the present invention, an advanced name resolution response to the advanced name resolution request is received, and the IP address of the FQDN indicated in the response is also registered in association with the source IP address of the flow identification entry database. In addition, it is possible to further include an eighth step of transferring the advanced name resolution response to the neighboring device having the IP address registered in the flow identification entry database.

  That is, in the eighth step, an advanced name resolution response to the advanced name resolution request is received, and the IP address (service identifier) of the FQDN included in this response is also the source IP address (user identifier) of the flow identification entry database, for example. Register in association with. Then, the advanced name resolution response is forwarded to the adjacent name resolution / authentication device of the IP address registered in the flow identification entry database, for example.

  As a result, the source IP address included in the advanced name resolution request, the IP address of the adjacent name resolution / authentication device that sent the advanced name resolution request (the IP address of the previous DNS), and the FQDN included in the advanced name resolution response The resolved IP address is registered in association with it.

  Based on this flow identification entry database, it is possible to perform flow identification based on the IP address (service identifier) of the FQDN and the source IP address (user identifier: IP address of the user terminal) and to authenticate this flow Become.

  In the present invention described above, a ninth step of converting the advanced name resolution response into a name resolution response and transferring it to a conventional terminal can be provided.

  Thereby, for example, a name resolution response can be returned to a conventional user terminal.

  Furthermore, in the present invention described above, the tenth step of registering in advance the IP address of the external gateway router of the network to which the device belongs, and the IP address of the FQDN and the source IP address of the registered external gateway router And an eleventh step of setting at least one of them.

  That is, the IP address of the external gateway router of the network (local domain) to which the database own device belongs is registered in advance in the external gateway router. In the eleventh step, for example, a flow identification entry (FQDN IP address and transmission source IP address, or FQDN IP address or transmission source IP address) in the flow identification entry database is searched, and the searched flow identification entry is externally Set in the external gateway router registered in the gateway router IP address database.

As a result, the external gateway router can discard or block the packet flow that is not authenticated by the network to which the external gateway router belongs, based on the flow identification entry.
As described in the above-described problem, first, means for realizing a name resolution apparatus associated with a network through which a user IP packet passes are described, and then user authentication and service authentication in a network using this apparatus will be described.

To solve the above problems, the name resolution and authentication device of the present invention is a name resolution and authentication device provided to each of the plurality of networks to relay the IP packet, the adjacent name resolution and authentication device IP Advanced DNS information that sends an advanced DNS advertisement indicating the FQDN managed by the own device and the IP address of the own device to the device having the IP address registered in the adjacent advanced DNS database. When the sending unit, the FQDN database, and the FQDN indicated in the received advanced DNS advertisement are not registered in the FQDN database, the FQDN and the IP address indicated in the received advanced DNS advertisement are associated with each other. and advanced DNS publication processing unit for registering in the FQDN database Te, Ru comprising a.

  That is, in the adjacent advanced DNS (Domain Name System) database, IP addresses of adjacent name resolution / authentication apparatuses (hereinafter sometimes referred to as advanced DNS servers) are registered. The advanced DNS public information transmission unit transmits the advanced DNS public information indicating the IP address of the own device and the FQDN managed by the own device to the name resolution / authentication device of the adjacent IP address registered in the adjacent advanced DNS database.

  When the FQDN of the received advanced DNS information is not registered in the FQDN database, the advanced DNS information processing unit sends the FQDN and IP address indicated in the received advanced DNS information (that is, the IP address of the adjacent name resolution / authentication device). Address, which may be abbreviated as “Next DNS”), is registered in the FQDN database.

  As a result, the name resolution / authentication apparatus can advertise the FQDN managed by the own apparatus and the IP address of the own apparatus to the adjacent name resolution / authentication apparatus using the advanced DNS advertisement. The adjacent name resolution / authentication device can perform name resolution by making a name resolution request for the registered FQDN to the name resolution / authentication device of the IP address registered in the FQDN database.

The above-mentioned A Dobansudo DNS publication processing unit further when said FQDN and the IP address indicated in the advanced DNS publicity received is associated not registered in the FQDN database, advanced DNS thus received It is possible to forward an advanced DNS advertisement in which the IP address of the advertisement is replaced with the IP address of its own device to the apparatus having the IP address registered in the adjacent advanced DNS database.

  In other words, the name resolution / authentication device that receives the Advanced DNS PR from the adjacent name resolution / authentication device replaces the IP address of the Advanced DNS PR with the IP address of its own device. Transfer to device.

  As a result, the advanced DNS public information having the same FQDN is not transferred to the same name resolution / authentication apparatus. Further, the name resolution / authentication device sequentially forwards the advanced DNS public information, so that route information for transmitting an FQDN advanced name resolution request to be described later is registered in the FQDN database.

  As a result, by sequentially transferring the advanced name resolution request to the IP address corresponding to the FQDN in the FQDN database, the name resolution request is traced in the reverse direction along the transmission path of the advanced DNS public information, and the name resolution of the FQDN is resolved. Can be transferred to the name resolution / authentication device.

Further, in the present invention , the advanced DNS public relations further includes the number of name resolution / authentication devices passed by itself, and the number of vias is further registered in the FQDN database in association with the FQDN. The advanced DNS PR processing unit further determines whether or not to register the FQDN of the advanced DNS PR in the FQDN database based on the number of vias indicated by the advanced DNS PR and the number of vias registered in the FQDN database. Or whether to forward the advanced DNS advertisement .

  That is, the advanced DNS public information processing unit determines whether or not to register information related to the FQDN of the advanced DNS public information in the FQDN database based on the number of vias indicated by the advanced DNS public information and the number of vias registered in the FQDN database. Can be determined whether or not to transfer. For example, when “the number of vias for advanced DNS public information”> “the number of registered vias”, it is not registered in the FQDN database, and the advanced DNS public information is not transferred.

  Thereby, for example, the shortest path information to which the advanced DNS public information is transferred can be registered in the FQDN database. It is also possible to register a plurality of route information to which the advanced DNS public information is transferred in the FQDN database.

  In the present invention described above, the authentication permitted transmission source IP address database in which the authenticated transmission source IP address is registered in advance, the flow identification entry database, and the transmission source IP address indicated in the received advanced name resolution request are When registered in the authentication-permitted source IP address database, the source IP address included in the advanced name resolution request is associated with the IP address of the adjacent name resolution / authentication device that forwarded the advanced name resolution request. And an advanced name resolution request processing unit registered in the flow identification entry database.

  That is, the name resolution / authentication apparatus further includes an authentication permission transmission source IP address database, a flow identification entry database, and an advanced name resolution request processing unit. In the authentication-permitted transmission source IP address database, a transmission source IP address (user IP address, that is, user identifier) that has been authenticated in advance is registered.

  The advanced name resolution request processing unit, when the source IP address indicated in the received advanced name resolution request is registered in the authentication-permitted source IP address database, the source IP address included in the advanced name resolution request The address and the IP address of the adjacent name resolution / authentication device that sent the advanced name resolution request are associated with each other and registered in the flow identification entry database.

  This makes it possible to authenticate this flow by performing flow identification based on the source IP address registered in the flow identification entry database.

  Further, by tracing the IP address of the adjacent name resolution / authentication device, for example, an advanced name resolution response to the advanced name resolution request can be transferred to the user who sent the advanced name resolution request.

  In the present invention described above, an advanced name resolution request creation unit that creates an advanced name resolution request obtained by converting the received name resolution request and gives the request to the advanced name resolution request processing unit can be further provided.

  That is, the advanced name resolution request creation unit receives a conventional name resolution request, creates an advanced name resolution request to which, for example, the IP address (user identifier) of the transmission source of the request is added, and creates the advanced name resolution request processing unit To give.

  This makes it possible for the name resolution / authentication apparatus of the present invention to process a conventional name resolution request.

  In the present invention described above, the advanced name resolution request processing unit may perform advanced name resolution when the source IP address indicated in the received advanced name resolution request is not registered in the authentication-permitted source IP address database. The request can be discarded.

  This makes it possible to refuse, for example, reception of an advanced name resolution request from a user terminal having an unauthenticated source IP address.

  In the present invention, an advanced name resolution response to the advanced name resolution request is received, and the IP address of the FQDN indicated in the response is also registered in association with the source IP address of the flow identification entry database. In addition, an advanced name resolution response processing unit that transfers the advanced name resolution response to an adjacent device having the IP address registered in the flow identification entry database can be further provided.

  That is, the advanced name resolution response processing unit receives the advanced name resolution response to the advanced name resolution request, and the IP address (service identifier) of the FQDN included in this response is also the source IP address (user identifier) of the flow identification entry database. ) And register. Then, the advanced name resolution response processing unit transfers the advanced name resolution response to the adjacent name resolution / authentication device of the IP address registered in the flow identification entry database.

  As a result, in the flow identification entry database, the source IP address included in the advanced name resolution request, the IP address of the adjacent name resolution / authentication device that sent the advanced name resolution request (the IP address of the previous DNS), and the advanced name The resolved IP address of the FQDN included in the resolution response is registered in association with it.

  Based on this flow identification entry database, it is possible to perform flow identification based on the IP address (service identifier) of the FQDN and the source IP address (user identifier: IP address of the user terminal) and to authenticate this flow Become.

  In the present invention described above, the advanced name resolution response processing unit converts the advanced name resolution response into a name resolution response and forwards the response to the adjacent device of the IP address registered in the flow identification entry database. can do. Thereby, for example, a name resolution response can be returned to a conventional user terminal.

  Furthermore, in the above-mentioned present invention, it further comprises an external gateway router IP address database in which the IP address of the external gateway router of the network to which the device belongs is registered in advance, and the advanced name resolution response processing unit includes the external gateway router IP address database. It is possible to set at least one of the IP address of the FQDN and the source IP address registered in the flow identification entry database in the external gateway router registered in (1).

  That is, in the external gateway router, the IP address of the external gateway router in the network (local domain) to which the database own device belongs is registered in advance. The advanced name resolution request processing unit searches the flow identification entry (the IP address of the FQDN and the transmission source IP address, or the IP address of the FQDN, or the transmission source IP address) of the flow identification entry database, and finds the searched flow identification entry. Set to the external gateway router registered in the external gateway router IP address database.

  As a result, the external gateway router can discard or block the packet flow that is not authenticated by the network to which the external gateway router belongs, based on the flow identification entry.

  As described above, according to the name resolution / authentication method and apparatus according to the present invention, the name resolution method and apparatus associated with the network through which the user IP packet passes can be realized. Furthermore, it is possible to perform user authentication and service authentication in the network by using this name resolution method and apparatus.

  In other words, service authentication using the DNS system is realized by publicizing the FQDN, and authentication of the transmission source user is realized by adding the transmission source IP address of the user terminal to the name resolution request message. In addition, it is possible to publicize a publicity message on the shortest route with the number of DNS via whether or not FQDN relay is possible. In addition, user IP packets can be authenticated by dynamically setting flow identification information in the router. Furthermore, compatibility with conventional DNS messages can be maintained.

  FIG. 1 shows an embodiment of a name resolution / authentication apparatus (hereinafter also referred to as an advanced DNS server or simply a server) 100 to which the name resolution / authentication method of the present invention is applied. The advanced DNS server 100 includes a database unit 80, a communication termination unit 10, a DNS packet type identification unit 20, an advanced DNS information processing unit 30 for processing an advanced DNS notification message (hereinafter, advanced DNS information) 801, Advanced Name Resolution Request (Advanced DNS Request) message (hereinafter referred to as Advanced Name Resolution Request) 802 Advanced Name Resolution Request Processing Unit 40, Advanced Name Resolution Response (Advanced DNS Reply) Message (hereinafter referred to as Advanced Name Resolution Response) 803 It comprises an advanced name resolution response processing unit 50, an advanced name resolution request creation unit 60, and a command interface 70 to be processed.

The database unit 80 includes an FQDN database 81, an adjacent advanced DNS database 82, an authentication permission transmission source IP address database 83, an external gateway router IP address database 84, and a flow identification entry database 85.

FQDN database 81 : a database created based on the advanced DNS public information 801, and has fields of FQDN 81a, next DNS 81b, and number of transits 81c.

  The advanced name resolution request 802 (see FIG. 2 (2) described later) is sent to the advanced DNS server 100 of the IP address indicated by the next DNS 81b corresponding to the FQDN 81a of the FQDN database 81, which is searched using the FQDN 802b in itself as a key. Transferred.

Adjacent advanced DNS database 82 : a database in which IP addresses 82a,... Of advanced DNS servers 100 that are adjacent to each other in the network are registered. The advanced DNS public information 801 is transferred to the advanced DNS server 100 having the IP address registered in the database 82.

Authentication-permitted sender IP address database 83 : a database in which IP addresses permitting authentication (that is, IP addresses of user terminals, hereinafter sometimes referred to as Src-IP) 83a,... Are registered as “user identifiers”. It is. The source IP address 802d of the received advanced name resolution request 802 (that is, “user identifier”, see FIG. 2 (2)) is searched for in the database 83. Authentication is permitted. Then, the FQDN database 81 is searched using the FQDN 802b of the authenticated advanced name resolution request 802 as a key, and the request 802 is transferred to the “adjacent advanced DNS server 100 of the IP address indicated by the next DNS 81b” corresponding to the hit FQDN 81a. Is done.

External gateway router IP address database 84 : a database in which the IP address of the external gateway router 520 in its own domain (network to which the own device belongs) is registered in advance.

Flow identification entry database 85 : a database having flow identification information set / set in the external gateway router 520, which may be referred to as a destination IP address (that is, an IP address of a server providing a service, hereinafter referred to as Dst-IP). ) 85a, a source IP address (hereinafter sometimes referred to as Src-IP) 85b, and a previous DNS 85c.

  The Src-IP 85b and the previous DNS 85c register the Src-IP 802d and the previous DNS 802c in the advanced name resolution request 802, respectively, and the advanced name resolution response 803 (see FIG. 2 (3) described later) in the Dst-IP 85a. Name-resolved IP address 803b is registered. Among these, Dst-IP85a (service identifier) and Src-IP85b (user identifier) are set as entries for flow identification in the external gateway router 530 (see FIG. 4 described later).

The communication termination unit 10 electrically terminates communication from the network 600, and passes the information received from the network 600 to the DNS packet type identification unit 20 as a packet (message) 800. Further, the communication termination unit 10 electrically transmits packets (messages) 801 to 803, 805, and 806 to the network 600.

The DNS packet type identification unit 20 identifies the message 800. That is, the advanced DNS public information 801, the advanced name resolution request 802, the advanced name resolution response 803, and the conventional name resolution request 804 are identified.

The advanced DNS public information processing unit 30 processes the advanced DNS public information 801, and includes an entry creation unit 31 and a next DNS determination unit 32.

Entry creation unit 31 : Creates an entry in the FQDN database 81. If an entry already exists for the same FQDN, the following process (1) or (2) is performed.

 (1) If the number of via DNS 801d (see FIG. 2 (1)) of the received advanced DNS public information 801 is smaller than the entry in the database 81, it is overwritten with the information of the public information 801, and the public information 801 is given to the next DNS decision unit 32 .

 (2) If the received DNS number 801d of the advanced DNS public information 801 is larger than the entry in the database 81, the public information 801 is discarded.

Next DNS determination unit 32 : Obtains the IP address 82a of the advanced DNS server 100 to which the public information 801 is transferred from the adjacent advanced DNS database 82, and transfers the public information 801 to this IP address.

The advanced name resolution request processing unit 40 processes the advanced name resolution request 802, and includes a source address authentication unit 41, a flow identification entry creation unit 42, a destination / source domain determination unit 43, a name resolution unit (advanced name A solution response generator 44) and a next DNS determiner 45.

Source address authentication unit 41 : Searches for IP addresses 83a,... In the authentication permitted source IP address database 83 using the source IP address 802d (see FIG. 2 (2)) in the advanced name resolution request 802 as a key, The presence or absence of a matching entry is confirmed, and the next processing (1) or (2) is performed.

 (1) If there is a matching entry, it is assumed that the authentication has succeeded, and the request 802 is passed to the flow identification entry creation unit.

 (2) If there is no matching entry, the request 802 is discarded.

Flow identification entry creation unit 42 : Creates an entry in the flow identification entry database 85 and passes the request 802 to the destination / source domain determination unit 43.

Destination / source domain determination unit 43 : FQDN 802b of request 802 (see FIG. 2 (2)) is an advanced name for FQDN 801b (see FIG. 2 (1)) of advanced DNS PR 801 transmitted by the own advanced DNS server 100. It is determined whether or not the solution request 802 is received. That is, the determination unit 43 determines whether the advanced DNS server 100 is a server 100 included in the service provider network 500 (see FIG. 4 or FIG. 13 described later) that performs name resolution of the domain name indicated in the FQDN 802b of the request 802. Determine whether or not.

Name resolution unit (advanced name resolution response creating unit) 44 : When the local server 100 is the server 100 that performs name resolution of the FQDN 802b of the request 802, the name resolution processing for the advanced name resolution request 802 is performed, and the advanced name resolution response 803 And gives this response 803 to the advanced name resolution response processing unit 50.

Next DNS determination unit 45 : When the local server 100 is a server 100 that does not perform name resolution of the FQDN 802b of the request 802, the FQDN database 81 is searched using the FQDN 802b of the request 802 as a key, and the IP address indicated by the corresponding next DNS 81b The advanced name resolution request 802 is transferred to the server 100. Note that the search target database 81 of the next DNS determination unit 45 is different from the search target database 82 of the next DNS determination unit 32.

The advanced name resolution response processing unit 50 processes the advanced name resolution response 803, and includes a flow identification entry appending unit 51, a router setting unit 52, a local domain address determination unit 53, and a name resolution response conversion unit 54. ing.

Flow identification entry appending unit 51 : Searches the flow identification entry database 85 using Src-IP803d included in the advanced name resolution response 803 as a key, and discards the response 803 when a hit miss is made.

  In the case of a hit, the appending unit 51 acquires the previous DNS 85c corresponding to the hit Src-IP803d, writes the resolved IP address 803b included in the response 803 to the Dst-IP85a of the database 85, and then sends the response 803. This is given to the router setting unit 52.

Router setting unit 52 : Obtains the IP address of the external gateway router 530 in its own domain from the external gateway router IP address database 84. Further, a flow for searching the flow identification entry database 85 and setting the flow identification entry (Dst-IP = “A1”, Src-IP = “M2”) registered in the database 85 in the external gateway router 530. After transmitting the identification setting signal 806 to the router 530, a response 803 is sent to the own domain address determination unit 53.

Own domain address determination unit 53 : Determines whether or not the IP address of the “previous DNS” searched by the flow identification entry appending unit 51 is an IP address possessed by the own network operator. If it is an IP address owned by the own network operator (own domain), it is determined that the next transmission destination is a user terminal (name resolution request transmission source), and a response 803 is given to the name resolution response conversion unit 54.

  If it is not the IP address of the own network operator (other domain), the own domain address determination unit 53 transfers the response 803 to the server 100 having the IP address of “previous DNS”.

Name resolution response conversion unit 54 : creates a conventional name resolution response 805 including the resolved IP address from the advanced name resolution response 803, and this name resolution response 805 is indicated in Src-IP803d of the advanced name resolution response 803 Send to IP address (IP address of user terminal).

The advanced name resolution request creation unit 60 creates an advanced name resolution request 802 from the conventional name resolution request 804. The advanced name resolution request 802 is processed by the advanced name resolution request processing unit 40.

The command interface 70 is a functional block that handles input / output with the console of the advanced DNS server 100, and performs settings 820 to 823 of the databases 81 to 84 in the database unit 80.

  FIG. 2 shows three examples of messages transmitted and received between the name resolution / authentication apparatus 100 of the present invention. The three messages are the advanced DNS public information 801 and the advanced DNS shown in FIGS. A name resolution request 802 and an advanced name resolution response 803.

  The advanced DNS public information 801 is distributed, for example, from the advanced DNS server 100_1 of the service provider network to the adjacent advanced DNS server 100_2, and further distributed from the server 100_2 to the adjacent advanced DNS server 100_3 (see FIG. 4). . That is, the advanced DNS public information 801 is distributed based on the physical connection relationship of the network operator.

  More specifically, the advanced DNS public information 801 includes a message type 801a in which an identifier indicating that the advanced DNS public information 801 is set, the FQDN 801b of the server 510 that provides the service, as shown in FIG. It includes a next DNS 801c indicating the IP address of the advanced DNS server 100 to which the public information 801 is transmitted or transferred, and a via DNS number 801d indicating the number of advanced DNS servers 100 through which the public information 801 passes.

  The advanced name resolution request 802 is a message for requesting name resolution in the name resolution / authentication apparatus, and does not follow the domain tree (see FIG. 15) as in the conventional name resolution request, It is transferred while following the “next DNS 81b” of the FQDN database 81 of each advanced DNS server 100 set based on the next DNS 801c.

  That is, the advanced name resolution request 802 is transferred from the advanced DNS server 100 of the user accommodation network 300 to the advanced DNS server 100 of the service provider network 500 by following the distribution route of the advanced DNS public information 801 in reverse order.

More specifically, the advanced name resolution request 802 is as shown in FIG.
Message type 802a in which an identifier indicating that it is an advanced name resolution request 802 is set, information included in a conventional name resolution request (for example, FQDN to be resolved) 802b, and an advanced DNS server in the previous stage that transmitted or forwarded the request 802 It includes a front DNS 802c indicating 100 IP addresses and a source IP address (Src-IP) 802d indicating the IP address of the user terminal 310 that is requesting name resolution.

  More specifically, the advanced name resolution response 803 is included in the conventional name resolution response 805 and the message type 803a in which an identifier indicating the advanced name resolution response 803 is set, as shown in FIG. Information (for example, resolved IP address) 803b, authentication result 803c of advanced DNS server 100 of service provider network 500, and Src-IP 803d that is the same as Src-IP 802d of request 802.

  The advanced name resolution response 803 is a message having an IP address indicating name resolution of the FQDN 801b requested by the advanced name resolution request 802. The response 803 is transferred while following the “previous DNS 85c” of the flow identification entry database 85 set based on the “previous DNS 802c” in the request 802.

  FIG. 3 shows an example of the entire operation procedure of the name resolution / authentication apparatus 100. First, steps S100 and S110 and steps T100 to T800 surrounded by a broken line or an alternate long and short dash line are schematically described below.

Steps S100 and S110 : In the name resolution / authentication apparatus 100, the DNS packet type identification unit 20 (see FIG. 1) identifies the packet 800 received from the network 600 via the communication termination unit 10, and (1) Advanced DNS public information 801, (2) Advanced name resolution request 802, (3) Advanced name resolution response 803, (4) Conventional name resolution request 804, and (5) Other packets 890 not involved in name resolution.

  The DNS packet type identifying unit 20 identifies the public information 801, the request 802, and the response 803 based on the respective message types 801a to 803a (see FIG. 2).

  The DNS packet type identification unit 20 sends the received advanced DNS public information 801, advanced name resolution request 802, advanced name resolution response 803, and name resolution request 804 to the advanced DNS public information processing unit 30, advanced name resolution request processing unit 40, respectively. To the advanced name resolution response processing unit 50 and the advanced name resolution request creating unit 60.

  Further, the DNS packet type identification unit 20 gives the packet 890 to a conventional packet processing unit (not shown in FIG. 1).

Steps T100 and T200 : The advanced DNS public information processing unit 30 registers the FQDN 801b indicated in the received advanced DNS public information 801 in the FQDN database 81, and transfers it to the next name resolution / authentication apparatus 100 if necessary. The detailed operation procedure will be described later.

Step T300 : The advanced name resolution request creation unit 60 converts the received conventional name resolution request 804 into an advanced name resolution request 802, which is given to the advanced name resolution request processing unit 40 for processing. The detailed operation procedure will be described later.

Step T400 : The advanced name resolution request processing unit 40, when the source IP address 802d indicated in the received advanced name resolution request 802 has been authenticated (that is, registered in the authentication permitted source IP address database 83) ), After registering the source IP address 802d as a flow identifier in the flow identification entry database 85, the request 802 is transferred to the next name resolution / authentication apparatus 100. The detailed operation procedure will be described later.

Step T500 : When the source IP address 802d indicated in the received advanced name resolution request 802 is registered in the authentication-permitted source IP address database 83, the advanced name resolution request processing unit 40 flows the source IP address 802d. After registration in the flow identification entry database 85 as an identifier, if the request 802 is a name resolution request to the next advanced DNS server 100, an advanced name resolution response 803 that resolves the request 802 is created and returned. The detailed operation procedure will be described later.

Step T600 : If the source IP address 802d is not authenticated, the advanced name resolution request processing unit 40 discards the request 802. The detailed operation procedure will be described later.

Steps T700 and T800 : The advanced name resolution response processing unit 50 registers the resolved IP address indicated in the received advanced name resolution response 803 in the flow identification entry database 85 as a flow identifier, and externally registers an entry in the database 85. Set the gateway router.

 Further, when the IP address of the previous DNS 85c retrieved from the database 85 is not the IP address of the own network, the advanced name resolution response processing unit 50 transfers the response 803 to the previous DNS. When the IP address of the previous DNS 85c is the IP address of the own network, the advanced name resolution response 803 is converted into a conventional name resolution response 805 and transferred to the user terminal 310. The detailed operation procedure will be described later.

  FIG. 4 shows an example of a distribution operation procedure of the advanced DNS public information 801. In the figure, as an example of a network to which the advanced DNS public relations 801 is distributed, a service provider network 500, a relay network 400_1, a relay network 400_2, and a user accommodation network 300 are connected in cascade, and further connected in cascade. -Relay network 400_3-...-Relay network 400_5-A network in which the user accommodation network 300 is connected in parallel is shown.

  In the service provider network 500, the relay network 400_1 to the relay network 400_3, the relay network 400_5, and the user accommodating network 300, a server (name resolution / authentication device) 100_1, servers 100_2 and 100_3, servers 100_4 and 100_5, and a server 100_7 are respectively included. ,..., Server 100_12,..., And server 100_6. Hereinafter, the servers 100_1 to 100_12 may be collectively referred to as the server 100.

  The service provider network 500, the relay network 400_1 to the relay network 400_3,..., The relay network 400_5, and the user accommodating network 300 include an external gateway router 520_1, an internal gateway router 530_1, routers 520_2, 520_3, 530_2, and 530_3, routers 520_4, 520_5, 530_4, and 530_5, routers 520_7 and 530_7, routers 520_12 and 530_12, and routers 520_6 and 530_6 are included. Hereinafter, the routers 520_1 to 520_12 and the routers 530_1 to 530_12 may be collectively referred to as the router 520 and the router 530, respectively.

  The advanced DNS server 100_1 that manages the FQDN (= Abcom) of the service provider server 510 sends the advanced DNS public information 801_1 and 801_6 (see FIG. 2) including the FQDN 801b to the IP registered in the adjacent advanced DNS database 82_1. Distribute to advanced DNS servers 100_2 and 100_7 with addresses (= D2, X2).

  Note that FIG. 1 does not show a functional unit for distributing the advanced DNS public information 801.

Receiving Operation of Advanced DNS Public Information 801 (Step T100): Registration of FQDN FIG. 5 shows an example of an operation procedure when advanced DNS servers 100_2 and 100_7 receive advanced DNS public information 801_1 and 801_7, respectively. An example of this operation procedure in the server 100_2 will be described below.

Steps S100 and S110 : The advanced DNS public information 801 is given to the entry creation unit 31 of the advanced DNS public information processing unit 30 via the communication termination unit 10 and the DNS packet type identification unit 20.

Steps S120 to S140 : The entry creating unit 31 searches whether or not the FQDN 801b = “Abcom” included in the advanced DNS public relations 801 is entered (registered) in the FQDN database 81_2 (see FIG. 4). If not, the FQDN 801b of the advanced DNS public relations 801, the next DNS (may be referred to as the previous advanced DNS server or the source DNS server) 801c, and the number of via DNS 801d = “0” incremented by 1 respectively. Is registered (written) in the FQDN 81a, the next DNS 81b, and the number of transits 81c of the FQDN database 81_2 (search / write 810). Thereafter, the entry creating unit 31 provides the advanced DNS public information 801 to the next DNS determining unit 32.

Advanced DNS PR 801 forwarding action :
Steps S150 to S160 : The next DNS determination unit 32 transmits the advanced DNS information 801 in the advanced DNS server 100 with the IP address = “B2, F2 (see FIG. 4)” registered in the adjacent advanced DNS database 82_2. The advanced DNS public information 801_3 is transferred via the communication termination unit 10 to the advanced DNS server 100_3 whose IP address is “F2” other than the advanced DNS server 100_1.

  At this time, the next DNS determination unit 32 sets the next DNS (source DNS) 801c of the advanced DNS public information 801_2 and the number 801d of the via DNS to “IP address of own device” = “D2” and the received advanced DNS public information 801_1, respectively. Set the number of via DNS 801d = “0” by incrementing “0” by “1”.

  Similarly, the server 100_3 transfers the received advanced DNS PR 801_2 as the advanced DNS PR 801_3 to the server 100_4, the server 100_4 transfers the advanced DNS PR 801_3 as the advanced DNS PR 801_4 to the server 100_5, and the server 100_5 The advanced DNS PR 801_4 is transferred to the server 100_6 as the advanced DNS PR 801_5.

  As a result, the FQDN 81a = “A.b.com”, the next DNS 81b = “J2”, and the number of vias 81c = “5” are registered in the FQDN database 81_6 of the advanced DNS server 100_6.

  Similarly, in the process of step T100, the advanced DNS servers 100_7 to 100_12 sequentially transfer the advanced DNS public relations 801_7 to 801_12 to the advanced DNS servers 100_8 to 100_12 and 100_6.

Advanced DNS PR 801 reception operation (step T200): Discard Advanced DNS PR 801
Step S100 : In the advanced DNS server 100_6, the entry creation unit 31 receives the advanced DNS public information 801_12 via the communication termination unit 10 and the DNS packet type identification unit 20.

Steps S110 to S130, S170 : Since the FQDN 801b = “Abcom” of the advanced DNS public relations 801_12 is entered in the FQDN 81a of the FQDN database 81_6, the entry creation unit 31 uses the FQDN database 801d = “6” and the FQDN database of the public relation 801_12. The number of vias 81c = 81 ”of 81_6 is compared, and the number of via DNS 801d =“ 6 ”> the number of vias 81c =“ 5 ”, so the advanced DNS PR 801_12 is discarded.

 As a result, information on the shortest path between the server 100_1 and the server 100_6 is registered in the FQDN database 81_6 of the server 100_6. In addition, unnecessary public information is not transmitted to the network.

  FIG. 6 shows an example of a transmission sequence of the advanced name resolution request 802. In this example, the advanced name resolution request 802 indicates the shortest path from the server 100_1 to the server 100_6 established by the advanced DNS PR 801 in FIG. In reverse, the data is transmitted.

  Further, in the authentication permission transmission source IP address databases 83_1 to 83_6 of the servers 100_1 to 100_6, for example, a user terminal group that permits authentication in advance via the command interface 70 (see FIG. 1), that is, an IP address group = “ M2 ″ (see FIG. 6) is registered.

  In the figure, only the servers 100_1 to 100_6 related to the shortest path are illustrated, and the servers 100_7 to 100_12 illustrated in FIG. 4 are not illustrated. Further, the adjacent advanced DNS databases 82_1 to 82_6 shown in FIG. 4 are not shown because they are not involved in the transmission of the request 802.

Conventional name resolution request 804 reception and advanced name resolution request 802 transmission operation (step T300)
FIG. 7 shows an operation procedure example of the advanced DNS server 100_6 that has received the conventional name resolution request 804_1 sent from the user terminal 310_1 with the IP address = “M2”. An example of this operation procedure will be described below.

  In FIG. 6, the user terminal 310_1 sends a name resolution request 804_1 (FQDN 804a = “A.b.com”, Src-IP804b = “M2”), which is received by the server 100_6.

Steps S100 and S110 : In FIG. 7, the advanced name resolution request creation unit 60 (see FIG. 1) of the server 100_6 receives the name resolution request 804_1 via the communication termination unit 10 and the identification unit 20.

Step S500 : The request creation unit 60 sends the name resolution request 804_1 to the advanced name resolution request 802 (FQDN802b = “Abcom”, previous DNS802c = “L2 (= IP address of the local server 100_6)”, Src-IP802d = “M2 (= The IP address of the user terminal 310_1) ”and FIG. 2 (2)) are created, and this request 802 is given to the flow identification entry creating unit 42 (see FIG. 1). The previous DNS 802c and Src-IP 802d are information that was not found in the conventional name resolution request.

Step S220 : The creation unit 42 associates the previous DNS 802c = “L2” of the advanced name resolution request 802 with Src-IP802d = “M2” and registers them in the previous DNS 85c and Src-IP 85b of the flow identification entry database 85_6 ( After the search / write 813), the request 802 is given to the destination / source domain determination unit 43.

Step S230 : The determination unit 43 determines whether the request 802 is a name resolution request for a domain name managed by the server 100, that is, whether the request 802 is an advanced name resolution request 802 for the FQDN 801b of the advanced DNS PR 801 sent by the server 100. Determine whether or not.

  Since the determination unit 43 is not a name resolution request for the domain name managed by the server 100 (others), the determination unit 43 gives the request 802 to the next DNS determination unit 45.

Step S240 : The next DNS determination unit 45 searches the FQDN database 81 using FQDN 802b = “Abcom” of the request 802 as a key 814.

Step S250 : “Abcom” is hit (see FQDN 81a in the FQDN database 81_6 in FIG. 6). Therefore, the next DNS determination unit 45 creates an advanced name resolution request 802_1 (FQDN 802b = “Abcom”, previous DNS 802c = IP address “L2” in the local server, source IP address 802d = IP address “M2” of the user terminal) To do.

  Further, the next DNS determination unit 45 obtains the next DNS 81b = “J2 (IP address of the server 100_5)” corresponding to the hit “Abcom” from the FQDN database 81 (search 814), and advanced to the server 100_5. The name resolution request 802_1 is transferred via the communication termination unit 10 (see FIG. 6).

Transfer operation of advanced name resolution request 802 (step T400)
FIG. 8 shows an example of a processing operation procedure of the advanced name resolution request 802_1 in the server 100_5 (see FIG. 6). An example of this procedure will be described below.

Steps S100 and S110 : The source address authenticating unit 41 receives an advanced name resolution request 802_1 (hereinafter, code 802 is used) via the communication terminating unit 10 and the DNS packet type identifying unit 20.

Step S200 : The authentication unit 41 searches the authentication-permitted transmission source IP address database 83 using the transmission source IP address (Src-IP) 802d = “M2” of the request 802 as a key.

Step S210 : The authentication unit 41 determines that the source user terminal 310_1 (source IP address = “M2”) is authenticated because “M2” hits the entry = “M2” in the database 83. Then, a request 802 is given to the flow identification entry creating unit.

Step S220 : The creating unit 42 registers (search / write) the DNS 802c = “L2” before the request 802 and the source IP address 802d = “M2” in association with each other in the flow identification entry database 85_5 (see FIG. 6). 813), the request 802 is given to the destination / source domain determination unit 43.

Step S230 : The determination unit 43 determines whether the request 802 is a name resolution request for the domain name managed by the server 100, and is not a name resolution request for the domain name managed by the server 100 (others Therefore, the request 802 is given to the next DNS determination unit 45.

Step S240 : The next DNS determination unit 45 searches 814 the FQDN database 81_5 using the FQDN 802b = “Abcom” of the request 802 as a key.

Step S250 : Since “Abcom” was hit (see FQDN 81a in the FQDN database 81_5 in the figure), the next DNS determination unit 45 makes a request 802_2 (previous DNS 802c = IP address “J2” of the local server, source IP address 802d = User terminal IP address “M2”, see FIG. 2).

  Then, the next DNS determination unit 45 obtains the next DNS 81b = “H2 (IP address of the server 100_4)” corresponding to the hit “Abcom” from the FQDN database 81, and sends an advanced name resolution request 802_2 to the server 100_4. Then, the data is transferred via the communication terminal unit 10 (see FIG. 6).

  The same transfer operation is performed in the servers 100_4 to 100_2, and advanced name resolution requests 802_3 to 802_5 (see FIG. 6) are transferred to the servers 100_3 to 100_1, respectively.

Example of receiving operation for advanced name resolution request 802 (step T500)
FIG. 9 shows an example of a processing operation procedure of the advanced name resolution request 802_5 in the server 100_1. An example of this procedure will be described below.

Steps S100 and S110 : The source address authenticating unit 41 (see FIG. 1) receives the advanced name resolution request 802_5 (hereinafter, reference numeral 802) via the communication terminating unit 10 and the DNS packet type identifying unit 20. To do.

Steps S200 and S210 : The authentication unit 41 searches the database 83_1 using the transmission source IP address (Src-IP) 802d = “M2” of the request 802 as a key and hits it, so the request 802 is sent to the flow identification entry creation unit 42. give.

Step S220 : The creation unit 42 associates the previous DNS 802c = “D2” of the request 802 with the source IP address 802d = “M2” and registers them in the previous DNS 85c and Src-IP 85b of the flow identification entry database 85_1. The request 802 is given to the destination / source domain determination unit 43.

Step S230 : The determination unit 43 determines whether or not the request 802 is a name resolution request for a domain name managed by the server 100, and the request 802 is a name resolution request for a domain name managed by the server 100. Is given to the name resolution unit 44.

Step S260 : The name resolution unit 44 searches 815 the FQDN database 81 using FQDN 802b = “Abcom” of the request 802 as a key.

Step S270 : Since FQDN81a = “Abcom” is hit (see the FQDN database 81_1 in FIG. 6), the name resolution unit 44 creates an advanced name resolution response 803 (see FIG. 2 (3)) for the request 802.

  That is, the name resolution unit 44 creates a response 803 (resolved IP address 803b = “Abcom IP address“ A1 ””, authentication result 803c = “authentication OK”, source IP address 803d = “M2”) To do.

  As a result, an advanced name resolution response 803 for the advanced name resolution request 802 is created. Further, the name resolution unit 44 provides the response 803 to the flow identification entry appending unit 51.

Steps S300 to S320 : The appending unit 51 searches the Src-IP85b of the flow identification entry database 85 using the transmission source IP address 803d = “M2” in the response 803 as a key, and hits the IP address of the corresponding previous DNS85c. Address = “D2” is the destination of the response 803.

Step S330 : Furthermore, the additional recording unit 51 registers (search / write 816) the resolved IP address = “A1” in the advanced name resolution response 803 in Dst-IP85a of the hit entry, and then sets the response 803 as a router. Give to part 52.

Step S340 : The router setting unit 52 obtains the IP address = “B3” of the external gateway router 520_1 in its own domain from the external gateway router IP address database 84_1 (not shown).

Steps S350 to 360 : Further, the router setting unit 52 searches the flow identification entry database 85 using the source IP address 803d = “M2” in the response 803 as a key, and corresponds to the source IP address 803d = “M2”. After transmitting a flow identification setting signal 806 including a flow identification entry (Dst-IP = “A1”, Src-IP = “M2”) to the external gateway router 520_1, a response 803 is given to the own domain address determination unit 53.

  As a result, the flow identification information (A1, M2) is registered in the external gateway router 520_1.

Steps S370 and S380 : Since the IP address “D2” of the “previous DNS” searched by the flow identification entry appending unit 51 is not the IP address of the own network operator, the determination unit 53 is advanced via the communication termination unit 10. A name resolution response 803 is sent out.

  As a result, the advanced name resolution response 803 is sent to the server 100_6. The procedure for transmitting the response 803 to the user terminal 310_1 will be described later.

  In the above description, the transmission procedure of the advanced name resolution request 802 when the user accommodation network 300, the relay networks 400_1 and 400_2, and the service provider network 500 both authenticate the user terminal 310_1, that is, the IP address = “M2”. An example is shown.

Example of Reception Operation of Advanced Name Resolution Request 802 (Step T600): Authentication Disapproval Processing Next, the name sent by the user terminal 310_2 (see FIG. 6) having an address = “M4” that is not authenticated by the relay network 400_2 An example of the processing procedure for the resolution request 804_2 is shown below.

  In FIG. 6, the user terminal 310_2 sends a name resolution request 804_2 (FQDN 804a = “A.b.com”, Src-IP804b = “M4”), which is received by the server 100_6.

  The processing operation procedure example when the server 100_6 receives the name resolution request 804_2 is the same as the processing procedure example (step T300) shown in FIG. 7 in which the server 100_6 processes the name resolution request 804_1 received from the user terminal 310_1. It is.

Steps S100 and S110 : The advanced name resolution request creation unit 60 (see FIG. 1) receives the name resolution request 804_2 via the communication termination unit 10 and the identification unit 20.

Step S500 : The request creation unit 60 creates an advanced name resolution request 802_6 (FQDN802b = “Abcom”, previous DNS802c = “L2”, Srs-IP802d = “M4”) from the name resolution request 804_2, and the flow identification entry creation unit 42 To give.

Step S220 : The creation unit 42 registers the source IP address (Src-IP) = “M4” of the name resolution request 804 in the previous DNS 85c and Src-IP 85b of the flow identification entry database 85_6, and then performs an advanced name resolution request. 802 is given to the destination / source domain determination unit 43.

Step S230 : Since the request 802 is not a name resolution request for the domain name managed by the server 100, the determination unit 43 gives the request 802 to the next DNS determination unit 45.

Steps S240 and S250 : The next DNS determination unit 45 searches 814 the FQDN database 81 using the FQDN 802b = “Abcom” of the request 802 as a key and finds a hit (see the FQDN 81a of the FQDN database 81_6 in FIG. 6). (FQDN802b = “Abcom”, previous DNS802c = IP address “L2” of the local server, source IP address 802d = IP address of user terminal = “M4”).

  The next DNS determination unit 45 transfers this request 802_6 to the server 100_5 having the IP address of next DNS 81b = “J2” acquired from the FQDN database 81 via the communication termination unit 10 (see FIG. 6).

  Step T600 (portion surrounded by a broken line) in FIG. 8 shows an example of the reception processing operation of the request 802_6 in the server 100_5. An example of this operation will be described below.

Steps S100 and S110 : The source address authenticating unit 41 (see FIG. 1) receives the advanced name resolution request 802_6 (hereinafter abbreviated as 802) via the communication terminating unit 10 and the identifying unit 20.

Steps S200 and S210 : The authentication unit 41 (see FIG. 1) searches 812 the authentication-permitted source IP address database 83 using the source IP address 802d = “M4” in the advanced name resolution request 802 as a key. Since the relay network 400_2 has not authenticated the IP address = “M4”, the authentication unit 41 makes a miss-hit in the search 812 for “M4”.

Step S215 : The authentication unit 41 discards the advanced name resolution request 802.

  As a result, the relay network 400_2 does not permit transmission of the advanced name resolution request 802 from the user terminal 310_2 with the IP address = “M4” that has not been authenticated. Therefore, the advanced name resolution response 803 for the advanced name resolution request 802 is not returned, and the flow identification described later is not entered in the flow identification entry database 85.

  As a result, packet transfer between the user terminal 310_2 and the service provider server 510 via the relay network 400_2 is not performed.

Example of receiving advanced name resolution response 803 (step T700)
FIG. 10 shows an example of a transmission operation procedure of the advanced name resolution response 803_1 sent from the server 100_1 shown in FIG. An example of this operation procedure will be described below.

  The advanced name resolution response 803_1 sent from the server 100_1 is sequentially converted into an advanced name resolution response 803_2 to 803_5 and a name resolution response 805 by the server 100_2 to the server 100_6 and transmitted to the server 100_3 to the server 100_6 and the user terminal 310_1. The

  When the servers 100_2 to 100_6 receive the advanced name resolution responses 803_1 to 803_5, the flow identification setting signals (Dst-IP = “A1”, Src-IP = “ M2 ”) 806_2 ~ 806_6.

  FIG. 11 shows an example of an operation procedure for receiving and processing the advanced name resolution response 803_1 in the server 100_2. This example of the operation procedure will be described below.

Transfer advanced name resolution response 803 and set flow identification information to external gateway (step T800)
Steps S100, S200 : The flow identification entry appending unit 51 passes through the communication termination unit 10 and the DNS packet type identification unit 20, and the advanced name resolution response 803_1 (resolved IP address 803b = “A1”, authentication result 803c = "Authentication OK", Src-IP803d = "M2") is received.

Steps S300 to S320 : The flow identification entry appending unit 51 searches the flow identification entry database 85_2 using Src-IP803d = “M2” of the received response 803_1 as a key 816 (see FIGS. 1 and 10) and hits it. The previous DNS85c = “F2” corresponding to “M2” is set as the next transfer destination.

Step S330 : Furthermore, the flow identification entry appending unit 51 registers (writes 816) the resolved IP address (Dst-IP) 803b = “A1” in the response 803 to the entry that has been hit in the database 85, and then responds. 803 is given to the router setting unit 52.

Step S340 : The router setting unit 52 acquires (search 818) the IP address = “D1” of the external gateway router 520_2 of its own domain from the external gateway router IP address database 84.

Steps S350 and S360 : Further, the router setting unit 52 performs a search 817 of the database 85 using the source IP address = “M2” in the advanced name resolution response 803 as a key, and the flow identification entry (Dst-IP == “A1”, Src-IP = “M2”) is sent to the external gateway router 520_2 with the IP address = “D1”, and then a response 803 is given to the own domain address determination unit 53.

 The external gateway router 520_2 holds it as authenticated flow identification information (Dst-IP = “A1”, Src-IP = “M2”) 521.

Step S370 : Since the previous DNS 85c = “F2” searched by the appending unit 51 is not the IP address of the user terminal included in the own network, the own domain address determination unit 53 sends the advanced name resolution response 803_2 to the IP address = “F2 (= The data is transferred to the server 100_3 of the previous DNS 85c) ”via the communication terminal unit 10.

  Similarly, the servers 100_3 to 100_5 sequentially receive the advanced name resolution responses 803_2 to 803_4 and give the advanced name resolution responses 803_3 to 803_5 to the servers 100_4 to 100_6.

  Similarly, the servers 100_3 to 100_5 give the flow identification setting signals 806_3 to 806_5 to the external gateway routers 520_3 to 520_5, and the external gateway routers 520_3 to 520_5 receive the authenticated flow identification information (Dst-IP = “A1”). , Src-IP = "M2") 521.

Advanced name resolution response 803 / name resolution response 805 conversion and setting of flow identification information to external gateway (step T800)
FIG. 11 also shows an example of an operation procedure in which the server 100_6 processes the received advanced name resolution response 803_5 (see step T800 surrounded by a one-dot chain line). An example of this operation procedure will be described below.

Steps S100, S200, S300 to S360 : The same as the above-described reception processing operation procedure example of the advanced name resolution responses 803_1 to 803_4 in the servers 100_2 to 100_5,
In the database 85_6, Dst-IP85a = "A1" is set, and the flow identification information (Dst-IP = "A1", Src-IP = "M2") 521 is held in the external gateway router 520_6.

Steps S370, S400, S410 : When the IP address of the previous DNS searched by the appending unit 51 is the IP address of the user terminal possessed by the own network, the name resolution response conversion unit 54 converts the advanced name resolution response 803 to the conventional name resolution. The response is converted into a response 805 (Dst-IP = “A1”), and the name resolution response 805 is transferred to the user terminal 310_1 via the communication termination unit 10.

  As a result, the user terminal 310_1 has received the name resolution response 805 to the name resolution request 804_1 (see FIG. 6) via the relay networks 400_1 and 400_2 that authenticate the user terminal 310_1.

Transmission of IP packet FIG. 12 shows an example of a transmission operation sequence of an IP packet 810 (destination IP address 810b = “A1”, transmission source IP address 810c = “M2”) transmitted by the user terminal 310_1. An example of this operation sequence will be described below.

Step T900 : The user terminal 310_1 transmits the transmitted IP packet 810 (destination IP address 810b = “A1”, transmission source IP address 810c = “M2”).

Step T910 : The external gateway router 520_6 receives the IP packet 810 and performs flow identification of the IP packet 810. That is, referring to the flow identification information 521, the flow (destination IP address 810b = “A1”, transmission source) Since the IP address 810c = “M2”) is registered, the IP packet 810 is recognized as being authenticated, and the IP packet is transferred to the next external gateway router 520_5.

Steps T920 to T950 : Similarly, the external gateway routers 520_5 to 520_2 sequentially recognize the received IP packet 810 by referring to the flow identification information 521, the IP packet 810 being authenticated, To the external gateway routers 520_4 to 520_1.

Step T960 : The external gateway router 520_1 refers to the received IP packet 810 with reference to the flow identification information 521, recognizes that the IP packet 810 has been authenticated, and transfers the IP packet to the service provider server 510.

As a result, the IP packet 810 is transferred to the service provider server 510 via the authenticated user accommodation network 300, relay network 400_2, relay network 400_1, and service provider network 500.
(Appendix 1)
A name resolution / authentication method between name resolution / authentication devices provided in each of a plurality of networks that relay IP packets,
A first step of registering an IP address of an adjacent name resolution / authentication device;
A second step of sending an advanced DNS advertisement indicating the FQDN managed by the own device and the IP address of the own device to the neighboring device of the IP address;
A third step of registering the FQDN and the IP address associated with the received advanced DNS advertisement in association with each other when the FQDN indicated in the received advanced DNS advertisement is not registered;
A name resolution / authentication method characterized by comprising:
(Appendix 2) In Appendix 1 above,
In the third step, when the FQDN and the IP address indicated in the received advanced DNS advertisement are not registered in association with each other, the IP address of the received advanced DNS advertisement is changed to the IP address of the own device. A name resolution / authentication method characterized in that the advanced DNS public relations replaced with is forwarded to the neighboring device of the IP address.
(Appendix 3) In Appendix 1 above,
The Advanced DNS PR further includes the number of name resolution / authentication devices passed by itself,
In the third step, the number of vias is further registered in association with the FQDN,
A fourth step of determining whether to register the FQDN of the advanced DNS PR and whether to transfer the advanced DNS PR based on the number of vias indicated by the advanced DNS PR and the registered number of passes,
A name resolution / authentication method characterized by further comprising:
(Appendix 4) In Appendix 1 above,
A fifth step of pre-registering the authenticated source IP address;
When the source IP address indicated in the received advanced name resolution request is registered as the authenticated source IP address, the source IP address and the advanced name resolution request included in the advanced name resolution request are transferred. A sixth step of registering in association with the IP address of the adjacent name resolution / authentication device
A name resolution / authentication method characterized by further comprising:
(Appendix 5) In Appendix 4 above,
A name resolution / authentication method characterized by further comprising, before the sixth step, a seventh step of creating the advanced name resolution request obtained by converting the received name resolution request.
(Appendix 6) In Appendix 4 above,
The sixth step is a name resolution / authentication method characterized by discarding an advanced name resolution request in which the source IP address indicated in the received advanced name resolution request is not the source IP address registered for authentication. .
(Appendix 7) In Appendix 4 above,
An advanced name resolution response to the advanced name resolution request is received, the IP address of the FQDN indicated in the response is also registered in association with the source IP address of the flow identification entry database, and the advanced name resolution response is registered. A name resolution / authentication method, further comprising an eighth step of transferring to an adjacent device having the IP address registered in the flow identification entry database.
(Appendix 8) In Appendix 7 above,
A name resolution / authentication method comprising: a ninth step of converting the advanced name resolution response into a name resolution response and transferring it to a conventional terminal.
(Appendix 9) In Appendix 7 above,
A tenth step of pre-registering the IP address of the external gateway router of the network to which the device belongs;
An eleventh step of setting at least one of the IP address of the FQDN and the source IP address in the registered external gateway router;
A name resolution / authentication method characterized by further comprising:
(Appendix 10)
A name resolution / authentication device provided in each of a plurality of networks that relay IP packets,
An adjacent advanced DNS database that registers the IP addresses of adjacent name resolution / authentication devices,
An advanced DNS public information sending unit that sends an advanced DNS public information indicating the FQDN managed by the own device and the IP address of the own device to the device having the IP address registered in the adjacent advanced DNS database;
FQDN database,
When the FQDN indicated in the received advanced DNS advertisement is not registered in the FQDN database, the advanced FQDN is registered in the FQDN database in association with the FQDN indicated in the received advanced DNS advertisement and the IP address. DNS public information processing department,
A name resolution / authentication device characterized by comprising:
(Appendix 11) In Appendix 10 above,
The advanced DNS public information processing unit further includes the IP address of the received advanced DNS public information when the FQDN and the IP address indicated in the received advanced DNS public information are associated and not registered in the FQDN database. A name resolution / authentication device that forwards an advanced DNS advertisement in which the IP address of the device is replaced to a device having an IP address registered in the adjacent advanced DNS database.
(Supplementary note 12) In the above supplementary note 10,
The Advanced DNS PR further includes the number of name resolution / authentication devices that the user has passed through,
In the FQDN database, the number of vias is registered in association with the FQDN.
The advanced DNS PR processing unit further determines whether to register the FQDN of the advanced DNS PR in the FQDN database based on the number of vias indicated by the advanced DNS PR and the number of vias registered in the FQDN database. A name resolution / authentication apparatus for determining whether to forward the advanced DNS public information.
(Supplementary note 13) In the above supplementary note 10,
An authentication permitted source IP address database in which authenticated source IP addresses are registered in advance;
A flow identification entry database;
When the source IP address indicated in the received advanced name resolution request is registered in the authentication-permitted source IP address database, the source IP address included in the advanced name resolution request and the advanced name resolution request are An advanced name resolution request processing unit that registers in the flow identification entry database in association with the IP address of the transferred adjacent name resolution / authentication device;
A name resolution / authentication device further comprising:
(Supplementary note 14) In the above supplementary note 13,
A name resolution / authentication apparatus, further comprising: an advanced name resolution request creation unit that creates an advanced name resolution request obtained by converting a received name resolution request and gives the request to the advanced name resolution request processing unit.
(Supplementary note 15) In the above supplementary note 13,
The advanced name resolution request processing unit discards the advanced name resolution request when the source IP address indicated in the received advanced name resolution request is not registered in the authentication permission source IP address database. Name resolution / authentication device.
(Supplementary Note 16) In the above supplementary note 13,
An advanced name resolution response to the advanced name resolution request is received, the IP address of the FQDN indicated in the response is also registered in association with the source IP address of the flow identification entry database, and the advanced name resolution response is registered. A name resolution / authentication apparatus, further comprising: an advanced name resolution response processing unit for forwarding to an adjacent apparatus having the IP address registered in the flow identification entry database.
(Supplementary Note 17) In the above supplementary note 16,
An advanced name resolution response processing unit converts the advanced name resolution response into a name resolution response and forwards the response to the adjacent device of the IP address registered in the flow identification entry database. -Authentication device.
(Appendix 18) In Appendix 16 above,
An external gateway router IP address database in which the IP address of the external gateway router of the network to which the device belongs is registered in advance;
The advanced name resolution response processing unit sets at least one of the IP address and source IP address of the FQDN registered in the flow identification entry database in the external gateway router registered in the external gateway router IP address database. Name resolution / authentication device characterized by

It is the block diagram which showed the Example of the name resolution / authentication apparatus which concerns on this invention. It is the figure which showed the example of a message transmitted / received between the name resolution / authentication apparatuses which concern on this invention. It is the flowchart figure which showed the example of the whole operation | movement procedure of the name resolution / authentication apparatus which concerns on this invention. FIG. 5 is a sequence diagram showing an example of an operation procedure (forwarding process T100 and discarding process T200) of advanced DNS public information transmitted / received between name resolution / authentication apparatuses according to the present invention. FIG. 10 is a flowchart showing an example of an advanced DNS public information processing procedure (transfer processing T100 and discard processing T200) in the name resolution / authentication apparatus according to the present invention. FIG. 6 is a sequence diagram showing an example of an advanced name resolution request processing operation procedure (name resolution request conversion processing T300, transfer processing T400, response processing T500, and authentication rejection processing T600) transmitted and received between the name resolution / authentication apparatus according to the present invention. is there. It is the flowchart figure which showed the example of a procedure of the name resolution request / advanced name resolution request conversion process (T300) transmitted / received between the name resolution / authentication apparatuses according to the present invention. FIG. 12 is a flowchart showing an example of an operation procedure of an advanced name resolution request (transfer process T400 and authentication rejection process T600) in the name resolution / authentication apparatus according to the present invention. It is the flowchart figure which showed the example of an operation procedure of the advanced name resolution response process (T500) with respect to the advanced name resolution request in the name resolution / authentication apparatus according to the present invention. FIG. 10 is a sequence diagram showing an example of operation procedures of advanced name resolution response transfer processing (T700) and advanced name resolution response / name resolution response conversion processing (T800) in the name resolution / authentication apparatus according to the present invention. It is the flowchart figure which showed the example of an operation | movement procedure of the transfer process (T700) of an advanced name resolution response and the advanced name resolution response / name resolution response conversion process (T800) in the name resolution / authentication apparatus according to the present invention. FIG. 10 is a sequence diagram showing an example of an IP packet transfer processing procedure (T900 to T920) in the name resolution / authentication apparatus according to the present invention. It is the block diagram which showed the general domain tree. It is the block diagram which showed the example of a connection of a general user accommodation network, a relay network, and a service provider network. It is the figure which put together the conventional technique for authentication.

Explanation of symbols

100, 100_1 ~ 100_12 Name resolution / authentication device, advanced DNS server
10 Communication termination part 20 DNS packet type identification part
30 Advanced DNS Public Relations Processing Department 31 Entry Creation Department
32nd DNS decision part
40 Advanced name resolution request processing part
41 Source address authentication unit 42 Flow identification entry creation unit
43 Destination / source domain determination unit
44 Name Resolution Department, Advanced Name Resolution Response Creation Department
45th DNS decision part
50 Advanced name resolution response processing part
51 Flow identification entry appending part 52 Router setting part
53 Own domain addressing part 54 Name resolution response conversion part
60 Advanced name resolution request generator
70 Command interface 80 Database part
81, 81_1 to 81_12 FQDN database 81a FQDN
Number via 81b next DNS 81c
82, 82_1-82_12 Adjacent advanced DNS database
82a, ... IP address
83, 83_1 to 82_6 Authentication permitted sender IP address database
83a, ... Source IP address, Src-IP
84 External gateway router IP address database
84a, ... IP address
85, 85_1 to 85_6 Flow identification entry database
85a Destination IP address, Dst-IP 85b Source IP address, Src-IP
85c Pre-DNS
300 user accommodation network 310, 310_1, 310_2 User terminal
400, 400_1 to 400_5 Relay network 500 Service provider network
510 Web server, service provider server
520,520_1 ~ 520_12 External gateway router
521 Flow identification information
530, 530_1 to 530_12 Internal gateway router
600 network 800 packets
801,801_1 ～ 801_12 Advanced DNS public relations
801a Message type 801b FQDN
801c Number of DNS via next DNS 801d
802, 802_1 to 802_6 Advanced name resolution request
802a Message type 802b Conventional DNS request information, FQDN
802c Pre-DNS 802d Source IP address, Src-IP
803, 803_1 to 803_5 Advanced name resolution response
803a Message type
803b Resolved IP address, traditional name resolution response information
803c Authentication result 803d Source IP address, Src-IP
804, 804_1, 804_2 Name resolution request
804a FQDN 804b Src-IP
805 Name resolution response 805a Dst-IP
806, 806_1 to 806_6 Flow identification setting signal
810, 813, 816 Search / Write
811, 812, 814, 815, 817, 818 search
820 to 823 settings 890 packets
A1-Z1, A2-Z2, B3-Z3, C4, K4, M4 IP address
Abcom domain name In the figure, the same symbols indicate the same or corresponding parts.

Claims (4)

A name resolution / authentication method between name resolution / authentication devices provided in each of a plurality of networks that relay IP packets,
A first step of registering an IP address of an adjacent name resolution / authentication device;
A second step of sending an avantaged DNS advertisement including the number of name resolution / authentication devices passed by itself to the neighboring device, indicating the FQDN managed by the own device and the IP address of the own device;
When the FQDN indicated in the received Advanced DNS PR is not registered, the FQDN indicated in the received Advanced DNS PR and the IP address are registered in association with each other , and the number of vias is registered in the FQDN. A third step of registering in association ;
Whether to register the FQDN of the advanced DNS PR in the FQDN database, whether to transfer the Advanced DNS PR based on the number of vias indicated by the Advanced DNS PR and the number of vias registered in the FQDN database A fourth step of determining
A name resolution / authentication method characterized by comprising: In claim 1,
In the third step, when the FQDN and the IP address indicated in the received advanced DNS advertisement are not registered in association with each other, the IP address of the received advanced DNS advertisement is changed to the IP address of the own device. A name resolution / authentication method characterized in that the advanced DNS public relations replaced with is forwarded to the neighboring device of the IP address. A name resolution / authentication device provided in each of a plurality of networks that relay IP packets,
An adjacent advanced DNS database that registers the IP addresses of adjacent name resolution / authentication devices,
Shows the FQDN managed by the local device and the IP address of the local device, and sends the advanced DNS information including the number of name resolution / authentication devices passed by itself to the device with the IP address registered in the adjacent advanced DNS database. Advanced DNS public information sending part to send,
An FQDN database for registering the number of name resolution / authentication devices passed through the advanced DNS public relations in association with the FQDN;
When shown in the advanced DNS publicity it received FQDN is not registered in the FQDN database, and registers to the FQDN database in association with the FQDN and the IP address shown in the advanced DNS publicity thus received Whether to register the FQDN of the advanced DNS public relations in the FQDN database based on the number of passages indicated by the advanced DNS public relations and the number of passages registered in the FQDN database; Advanced DNS public relations processing department to decide ,
A name resolution / authentication device characterized by comprising: In claim 3,
The advanced DNS public information processing unit further includes the IP address of the received advanced DNS public information when the FQDN and the IP address indicated in the received advanced DNS public information are associated and not registered in the FQDN database. A name resolution / authentication device that forwards an advanced DNS advertisement in which the IP address of the device is replaced to a device having an IP address registered in the adjacent advanced DNS database.

Images