JP4628938B2 - Data communication system, terminal device and VPN setting update method - Google Patents

Description

  The present invention relates to a network that includes a plurality of VPNs (Virtual Private Networks) and that allows one terminal device (data communication terminal device) to be simultaneously connected to a plurality of VPNs. In particular, the terminal device participates in the VPN. In particular, the present invention relates to a data communication system that dynamically performs processing such as leaving, a terminal device thereof, and a VPN setting updating method.

  VPN is a term indicating a private communication network (private network) constructed on the network in order to use a shared (public) network as a virtual private line, or a usage technology thereof. Recently, a service has been provided that enables connection from a remote location such as a business trip destination to the company's intranet, etc., using this VPN. It is steadily penetrating as a center.

  By the way, in order for a remote terminal device to connect to its own intranet or the like, the terminal device must be able to connect to a network configured as a VPN. Here, as a conventional method for configuring the VPN, for example, there are a method using IPSec, a method using MPLS / VPN (see Non-Patent Document 1 below), and the like. However, in any of these methods, in order for the terminal device to connect to the VPN, a logical connection (for example, IPSec tunnel mode Security Association (hereinafter referred to as “IPsec_SA” when using IPSec), In the case of MPLS / VPN, an edge device is required to establish a point-to-point protocol over Ethernet (registered trademark) session (hereinafter referred to as a “PPPoE session”). The terminal device identifies the VPN to which the terminal device is to be connected, determines whether or not to connect to the VPN, and assigns an IP address to the terminal device. Based on the function of such an edge device, Connection with VPN There is realized.

IETF RFC2547bis

  However, the VPN configuration method according to the above prior art has the following problems.

[Various problems associated with connection between terminal device and VPN]
In order for the terminal device to connect to the VPN, the edge device constituting the VPN needs to satisfy any of the following requirements.
(A) A necessary setting for mediating a connection between a terminal device and a VPN that the terminal device desires to connect to is provided in the edge device in advance.
(B) Means and procedures are provided for dynamically establishing a connection between the edge device and the VPN when the terminal device is connected to the edge device.

  Here, when the requirement (a) is satisfied, there is a problem that the setting work for the edge device becomes enormous when the number of VPNs to be connected to the terminal device increases, and resources such as memory are There is a problem that it is consumed even for a VPN that is not used. In addition, when supporting the function of dynamically creating / deleting a VPN, it is necessary to set information regarding the VPN to be created / deleted for all edge devices, and the number of messages exchanged between the edge devices is There is a problem that the processing increases and the processing becomes complicated.

  On the other hand, when the requirement (b) is satisfied, the function for dynamically establishing the connection between the edge device and the VPN at the time when the terminal device has connected to the edge device is the IPSec method as well as the MPLS. There is no standard for the / VPN system. For this reason, it is necessary to realize the above-mentioned function with a unique procedure.

  For example, when the IPSec method is used, in order to dynamically establish a connection between the edge device and the VPN when the terminal device is connected to the edge device, the edge device is connected to the VPN. In addition, the edge device itself needs to dynamically connect to the VPN. In order to realize this function, for example, it is necessary to provide another edge device for connecting the edge device to the VPN. Then, the edge device uses some means (for example, means for reading the setting data, means for searching the external database, etc.) for the IP address of the other edge device that is the other party that establishes IPSec_SA to connect to the target VPN. In addition, it is necessary to exchange a plurality of round-trip messages (3 round trips in the aggressive mode and 4.5 round trips in the main mode) to establish IPSec_SA with the counterpart edge device. Furthermore, when dynamically creating / deleting a VPN, it is necessary to determine an edge device that accommodates the VPN and to set the edge device to realize the VPN.

  On the other hand, when MPLS / VPN is used, in order to dynamically establish a connection between the edge device and the VPN when the terminal device is connected to the edge device, the VPN of the connection destination to the edge device is used. It is necessary to set VRF (Virtual Routing Forwarding) and interface corresponding to, and exchange routing information in the VPN with BGP (Border Gateway Protocol) with all other edge devices. A number of message transmissions proportional to the number of devices are required.

  As described above, in order to support dynamic VPN creation / deletion based on the IPSec method or the MPLS / VPN method, there is a problem that a large number of message transmissions are required and the processing becomes complicated.

[Scalability issues with increasing number of terminal devices]
Routing information propagation within the VPN including the edge device is performed based on a normal IP routing protocol (for example, RIP (Routing Information Protocol) or OSPF (Open Shortest Path First)). Here, when the VPN connection with the same IP address is possible even if the terminal device is connected via any edge device, the IP address of the terminal device does not belong to the subnet address assigned to the edge device in the VPN In order to prevent this from occurring, the edge device needs to advertise the host address assigned to the terminal device using a routing protocol. The routing information to the host address is set in the routing table of all edge devices and all routers in the VPN, and the routing information changes according to the routing protocol each time the terminal device is connected / disconnected. Is advertised to the entire VPN, and there is a problem that scalability against an increase in the number of terminal devices is poor.

  If the terminal device supports the mobile IP function, a mobile IP home agent (HA) is installed in the VPN, and the IP address assigned by the edge device is set as a care-of address (Care of). There is also a technique in which the edge device does not advertise the host address of the terminal device by a routing protocol by using the communication as the address (CoA). However, in this method, since it is assumed that mobile IP is used, all terminal devices that access the VPN must have a mobile IP function, and a home agent must be installed. There was a problem.

  The present invention has been made in view of the above, and a data communication system that enables dynamic VPN creation / deletion with a simpler procedure than when using the IPSec scheme or the MPLS / VPN scheme, and An object is to obtain the terminal device and the VPN setting update method.

  Further, even when the terminal device is connected to the VPN via any edge device without supporting the mobile IP, data communication that enables communication using the same IP address in the VPN It is an object of the present invention to obtain a system, a terminal device thereof, and a VPN setting update method.

  In order to solve the above-described problems and achieve the object, the present invention is a data communication system capable of configuring a plurality of VPNs (Virtual Private Networks) on an IP network, and is registered as a member of a VPN. Information on the VPN identifier of the default VPN to which the terminal device belongs is stored, an authentication server that authenticates the terminal device that requests connection to a predetermined VPN based on the VPN identifier of the default VPN, and DHT (on the IP network) An overlay network that provides a search function of the Distributed Hash Table) method, an edge device that holds predetermined information for performing connection processing between the terminal device and the VPN and IP packet transfer processing, the plurality of VPNs, and the VPN Become a VPN member A VPN member management server that holds predetermined information for managing the terminal device, and the edge device belongs to the terminal device after establishing a logical connection with the terminal device that requests connection to the VPN. VPN information is acquired from a VPN member management server, and connection setting processing between the terminal device and a VPN to which the terminal device requests connection is performed based on the VPN information acquired from the VPN member management server. To do.

  According to the present invention, an edge device that constructs an overlay network that provides a DHT search function on an IP network, and a VPN member management server that manages a plurality of VPNs and terminal devices that can be members of the VPN are provided. The edge device establishes a logical connection with the terminal device that requests connection to the VPN, and then connects the terminal device and the VPN that the terminal device requests to connect based on the VPN information acquired from the VPN member management server. Since setting processing is performed, dynamic VPN creation / deletion can be performed with a simpler procedure than when using the IPSec method or MPLS / VPN method, and the terminal device supports mobile IP. Without connecting to the VPN via any edge device, even within the VPN An effect that can communicate using an IP address.

  Hereinafter, embodiments of a data communication system and a data communication method according to the present invention will be described in detail with reference to the drawings. In addition, this invention is not limited by this embodiment.

Embodiment 1 FIG.
FIG. 1 is a diagram illustrating a configuration example of a network that implements the data communication system according to the first embodiment of the present invention, and the network is a terminal that is connected to an IP network corresponding to an IP multicast that connects edge devices. , 1-m, edge devices 2-1, 2-2,..., 2-n connected to the IP network and constructing an overlay network, and various information for each VPN VPN member management server 3 for managing the authentication, and authentication server 4 for authenticating the terminal device.

  Here, in the network of the present embodiment realizing the data communication system according to the present invention, the VPN is identified by the subnet portion of the IP address. In this way, terminal devices belonging to the same VPN can belong to the same subnet, and a plurality of VPNs can be simultaneously realized on the IP network. Note that the bit lengths of the subnet portions are not necessarily the same, but are preferably the same for any VPN in order to simplify the processing.

  In addition, a label for identifying on which VPN the IP packet is transmitted / received can be given to the IP packet transmitted / received in the IP network. In addition, by giving such a label, the terminal devices (terminal devices 1-1 to 1-m shown in FIG. 1) can be simultaneously connected to a plurality of VPNs.

(Configuration of terminal device 1)
FIG. 2 is a diagram illustrating a configuration example of the terminal device 1 (corresponding to the terminal devices 1-1 to 1-m). For example, a PC (personal computer) using Linux as an OS can be used. . As illustrated in FIG. 2, the terminal device 1 includes an IP communication module 11, a tunnel communication module 12, a virtual interface driver 13, an application 14, and a database 15.

  The IP communication module 11 provides a function of performing IP protocol processing for realizing IP communication between the terminal device 1 and the edge device 2 via the IP network. For example, an IP protocol stack S / W (software) included in Linux ).

  The tunnel communication module 12 performs communication protocol processing for realizing a logical connection between the terminal device and the edge device. For example, a logical connection is realized by using the IPSec tunnel mode as a communication protocol. When a labeled IP packet is transferred on a logical connection represented by IPSec_SA, an IP packet having the same label as the MPLS label format defined in RFC 3032 of IETF (Internet Engineering Task Force) is transferred. Whether the IP packet with a label transferred on the logical connection is an IP packet that becomes user traffic or an IP packet for VPN-related control is the value of the Protocol field of the IPv4 header or the Next Header field of the IPv6 header. It is determined whether or not the value is an IP packet for control related to VPN.

  The virtual interface driver 13 provides a function (virtual interface) for making the identifier and label value of the logical connection appear as one interface capable of IP communication to the IP communication module. For example, Linux It can be realized as a device driver.

  The application 14 is an application that operates on Linux, for example, IP communication on a VPN using a socket interface, participation / leaving to / from a VPN using an API (Application Program Interface) provided by a virtual interface driver, A function of transmitting / receiving a control signal for instructing generation / deletion of VPN and member addition / deletion to VPN is realized.

  In addition, the database 15 includes “a database that uses a virtual interface identifier as a key and a label value used by the virtual interface as data” and “a virtual interface identifier that is associated with a label using the label value as a data. To manage the database. And it implement | achieves as S / W which provides the search function of the registered data.

  The terminal device 1 having the above-described configuration is connected to an edge device (the edge devices 2-1,..., 2 shown in FIG. 1) through a logical connection having an authentication function, a confidentiality function, and a tampering prevention function between communication parties. -N). Then, the terminal device 1 performs transmission / reception of a control message and transmission / reception of an IP packet for performing participation in the VPN or the like via the logical connection.

  Here, the control message includes “VPN join request MSG (message) and response MSG”, “VPN leave request MSG and response MSG”, “VPN generation request MSG and response MSG”, “VPN deletion request MSG and response MSG” ”,“ Member addition request MSG and response MSG ”, and“ Member deletion request MSG and response MSG ”. The terminal device 1 uses these messages to join and leave the VPN, create and delete the VPN, add and remove the members from the VPN, as an edge device (the edge device 2-1, shown in FIG. 1,... , 2-n).

  The terminal device 1 treats each label value on the logical connection as a virtual interface capable of transmitting and receiving IP packets.

(Configuration of edge device 2)
FIG. 3 is a diagram illustrating a configuration example of the edge device 2 (corresponding to the edge devices 2-1 to 2-n). For example, a PC using Linux as an OS can be used. As shown in FIG. 3, the edge device 2 includes an IP communication module 21, a database 25, a DHT search module 26, a control module 27, and a tunnel communication module 12. The tunnel communication module 12 is the same as the tunnel communication module provided in the terminal device 1.

  The IP communication module 21 communicates between the terminal device 1 and the edge device 2 via the IP network and other edge devices (the edge devices 2-1, 2-2, ..., 2-n). ), IP communication between the edge device 2 and the authentication server 4, and IP communication between the edge devices 2-1, 2-2,..., 2-n and the VPN member management server 3. A function for performing IP protocol processing is provided, and is realized by, for example, an IP protocol stack S / W included in Linux.

  The database 25 manages a database that exists in the edge device 2. And it implement | achieves as S / W which provides the search function of the registered data. The database 25 is a summary of the following six types of databases.

  "Database with VPN identifier, terminal device identifier and IP address within VPN as data using pair of identifier and label value of logical connection with terminal device as key", "IP with VPN IP address as key and its IP “Database with logical connection identifier and label value pair as data between terminal device using address”, “between terminal device used for connection to VPN with VPN identifier as key Database having data as a list of pairs of logical connection identifiers and label values ”,“ database using VPN identifiers as keys and multicast IP addresses and subnet addresses associated with the VPNs ”,“ multicast IP addresses As the key to the multicast IP address Database "that the response with is VPN identifier and data," the subnet address as the key, the database that the VPN identifier that is associated with the subnet address and data. "

  Each of the above six databases does not necessarily have to be stored as an individual database. A single database is configured, and each data item in the above six databases is extracted using predetermined item data as a key. It may be configured such that.

  The DHT search module 26 is, for example, “Building Peer-to-Peer Systems With Chord, a Distributed Lookup Service, F. Dabek, E. Brunskill, M. Kashoek, D. M. Kashoek, D.K. .. Balakishnan, Proceeding of the 8th Workshop on Hot Topics on Operating Systems, May, 2001 ”, which is a DHT (Distributed Hash) device that is a DHT (Distributed Hash) device described in the implementation method of Chord shown in When an IP address is given, The terminal device provides a function for determining an edge device that has established a logical connection (hereinafter, "edge device that has established a logical connection ..." is simply expressed as "connected edge device ...") To do.)

  The control module 27 is realized as, for example, S / W, and controls other modules (the IP communication module 21, the tunnel communication module 12, etc.) constituting the edge device 2.

  The edge device 2 connected to the IP network constructs an overlay network together with other edge devices, and provides a function of performing a search in the DHT method in the network according to, for example, the above-described Chord method.

(Configuration of VPN member management server 3)
Next, the VPN member management server 3 will be described with reference to FIG. FIG. 4 is a diagram illustrating a configuration example of the VPN member management server 3. For example, a PC using Linux as an OS can be used. As shown in FIG. 4, the VPN member management server 3 includes an IP communication module 31, a database 35, a control module 37, and a DHT search module 26. The DHT search module 26 is the same as the DHT search module provided in the edge device 2.

  The IP communication module 31 provides a function of performing IP protocol processing for realizing IP communication between the edge device 2 and the VPN member management server 3 via the IP network. For example, the IP protocol stack S / W included in Linux It is realized by.

  The database 35 manages the database existing in the VPN member management server 3 for each VPN using the VPN identifier as a key. And it implement | achieves as S / W which provides the search function of the registered data. The database managed by the database 35 includes “multicast IP address information used when forwarding broadcast / multicast packets on VPN”, “subnet address information associated with VPN”, and “each terminal device that can be a VPN member”. (List of sets of terminal device identifiers and IP addresses assigned to the terminal devices) ”, which is referred to as a VPN information database.

  In addition, the control module 37 is realized as, for example, S / W, and controls other modules (such as the IP communication module 31) configuring the VPN member management server 3.

  When the VPN member management server 3 receives the VPN member inquiry request MSG including the VPN identifier and the terminal device identifier, can the terminal device specified by the terminal device identifier participate in the VPN specified by the VPN identifier? As a result of the check, the IP address assigned to the terminal device when participation is possible, the multicast IP address used when forwarding broadcast / multicast packets on the VPN, and the subnet address associated with the VPN A member inquiry response MSG notifies (replies).

(Configuration of authentication server 4)
Next, FIG. 5 is a diagram illustrating a configuration example of the authentication server 4. For example, a PC using Linux as an OS can be used. As shown in FIG. 5, the authentication server 4 includes an IP communication module 41, a database 45, and a control module 47.

  The IP communication module 41 provides a function of performing IP protocol processing for realizing IP communication between the edge devices 2-1, 2-2,..., 2-n and the authentication server 4 via the IP network. This is realized by an IP protocol stack S / W included in Linux.

  The database 45 manages a database existing in the authentication server 4. And it implement | achieves as S / W which provides the search function of the registered data. The database 45 manages “secret information necessary for terminal device authentication” and “VPN identifier of default VPN to which the terminal device belongs”.

  The control module 47 is realized as, for example, S / W, and controls other modules (such as the IP communication module 41) that constitute the authentication server 4.

  When the authentication server 4 receives the authentication request MSG, the authentication server 4 performs an authentication process of the terminal device based on the terminal device identifier included in the authentication request MSG and information necessary for the terminal device authentication, and the authentication result, The VPN identifier of the VPN to which the terminal device belongs by default is notified (returned) by the authentication response MSG.

(Create VPN with terminal device)
Next, an example of an operation in which the terminal device 1-1 creates a new VPN via a connection with an existing VPN will be described with reference to FIG. FIG. 6 is a sequence diagram illustrating an example of an operation in which the terminal device 1-1 creates a VPN. In addition, it is assumed that a logical connection has been established between the terminal device 1-1 and the edge device 2-1.

  The terminal apparatus 1-1 transmits a VPN generation request MSG including a VPN identifier indicating a VPN to be newly created to the edge apparatus 2-1 on the virtual interface (step S1).

  The edge device 2-1 searches the database 25 for the terminal device identifier of the terminal device 1-1 using the logical connection identifier and label value pair included in the VPN generation request MSG received from the terminal device 1-1 as a key. (Step S2). Then, the edge device 2-1 transmits a VPN creation request MSG including the terminal device identifier of the terminal device 1-1 acquired by the search and the VPN identifier to the VPN member management server 3 (step S3).

  If the VPN identifier included in the received VPN creation request MSG is not registered, the VPN member management server 3 executes the process described below and updates the database 35 (VPN information database) (step S4).

  The VPN member management server 3 determines that “the subnet address assigned to the VPN corresponding to the VPN identifier (a newly created VPN) (a value that does not overlap with the subnet address already assigned to another VPN identifier)” and “the VPN identifier A multicast IP address (a value that does not overlap with a multicast IP address assigned to another VPN identifier) used when forwarding a broadcast / multicast packet on the corresponding VPN is determined. Then, the VPN member management server 3 adds the data to the database 35 as a database managed using the VPN identifier as a key. Further, the VPN member management server 3 adds the “specified VPN creation request MSG” to the “list of combinations of terminal device identifiers for each terminal device that can be VPN members and IP addresses assigned to the terminal devices” included in the database 35. The information on the set of the terminal device identifier and the IP address assigned to it is added (step S4).

  Then, the VPN member management server 3 sends the VPN creation response MSG (successful creation, IP address assigned to the terminal device, multicast IP address used when forwarding broadcast / multicast packets on the VPN, subnet address associated with the VPN. Are transmitted to the edge device 2-1 (step S5). When the VPN identifier included in the VPN creation request MSG received from the edge device 2-1 has been registered, the VPN member management server 3 sends a VPN creation response MSG (creation failure) indicating a VPN creation failure to the edge device. Transmit to 2-1.

  When receiving the VPN creation response MSG indicating the success of the VPN creation, the edge device 2-1 transfers the packet within the VPN on the logical connection with the terminal device 1-1 to the head of the IP packet. The label value used by the label to be attached is determined (step S6). Note that the value of the label is determined to be unique within the logical connection.

  Next, the edge device 2-1 executes processing described below and updates the database 25 (step S7).

  The edge device 2-1 records the VPN identifier, the terminal device identifier, and the IP address in the VPN in the database 25 using the identifier and label value pair of the logical connection with the terminal device 1-1 as a key. Further, the edge device 2-1 records the identifier and label value pair of the logical connection with the terminal device 1-1 in the database 25 using the IP address in VPN as a key. Further, the edge device 2-1 obtains the logical connection identifier and the list of the logical connection identifier and label value pair with the terminal device obtained by searching the database 25 using the VPN identifier as a key. Add label-value pairs. (Update the list in the database 25). As a result of searching the database 25 using the VPN identifier as a key, the edge device 2-1 cannot obtain a list of logical connection identifier and label value pairs with the terminal device (the specified VPN identifier). If the corresponding list is not stored in the database 25), the data having the empty list as data with the VPN identifier as a key is added to the database 25 (after creating a new empty list), and the logical A pair of connection identifier and label value is added (step S7).

  Then, the edge device 2-1 receives the VPN generation response MSG (successful, including the IP address and label value assigned to the terminal device 1-1) to which the same label as that given to the VPN generation request MSG is given. Then, the data is transmitted to the terminal device 1-1 over the logical connection (step S8).

  Hereinafter, the edge device 2-1 registers a record having the IP address of the own device as data, with the IP address assigned to the terminal device 1-1 as a key on the overlay network that provides the DHT search function described above ( Step S9). When the terminal device 1-1 is connected to the newly created VPN, the edge device 2-1 performs the following processing.

  The edge device 2-1 includes data of “multicast IP address and subnet address using VPN identifier (of newly created VPN) as key”, data of “VPN identifier using multicast IP address as key”, and “subnet Data of “VPN identifier” using the address as a key is recorded in the database 25. Then, the multicast IP address is joined to receive the packet addressed to the multicast IP address.

  When the edge device 2-1 receives a VPN creation response MSG indicating VPN creation failure from the VPN member management server 3, the edge device 2-1 transmits a VPN generation response MSG (failure) indicating that fact to the terminal device 1-1. .

  When receiving the VPN generation response MSG (successful generation) indicating the success of the VPN generation, the terminal device 1-1 treats the pair of the logical connection identifier and the label value indicated in the VPN generation response MSG as a virtual interface, and creates a VPN. The IP address indicated in the generation response MSG is set as the IP address of the virtual interface. Next, the terminal device 1-1 determines an identifier representing the virtual interface, and records the association between the virtual interface identifier and the label value in the database 15 (step S10).

(Adding members to the VPN using a terminal device)
Next, an example of an operation in which the terminal device 1-1 adds a member to an existing VPN will be described with reference to FIG. FIG. 7 is a sequence diagram showing an example of an operation for adding a member to an existing VPN. In addition, it is assumed that a logical connection has been established between the terminal device 1-1 and the edge device 2-1.

  On the virtual interface, the terminal device 1-1 transmits a member addition request MSG including a VPN identifier indicating the VPN to which a member is to be added and a terminal device identifier indicating the member to be added to the edge device 2-1. Step S11).

  The edge device 2-1 uses the pair of the logical connection identifier and the label value included in the member addition request MSG received from the terminal device 1-1 as a key for the terminal device 1-1 that is the terminal device of the addition request source. The terminal device identifier (hereinafter referred to as “addition request source terminal device identifier”) is searched in the database 25 (step S12). Then, the edge device 2-1 includes the additional request source terminal device identifier acquired by the search, the terminal device identifier (hereinafter referred to as “addition target terminal device identifier”) included in the member addition request MSG, and the VPN identifier. VPN member addition request MSG including is transmitted to the VPN member management server 3 (step S13).

  The VPN member management server 3 executes the processing described below and updates the database 35 (VPN information database) (step S14).

  The VPN member management server 3 searches the database 35 using the VPN identifier included in the VPN member addition request MSG received from the edge device 2-1 as a key. If the additional target terminal device identifier is unregistered in the search result “information for each terminal device that can be a VPN member (list of set of terminal device address and IP address assigned to terminal device)”, the VPN member management server 3 determines an IP address to be assigned to the terminal device to be added. Further, the VPN member management server 3 uses the IP address and the terminal device identifier to be added to the “information for each terminal device that can be a VPN member (terminal device address and IP address to be assigned to the terminal device) included in the database 35. List) ”(step S14).

  Then, the VPN member management server 3 transmits a VPN member addition response MSG (addition success) indicating the successful addition of the member to the VPN to the edge device 2-1 (step S15). When the addition target terminal device identifier has already been registered in the “information for each terminal device that can be a VPN member” searched using the VPN identifier as a key, the VPN member management server 3 indicates that the member addition to the VPN has failed. A VPN member addition response MSG (addition failure) is transmitted to the edge device 2-1.

  When the edge device 2-1 receives the VPN member addition response MSG from the VPN member management server 3, the edge device 2-1 sets the result (addition success / addition failure) in the member addition response MSG and notifies the terminal device 1-1 (step). S16).

(Deleting VPN by terminal device)
Next, an example of an operation in which the terminal device 1-1 deletes an existing VPN different from the VPN through connection with the VPN will be described with reference to FIG. FIG. 8 is a sequence diagram illustrating an example of an operation in which the terminal device 1-1 deletes the VPN. In addition, it is assumed that a logical connection has been established between the terminal device 1-1 and the edge device 2-1.

  The terminal device 1-1 transmits a VPN deletion request MSG including a VPN identifier indicating the VPN to be deleted to the edge device 2-1 on the virtual interface (step S21).

  The edge device 2-1 uses the logical connection identifier and label value pair included in the VPN deletion request MSG received from the terminal device 1-1 as a key for the terminal device 1-1 that is the deletion request source terminal device. The terminal device identifier is searched in the database 25 (step S22). Then, the edge device 2-1 transmits a VPN deletion request MSG including the terminal device identifier acquired by the search and the VPN identifier included in the VPN deletion request MSG (hereinafter referred to as “deleted VPN identifier”) to the VPN member. It transmits to the management server 3 (step S23).

  The VPN member management server 3 has registered the deletion target VPN identifier included in the received VPN deletion request MSG and registered in the database 35 (VPN information database) using the deletion target VPN identifier as a key. When the list of the “terminal device identifier for each device and the set of IP addresses assigned to the terminal device” is empty, the processing described below is executed and the database 35 is updated (step S24).

  The VPN member management server 3 releases the subnet address assigned to the VPN and the multicast IP address used when forwarding broadcast / multicast packets on the VPN. In addition, the VPN member management server 3 uses the above-described deletion target VPN identifier as a key, “multicast IP address used when forwarding broadcast / multicast packets on VPN”, “subnet address assigned to VPN” ”And“ list of sets of terminal device identifiers and IP addresses assigned to the terminal devices that can be VPN members ”are deleted from the database 35 (step S24).

  Then, the VPN member management server 3 transmits a VPN deletion response MSG (deletion success) to the edge device 2-1 (step S25). The VPN member management server 3 deletes the VPN designated by the edge device 2-1 if the “list of terminal device identifiers for each terminal device that can be VPN members and the IP address assigned to the terminal device” is not empty. A VPN deletion response MSG (deletion failure) indicating failure is transmitted to the edge device 2-1.

  When the edge device 2-1 receives the VPN deletion response MSG (deletion success / deletion failure) indicating that the VPN deletion operation has ended, the edge device 2-1 receives the VPN deletion response MSG indicating the operation result (deletion success / deletion failure). It transmits to the device 1-1 (step S26).

(Deleting members from VPN by terminal device)
Next, an example of an operation in which the terminal device 1-1 deletes a member (terminal device 1-m) from the existing VPN will be described with reference to FIG. FIG. 9 is a sequence diagram showing an example of an operation for deleting a member from an existing VPN. In addition, it is assumed that a logical connection has been established between the terminal device 1-1 and the edge device 2-1.

  On the virtual interface, the terminal device 1-1 sends a member deletion request MSG including a VPN identifier indicating a VPN whose member is to be deleted and a terminal device identifier indicating a member (terminal device 1-m) to be deleted to the edge device 2- 1 is transmitted (step S31).

  The edge device 2-1 uses the logical connection identifier and label value pair included in the member deletion request MSG received from the terminal device 1-1 as a key, and the terminal device identifier of the terminal device 1-1 that has requested member deletion. Is searched in the database 25 (step S32). Then, the edge device 2-1 is the terminal device identifier of the terminal device 1-1 acquired by the search, and the terminal device 1-m (terminal device that is a member deletion target) included in the member deletion request MSG. The VPN member deletion request MSG including the identifier and the VPN identifier is transmitted to the VPN member management server 3 (step S33).

  The VPN member management server 3 searches the database 35 (VPN information database) using the VPN identifier included in the VPN member deletion request MSG received from the edge device 2-1 as a key. When the terminal device identifier of the terminal device 1-m is already registered in the “search information for each terminal device that can be a VPN member (list of a set of terminal device addresses and IP addresses assigned to the terminal device)” that is the search result, The member management server 3 releases the IP address assigned to the terminal device 1-m. Further, the VPN member management server 3 sets the IP address and the terminal device identifier of the terminal device 1-m in the database 35 as “information for each terminal device that can be a VPN member (terminal device address and IP assigned to the terminal device). (List of address pairs) ”(step S34).

  Next, the VPN member management server 3 uses the IP address assigned to the terminal device 1-m as a key, and the IP address of the edge device (edge device 2-n) to which the terminal device 1-m is connected. Is searched on the overlay network (step S35), and the terminal device disconnection request MSG including the IP address information assigned to the terminal device 1-m is sent to the IP address (edge device 2-n) of the search result. Transmit (step S36). Then, the VPN member management server 3 transmits a VPN member deletion response MSG (deletion success) to the edge device 2-1 (step S37).

  When receiving the VPN member deletion response MSG, the edge device 2-1 sets the result (deletion success / deletion failure) indicated in the member deletion response MSG and notifies the terminal device 1-1 (step S38). ).

  The edge device 2-n deletes data using the IP address assigned to the terminal device 1-m as a key from the record on the overlay network (step S39).

  Further, the edge device 2-n executes the processing described below and updates the database (step S40).

  The edge device 2-n searches the database using the IP address assigned to the terminal device 1-m as a key, acquires a pair of an identifier and a label value of a logical connection with the terminal device 1-m, The VPN identifier (hereinafter referred to as “deleted VPN identifier”) of the VPN to which the terminal apparatus 1-m is connected is searched (obtained) using the logical connection identifier and label value pair as a key. Then, the logical connection identifier and label value pair retrieved using the deletion target VPN identifier as a key are deleted from the database. Further, the edge device 2-n deletes from the database the pair of the logical connection identifier and the label value searched using the intra-VPN IP address assigned to the terminal device 1-m as a key. In addition, the edge device 2-n deletes the VPN identifier, the terminal device identifier, and the IP address in the VPN that have been searched using the logical connection identifier and label value pair with the terminal device 1-m from the database.

  When the terminal device 1-m is the last terminal device connected to the VPN to be deleted among the terminal devices connected to the edge device 2-n, the edge device 2-n determines that the step S40 Following this, the following processing is executed.

  The edge device 2-n stops JOIN to “multicast IP address” obtained by searching the database using “VPN identifier (deleted VPN identifier)” as a key. Further, the “VPN identifier” recorded in the database is deleted using the “subnet address” obtained by searching the database using the deletion target VPN identifier as a key. Further, the “VPN identifier” recorded in the database is deleted using the “multicast IP address” obtained by searching the database using the deletion target VPN identifier as a key. Further, “multicast IP address” and “subnet address” recorded in the database with “VPN identifier” as a key are deleted (step S40).

  Further, the edge device 2-n releases the label value, and transmits a VPN disconnection notification MSG including the deletion target VPN identifier and a label specified by the label value on the logical connection to the terminal device 1-m. (Step S41). In the VPN disconnection notification MSG, the IP address of the terminal device 1-m is set as the source IP address and the destination IP address.

  Then, after receiving the VPN disconnection notification MSG, the terminal device 1-m deletes the virtual interface that has received the VPN disconnection notification MSG (step S42).

(Connection of terminal device to edge device)
Next, an example of an operation in which the terminal device 1-2 connects to the edge device 2-1 when the default VPN of the terminal device 1-2 has been registered in the VPN member management server 3 will be described with reference to FIG. FIG. 10 is a sequence diagram illustrating an example of an operation in which the terminal device 1-2 connects to the edge device 2-1.

  The terminal device 1-2 transmits a logical connection establishment request including authentication information (including the terminal device identifier) to the edge device 2-1 (step S51).

  The edge device 2-1 creates an authentication request MSG using the authentication information included in the received logical connection establishment request and transmits it to the authentication server 4, and sends a response (authentication response MSG) from the authentication server 4. Wait (step S52). Then, the edge device 2-1 receives the authentication response MSG from the authentication server 4 (step S53). If the content is successful, the edge device 2-1 receives the VPN identifier included in the authentication response MSG and the logical connection establishment request. A VPN member inquiry request MSG is created using the included terminal device identifier. Then, the edge device 2-1 transmits the VPN member inquiry request MSG to the VPN member management server 3 to determine whether the terminal device 1-2 can participate in the VPN corresponding to the VPN identifier. In this case, an inquiry is made as to the IP address assigned to the terminal device 1-2 (step S54). When the content of the authentication response MSG is authentication failure, the edge device 2-1 rejects establishment of a logical connection with the terminal device 1-2.

  Next, in the edge device 2-1, the VPN member inquiry response MSG to the VPN member inquiry request MSG permits the participation of the terminal device 1-2 in the VPN (IP address assigned to the terminal device, multicast IP address, Label value used by the label attached to the head of the IP packet when the packet is transferred in the VPN via the logical connection with the terminal device 1-2. Is determined to be, for example, “0” (the purpose of fixing the value of the label for the VPN that participates first) (step S56). The label value may be determined so as to be unique within the logical connection. Further, when the VPN member inquiry response MSG rejects the participation of the terminal device 1-2 in the VPN, the edge device 2-1 rejects establishment of a logical connection with the terminal device 1-2. .

  Next, the edge device 2-1 executes the process described below and updates the database 25 (step S57).

  The edge device 2-1 uses the pair of the logical connection identifier and the label value (= 0) as a key to the terminal device 1-2, and stores the VPN identifier, the terminal device identifier, and the IP address in the VPN in the database 25. Record. Further, the edge device 2-1 records a pair (data) of the identifier and the label value (= 0) of the logical connection with the terminal device 1-2 using the IP address in VPN as a key. Further, the edge device 2-1 obtains the logical connection identifier and label in a list of logical connection identifier and label value pairs with the terminal device obtained by searching the database 25 using the VPN identifier as a key. Add a pair of values (= 0) (update the list in the database 25). As a result of searching the database 25 using the VPN identifier as a key, the edge device 2-1 cannot obtain a list of logical connection identifier and label value pairs with the terminal device (the specified VPN identifier). If the corresponding list is not stored in the database 25), after adding the empty list data with the VPN identifier as a key to the database 25 (after creating a new empty list), the logical connection A pair of identifier and label value (= 0) is added to the empty list (step S57).

  Then, the edge device 2-1 establishes a logical connection between the “IP address used by the terminal device 1-2” included in the VPN member inquiry response MSG and the terminal device 1-2. (Step S58).

  Further, the edge device 2-1 registers a record having the IP address of the own device as data, using the IP address assigned to the terminal device 1-2 as a key, on the overlay network that provides the DHT search function described above. (Step S59).

  The terminal device 1-2 is the first to connect to the VPN corresponding to the VPN identifier included in the authentication response MSG received from the authentication server 4 among the terminal devices connected to the edge device 2-1. If there is, the edge device 2-1 executes the following processing following the above step S59.

  The edge device 2-1 records “multicast IP address” and “subnet address” included in the VPN member inquiry response MSG in the database using the “VPN identifier” of the VPN to which the terminal device 1-2 is connected as a key. To do. Further, “VPN identifier” is recorded in the database 25 using “multicast IP address” as a key. Further, “VPN identifier” is recorded in the database 25 using “subnet address” as a key. Then, the multicast IP address is joined to receive the packet addressed to the multicast IP address.

  Further, the terminal device 1-2 treats the pair of the logical connection identifier and the label value (= 0) as a virtual interface, and uses the IP address assigned in the logical connection establishment procedure as the IP address of the virtual interface. Set as. And the terminal device 1-2 determines the identifier showing a virtual interface, and records matching with a virtual interface identifier and a label value in the database 15 (step S60).

(Participation in existing VPN of terminal device)
Next, an example of the operation of the terminal device 1-2 participating in the existing VPN will be described with reference to FIG. FIG. 11 is a sequence diagram illustrating an example of an operation in which the terminal device 1-2 participates in an existing VPN. In addition, it is assumed that a logical connection has been established between the terminal device 1-2 and the edge device 2-1.

  The terminal device 1-2 transmits a VPN participation request MSG including a VPN identifier indicating a VPN to newly join to the edge device 2-1 on the virtual interface (step S61).

  The edge device 2-1 searches the database 25 for the terminal device identifier of the terminal device 1-2 using the logical connection identifier and label value pair included in the VPN participation request MSG received from the terminal device 1-2 as a key. (Step S62).

  Next, the edge device 2-1 creates a VPN member inquiry request MSG using the VPN identifier included in the VPN participation request MSG and the terminal device identifier of the terminal device 1-2 obtained by the search, and manages the VPN member. The message is transmitted to the server 3 (step S63). The VPN member management server 3 creates a VPN member inquiry response MSG for the request MSG and transmits it to the edge device 2-1 (step S64). The edge device 2-1 confirms the content of the response MSG, determines whether the terminal device 1-2 can participate in the VPN corresponding to the VPN identifier, and if it can participate, it is included in the response MSG. An IP address assigned to the existing terminal device 1-2 is acquired (step S65). When the terminal device 1-2 cannot participate in the VPN, the edge device 2-1 logically connects the VPN participation response MSG (participation refusal) to which the same label as that given to the VPN participation request MSG is given. It transmits to the terminal device 1-2 above, and denies the VPN participation of the terminal device 1-2.

  When permitting the terminal device 1-2 to participate in the VPN, the edge device 2-1 attaches a label to the head of the IP packet when transferring the packet in the VPN via the logical connection with the terminal device 1-2. The label value to be used is determined (step S66). Note that the value of the label is determined to be unique within the logical connection.

  Next, the edge device 2-1 executes the processing described below and updates the database 25 (step S67).

  The edge device 2-1 records the VPN identifier, the terminal device identifier, and the IP address in the VPN in the database 25 using the logical connection identifier and label value pair with the terminal device 1-2 as a key. Further, the edge device 2-1 records the identifier and label value pair of the logical connection with the terminal device 1-2 in the database 25 using the VPN IP address as a key. Further, the edge device 2-1 uses the identifier of the logical connection and the label in the list of pairs of logical connection identifiers and label values between the terminal devices obtained by searching the database 25 using the VPN identifier as a key. Add a value pair (update the list in the database 25). As a result of searching the database 25 using the VPN identifier as a key, the edge device 2-1 cannot obtain a list of logical connection identifier and label value pairs with the terminal device (the specified VPN identifier). If the corresponding list is not stored in the database 25), after adding the empty list data with the VPN identifier as a key to the database 25 (after creating a new empty list), the logical connection An identifier / label value pair is added (step S67).

  In addition, the edge device 2-1 has a VPN participation response MSG to which the same label as that given to the VPN participation request MSG is given (including participation permission, an IP address and a label value assigned to the terminal device 1-2). Is transmitted to the terminal device 1-2 over the logical connection (step S68).

  Next, the edge device 2-1 is the above-described “operation in which the terminal device 1-2 connects to the edge device 2-1 when the default VPN of the terminal device 1-2 has been registered in the VPN member management server 3. As in the case of the above, a record having the IP address assigned to the terminal device as a key and the IP address of the own device as data is registered on the overlay network.

  In addition, when the terminal device 1-2 connects to the VPN for the first time among the terminal devices connected to the edge device 2-1, the edge device 2-1 follows the above processing. Execute the process.

  The edge device 2-1 includes data of “multicast IP address and subnet address using VPN identifier (of the above VPN) as a key”, data of “VPN identifier using multicast IP address as a key”, and “subnet address as key The data of “VPN identifier” is recorded in the database 25. The edge device 2-1 joins the multicast IP address so as to receive the packet addressed to the multicast IP address (step S69).

  In addition, the terminal device 1-2 that has established a logical connection with the edge device 2-1 treats the pair of the logical connection identifier and the label value indicated in the VPN participation response MSG as a virtual interface, and sends the VPN participation response MSG to the VPN participation response MSG. The indicated IP address is set as the IP address of the virtual interface. Next, the terminal device 1-2 determines an identifier representing the virtual interface, and records the association between the virtual interface identifier and the label value in the database 15 (step S70).

(Leaving from the VPN while the terminal device is participating)
Next, an example of the operation of the terminal device 1-2 leaving the VPN will be described with reference to FIG. FIG. 12 is a sequence diagram illustrating an example of the operation of the terminal device 1-2 leaving the VPN. In addition, it is assumed that a logical connection has been established between the terminal device 1-2 and the edge device 2-1.

  The terminal device 1-2 transmits a VPN leave request MSG including a VPN identifier indicating the VPN to be removed to the edge device 2-1 on the virtual interface (step S71).

  The edge device 2-1 that has received the VPN leave request MSG uses a VPN identifier indicated in the VPN leave request MSG as a key to create a list of logical connection identifier and label value pairs with the terminal device 1-2. The database 25 is searched (step S72). When the search result list includes a pair of an identifier and a label value of the logical connection that has received the VPN withdrawal request MSG, the edge device 2-1 uses the IP address assigned to the terminal device 1-2 as a key. The recorded record is deleted from the overlay network (step S73).

  Further, the edge device 2-1 executes the process described below and updates the database 25 (step S74).

  The edge device 2-1 performs “a process of deleting the identifier and label value pair of the logical connection that has received the VPN withdrawal request MSG from the list of the database 25”, “the identifier and label value pair of the logical connection is a key, and Processing for deleting a pair (data) of an identifier and a label value of a logical connection with the terminal device 1-2 recorded using the IP address in VPN as a search result in the database 25, as a key. ”,“ Process for deleting VPN identifier, terminal device identifier, and IP address in VPN from database 25, recorded as a pair of logical connection identifier and label value ”, and“ Label value release process ” This is done (step S74).

  If the search result list does not include the pair of the identifier and the label value of the logical connection that has received the VPN withdrawal request MSG, the process is terminated at that point.

  Next, the edge device 2-1 transmits a VPN leave response MSG on the pair of the identifier and the label value of the logical connection that has received the VPN leave request MSG (on the virtual interface for the terminal device 1-2) (step) S75). Then, when receiving the VPN leave response MSG, the terminal device 1-2 deletes the received virtual interface.

(Packet transfer processing by edge device-Unicast transfer)
Subsequently, an example of an operation in which the edge device 2-1 transfers the packet addressed to the unicast IP address transmitted by the terminal device 1-2 to the destination terminal device (referred to as the terminal device 1-m) will be described with reference to FIG. To do. FIG. 13 is a sequence diagram illustrating an example of an operation in which the terminal device 1-2 transmits a packet addressed to a unicast IP address. In addition, it is assumed that a logical connection has been established between the terminal device 1-2 and the edge device 2-1.

  The terminal device 1-2 designates a unicast destination address, and transmits an IP packet with a label having a label value corresponding to the virtual interface at the top thereof on the virtual interface (step S81).

  When the edge device 2-1 receives the IP packet whose destination IP address is a unicast IP address from the terminal device 1-2, the edge device 2-1 uses the pair of the logical connection identifier and the label value (= 0) as a key. The VPN identifier is searched for, and further, the subnet address associated with the VPN is searched in the database 25 using the VPN identifier obtained by the search as a key (step S82).

  When the destination IP address of the IP packet received from the terminal device 1-2 belongs to the subnet address obtained by the search, the edge device 2-1 uses the destination IP address of the IP packet as a key and the destination of the IP packet The IP address of the edge device (referred to as edge device 2-n) to which the terminal device 1-m is connected is searched on the overlay network (step S83). On the other hand, when the destination IP address of the received IP packet does not belong to the subnet address obtained by the search, the edge device 2-1 discards the IP packet. Also, when the IP address search of the edge device 2-n on the overlay network fails, the edge device 2-1 discards the IP packet (partner edge device IP address search processing 1).

  Note that the edge device 2-1 may perform the following process (partner edge device IP address search process 2) instead of the above “partner edge device IP address search process 1 (steps S 82 and S 83)”. .

  When the edge device 2-1 receives the IP packet whose destination IP address is a unicast IP address from the terminal device 1-2, the edge device 2-1 uses the pair of the logical connection identifier and the label value (= 0) as a key. The VPN identifier and the IP address in the VPN of the terminal device 1-2 are searched for, and the subnet address associated with the VPN is searched using the VPN identifier obtained by the search as a key (alternative process in step S82). . Then, the edge device 2-1 determines that the destination IP address of the IP packet received from the terminal device 1-2 belongs to the subnet address obtained by the search, and the source IP address of the received IP packet is the search If the IP address in the VPN matches the IP address in the VPN, the destination IP address of the IP packet is used as a key, and the edge device (edge device 2-n) connected to the terminal device 1-m that is the destination of the IP packet Search for an IP address on the overlay network. On the other hand, when the destination IP address of the IP packet does not belong to the subnet address obtained by the search, or when the source IP address of the received IP packet does not match the IP address within the VPN obtained by the search Discards the IP packet. Also, when the IP address search of the edge device 2-n on the overlay network fails, the edge device 2-1 discards the IP packet (partner edge device IP address search processing 2).

  The edge device 2-1 acquires the IP address of the edge device 2-n by the above “other party edge device IP address search process 1” or “other party edge device IP address search process 2”, and then receives the IP address from the terminal device 1-2. The received IP packet is transmitted to the IP address (edge device 2-n) through the tunnel between edge devices (step S84).

  The edge device 2-n that has received the IP packet through the tunnel between the edge devices searches the database for the pair of the identifier and the label value of the corresponding logical connection by using the IP address designated as the destination address of the IP packet as a key. (Step S85). Then, the edge device 2-n assigns the label of the label value obtained by the search to the IP packet, and transmits it to the logical connection obtained by the search. The edge device 2-n discards the IP packet when the search for the pair of the logical connection identifier and the label value fails.

  When the destination terminal device (terminal device 1-m) of the IP packet transmitted by the terminal device 1-2 receives an IP packet with a label on a logical connection, it determines which virtual value from the value of the assigned label. Whether it is received on the interface is identified, the label is removed, and the IP packet is received (step S86).

  The tunnel between the edge devices sets the IP address of the transmission source edge device (edge device 2-1) as the transmission source IP address of the IP packet to be transferred, and the transfer destination edge device (edge device) as the destination IP address. This is realized by IPinIP encapsulation that is encapsulated with an IP header in which the IP address of 2-n) is set.

(Packet forwarding processing by edge device-broadcast / multicast forwarding)
Next, an example of an operation in which the edge device 2-1 transfers a packet addressed to the broadcast / multicast IP address transmitted by the terminal device 1-2 to the destination terminal device will be described. Here, in particular, an operation in which the terminal device 1-2 transmits a packet in which a multicast IP address is set will be described with reference to FIG. FIG. 14 is a sequence diagram illustrating an example of an operation in which the terminal device 1-2 transmits a packet addressed to a multicast IP address. In addition, it is assumed that a logical connection has been established between the terminal device 1-2 and the edge device 2-1.

  The terminal device 1-2 designates a broadcast / multicast IP address as a destination address, and transmits an IP packet with a label having a label value corresponding to the virtual interface at the head (step S91).

  When the edge device 2-1 receives the IP packet whose destination IP address is the broadcast / multicast address from the terminal device 1-2, the edge device 2-1 uses the pair of the logical connection identifier and the label value (= 0) as a key. The VPN identifier is searched for, and the multicast IP address is searched in the database 25 using the VPN identifier obtained by the search as a key (step S92).

  The edge device 2-1 performs IPinIP encapsulation with the IP address received from the terminal device 1-2 as the destination and the multicast IP address obtained by the above search as the transmission source (step S 93). ). The edge device 2-1 discards the IP packet when the multicast IP address cannot be acquired by the search (when the search fails).

  The edge device (the partner edge device) that has received the IP packet encapsulated in IPinIP addressed to the multicast IP address searches the database for the VPN identifier using the multicast IP address as a key, and further obtains the VPN identifier obtained by the search. As a key, a list of logical connection identifier / label value pairs is searched in the database (step S94). Then, the partner edge device extracts the IP packet from the IPinIP-encapsulated packet, and on the pair of identifiers and label values of all the logical connections included in the list obtained by the above search (for the terminal device). On the virtual interface). The partner edge device discards the IP packet when it fails to search for a pair of logical connection identifier and label value.

  When the destination terminal device of the IP packet transmitted by the terminal device 1-2 receives the IP packet to which the label is attached on the logical connection, on which virtual interface is received from the value of the assigned label Is removed, and the label is removed and received as an IP packet (steps S95 to S97).

  As described above, in this embodiment, when a terminal device (user) who wants to connect to a certain VPN connects to the edge device, the edge device inquires the VPN member management server about information relating to the VPN. It is possible to remove the restriction that the edge device has to be provided with the necessary settings for mediating the connection between the terminal device and the VPN to which the terminal device wants to connect.

  Furthermore, in this embodiment, by transferring the labeled IP packet on the logical connection that connects the terminal device and the edge device, a plurality of labels that are further distinguished by one label on one logical connection are provided. The logical connection was multiplexed. In addition, a VPN can be dynamically created / deleted by enabling a VPN member management server to register / delete a VPN and register / delete a member (terminal device) belonging to the VPN in response to a request from the terminal device. did. Through these processes, the terminal device can dynamically create / delete the VPN with a small number of message exchanges, and the terminal device can dynamically join / leave the VPN.

  Furthermore, by managing information on which edge device each terminal device is connected to on the overlay network having the DHT search function constructed by the edge device, it scales with respect to the number of terminal devices and the number of edge devices. In this way, the terminal device can always connect to the VPN with the same IP address. That is, every time the terminal device is connected / disconnected, the edge device does not need to advertise the routing information to the entire VPN using the routing protocol. With this process, it is possible to construct a VPN in which the scalability problem with respect to the increase in the number of terminal devices is solved.

  In addition, by using the subnet part of the IP address as the VPN identifier, it is easy to determine whether the communication is within the same VPN. With this processing, it is possible to perform communication using the same IP address in the VPN even when the terminal device is connected to the VPN via an arbitrary edge device without supporting the mobile IP. .

  In this embodiment, an example has been described in which each edge device constructs an overlay network that provides a DHT search function on an IP network according to the Chord scheme. However, the present invention is limited to the Chord scheme. Instead, a method obtained by improving or expanding Chord may be used, or a method other than Chord using DHT may be used.

Embodiment 2. FIG.
FIG. 15 is a diagram of a configuration example of a network that implements the data communication system according to the second embodiment of the present invention. The network according to this embodiment includes edge devices 2a-1 to 2a-n instead of the edge devices 2-1 to 2-n as compared with the network according to the first embodiment, and also includes a VPN. A plurality of member management servers are provided. Due to such a configuration, in this embodiment, processing different from that in the first embodiment will be described.

  FIG. 16 is a diagram illustrating a configuration example of the edge device 2a according to the present embodiment (corresponding to the edge devices 2a-1 to 2a-n in FIG. 15). For example, a PC using Linux as an OS can be used. . The edge device 2a includes an IP communication module 21, a database 25, a DHT search module 26, a tunnel communication module 12, a VPN identifier-VPN member management server association module 28, and a control module 27a. In addition, about the structure similar to the edge apparatus 2 (refer FIG. 3) of Embodiment 1 mentioned above, the same code | symbol is attached | subjected and the description is abbreviate | omitted.

  The VPN identifier-VPN member management server associating module 28 manages a database using the VPN identifier as a key and the IP address of the VPN member management server that manages data relating to the VPN identifier as data. The database software returns an IP address of a VPN member management server that manages data relating to the VPN identifier as an output.

  The control module 27a is realized as, for example, S / W, and controls other modules (the IP communication module 21, the tunnel communication module 12, and the like) constituting the edge device 2a.

  Then, the processing in the network according to this embodiment is such that when the edge device 2a communicates with any one of the VPN member management servers 3-1 to 3-x (see FIG. 15), the VPN identifier-VPN member is always included as a preceding stage. The management server association module 28 is called to determine which VPN member management server to communicate with. The processing in the network according to the present embodiment is the same as the processing in the first embodiment except that the determination process is added.

  As described above, in this embodiment, when communicating with the VPN member management server, it is determined which of the plurality of VPN member management servers communicates, and dynamic VPN creation / deletion, etc. It was decided to distribute the processing load. Thereby, the scalability with respect to the number of VPNs and the number of terminal devices can be further improved as compared with the case of the first embodiment described above.

  As described above, the data communication system according to the present invention is useful for an IP network in which a plurality of VPNs are configured.

It is a figure which shows the structural example of the network which implement | achieves the data communication system concerning Embodiment 1 of this invention. It is a figure which shows the structural example of a terminal device. It is a figure which shows the structural example of an edge apparatus. It is a figure which shows the structural example of a VPN member management server. It is a figure which shows the structural example of an authentication server. It is a sequence diagram which shows an example of the operation | movement which a terminal device produces VPN. It is a sequence diagram which shows an example of the operation | movement which adds a member to the existing VPN. It is a sequence diagram which shows an example of the operation | movement which a terminal device deletes VPN. It is a sequence diagram which shows an example of the operation | movement which deletes a member from the existing VPN. It is a sequence diagram which shows an example of the operation | movement which a terminal device connects to an edge device. It is a sequence diagram which shows an example of the operation | movement which a terminal device participates in the existing VPN. It is a sequence diagram which shows an example of the operation | movement which a terminal device leaves | separates from VPN. It is a sequence diagram which shows an example of the operation | movement which a terminal device transmits the packet addressed to a unicast IP address. It is a sequence diagram which shows an example of the operation | movement which a terminal device transmits the packet addressed to a multicast IP address. It is a figure which shows the structural example of the network which implement | achieves the data communication system concerning Embodiment 2 of this invention. It is a figure which shows the structural example of an edge apparatus.

Explanation of symbols

DESCRIPTION OF SYMBOLS 1,1-1,1-2,1-m Terminal device 2,2-1,2-2,2-n, 2a Edge device 3,3-1,3-x VPN member management server 4 Authentication server 11, 21, 31, 41 IP communication module 12 Tunnel communication module 13 Virtual interface driver 14 Application 15, 25, 35, 45 Database 26 DHT search module 27, 37, 47, 27a Control module 28 VPN identifier-VPN member management server association module

Claims (16)

A data communication system capable of configuring a plurality of VPNs (Virtual Private Networks) on an IP network,
An edge device that is connected to the IP network and holds predetermined information for performing a connection process between the terminal device and the VPN and a transfer process of the IP packet;
A terminal device that can be a member of the plurality of VP N ;
A VPN member management server holding predetermined information for managing the plurality of VPNs and the terminal devices ;
With
The edge device establishes a logical connection with the terminal device that requests connection to the VPN, obtains information on the VPN to which the terminal device belongs from the VPN member management server, and obtains the VPN obtained from the VPN member management server A data communication system, characterized in that connection setting processing is performed between the terminal device and a VPN to which the terminal device requests connection based on the information. The edge device is
A database having a VPN identifier, a terminal device identifier, and an IP address within the VPN as data, using a pair of an identifier and a label value of a logical connection with the terminal device as a key;
A database that uses a pair of identifier and label value of a logical connection with the terminal device using the IP address as data, with the IP address in the VPN as a key;
A database that uses a VPN identifier as a key and a list of pairs of identifiers and label values of logical connections with terminal devices used for connection to the VPN as data;
A database having a multicast IP address and a subnet address associated with the VPN as data using the VPN identifier as a key;
A database having a multicast IP address as a key and a VPN identifier associated with the multicast IP address as data;
A database that uses a subnet address as a key and a VPN identifier associated with the subnet address as data;
With
Based on the information stored in the database, the edge device performs “VPN creation or deletion processing”, “VPN member addition or deletion processing”, “VPN join / leave processing”, “Unicast IP” The data communication system according to claim 1, wherein at least one of “packet transfer processing” and “broadcast / multicast IP packet transfer processing” is performed.   In response to a VPN member inquiry request message including a VPN identifier and a terminal device identifier received from the edge device, the VPN member management server sends a terminal device specified by the terminal device identifier to the VPN specified by the VPN identifier. The IP address assigned to the terminal device that accepts the participation, the multicast IP address used when forwarding a broadcast or multicast packet on the VPN, and the subnet address associated with the VPN, The data communication system according to claim 1 or 2, wherein notification is made by a VPN member inquiry response message in response to a VPN member inquiry request message.   The edge device constructs an overlay network on the IP network, and participation of the terminal device connected to the edge device in the VPN is permitted by the VPN member management server. As a result, an IP address is assigned to the terminal device. In the case of registering a record having the IP address of the own device as data using the assigned IP address as a key and searching for data registered on the overlay network, DHT ( 4. The data communication system according to claim 1, wherein a search function of a Distributed Hash Table) method is used.   The data communication system according to any one of claims 1 to 4, wherein a subnet part of an IP address assigned to a terminal device permitted to participate in the VPN is used as a VPN identifier.   The IP packet transmitted in the IP network is provided with a label for identifying on which VPN the IP packet is transmitted and received. The data communication system described in 1. The VPN member management server is composed of a plurality of VPN member management servers for dividing and managing information of terminal devices connected to the VPN,
The edge device is
A database in which information associated with an IP address of a VPN member management server that manages data relating to the VPN identifier is stored using the VPN identifier as a key;
Information management means for managing information in the database;
With
The information management means determines which VPN member management server the VPN information is registered in when acquiring the information of the VPN of which the terminal device is a member in response to a request from the terminal device The data communication system according to any one of claims 1 to 6, wherein: A terminal device is found using Oite data communication system according to any one of claims 1 to 7,
An IP protocol processing unit for performing IP protocol processing for realizing IP communication in the IP network;
A tunnel communication processing unit for performing processing for establishing a logical connection with the edge device;
A virtual interface processing unit that handles an identifier for identifying a logical connection and a label value of a label attached to an IP packet as one virtual interface capable of IP communication;
With
The virtual interface processing unit performs IP communication on the assumption that a plurality of logical connections are established for each virtual interface. An edge device that constructs an overlay network on an IP network in which a plurality of VPNs (Virtual Private Networks) is configured, performs a connection process between the terminal device and the VPN and a transfer process of the IP packet, a plurality of VPNs, and members of the VPN And a VPN member management server that holds predetermined information for managing potential terminal devices, and is applied to a data communication system,
In response to a logical connection between an edge device from a terminal device participating in one of the VPNs connected to the network constituting the overlay network and a new VPN generation instruction via the participating VPN When updating the VPN settings,
The terminal device notifying the edge device of a VPN identifier for identifying a VPN to be newly created;
The edge device obtains a terminal device identifier of the terminal device based on an identifier of the logical connection and a label value for identifying a VPN attached to the top of an IP packet;
The edge device notifying the VPN member management server of the VPN identifier and the terminal device identifier;
The VPN member management server creates information (VPN information) about the VPN newly created based on the VPN identifier and the terminal device identifier and information (terminal device information) for the terminal device to connect to the VPN. Process,
The VPN member management server registering the VPN information in a database in its own device;
The VPN member management server notifying the terminal device information to the edge device;
VPN setting update method characterized by including. An edge device that constructs an overlay network on an IP network in which a plurality of VPNs (Virtual Private Networks) is configured, performs a connection process between the terminal device and the VPN and a transfer process of the IP packet, a plurality of VPNs, and members of the VPN And a VPN member management server that holds predetermined information for managing potential terminal devices, and is applied to a data communication system,
Request for additional registration of a new member for a given VPN via a logical connection with an edge device from a first terminal device participating in one of the VPNs connected to the network constituting the overlay network When updating the VPN settings according to
The first terminal device notifying the edge device of a terminal device identifier for identifying a new second terminal device as a member and a VPN identifier for identifying a member registration destination VPN;
The edge device notifying the VPN member management server of a terminal device identifier (second terminal device identifier) and a VPN identifier of the second terminal device;
Information (terminal device management information) for the VPN member management server to manage the second terminal device that newly becomes a member of the VPN based on the second terminal device identifier and the VPN identifier, and the second A step of creating information (terminal device information) for connecting the terminal device to the VPN;
The VPN member management server registering the terminal device management information in a database in the server;
The VPN member management server notifying the edge device of the terminal device information;
VPN setting update method characterized by including. An edge device that constructs an overlay network on an IP network in which a plurality of VPNs (Virtual Private Networks) is configured, performs a connection process between the terminal device and the VPN and a transfer process of the IP packet, a plurality of VPNs, and members of the VPN And a VPN member management server that holds predetermined information for managing potential terminal devices, and is applied to a data communication system,
In response to a logical connection with an edge device from a terminal device participating in one of the VPNs connected to the network constituting the overlay network and an instruction to delete the existing VPN via the participating VPN When updating the VPN settings,
The terminal device notifying the edge device of a VPN identifier for identifying a VPN requesting deletion;
The edge device acquires a terminal device identifier of the terminal device based on an identifier of the logical connection and a label value for identifying a VPN attached to the top of an IP packet;
The edge device notifying the VPN member management server of the VPN identifier and the terminal device identifier;
The VPN member management server specifies necessary information (VPN information) about the VPN to be deleted based on the VPN identifier and the terminal device identifier, and cancels registration of the VPN information in its own server database;
VPN setting update method characterized by including. An edge device that constructs an overlay network on an IP network in which a plurality of VPNs (Virtual Private Networks) is configured, performs a connection process between the terminal device and the VPN and a transfer process of the IP packet, a plurality of VPNs, and members of the VPN And a VPN member management server that holds predetermined information for managing potential terminal devices, and is applied to a data communication system,
The member registered in the predetermined VPN via the logical connection with the edge device from the first terminal device participating in one of the VPNs connected to the network constituting the overlay network When updating the VPN settings in response to a registration deletion request,
The first terminal device notifying the edge device of a terminal device identifier for identifying a second terminal device to be deleted from member registration and a VPN identifier for identifying a member registration destination VPN;
The edge device notifying the VPN member management server of a terminal device identifier (second terminal device identifier) and a VPN identifier of the second terminal device;
The VPN member management server specifies VPN registration information (terminal device management information) of the second terminal device requested to be deleted based on the second terminal device identifier and the VPN identifier, and the terminal device management information Canceling the registration in the database in the server;
The edge device deleting information registered for the second terminal device to participate in VPN from the overlay network;
VPN setting update method characterized by including. Create an overlay network on an IP network that includes multiple VPNs (Virtual Private Networks), register the edge device that performs the connection processing between the terminal device and the VPN and the IP packet transfer processing, and registers as a member of the multiple VPNs In order to manage an authentication server that authenticates a terminal device that requests connection to a predetermined VPN based on the VPN identifier of the default VPN to which the terminal device that is connected, and a plurality of VPNs and terminal devices that can be members of the VPN And a VPN member management server that holds predetermined information of the data communication system,
When a terminal device that is a member of the VPN updates the VPN setting to participate in the VPN for the VPN connected to the network that constructs the overlay network,
A step in which a terminal device intending to join a member VPN makes a request for establishment of a logical connection including identification information (terminal device identifier) of the terminal device to the edge device;
The edge device notifying the authentication server of the terminal device identifier;
The authentication server notifying the edge device of a VPN identifier for identifying a VPN of which the terminal device is a member when the authentication process is normally completed;
The edge device that has received the notification of the VPN identifier notifies the VPN member management server of the VPN identifier and the terminal device identifier, and requests notification of information for participating in the VPN corresponding to the VPN identifier; ,
VPN setting update method characterized by including.   The VPN setting update method according to claim 13, wherein the edge device and the terminal device perform transmission / reception of an IP packet with a label for identifying a VPN on the logical connection. An edge device that constructs an overlay network on an IP network in which a plurality of VPNs (Virtual Private Networks) is configured, performs a connection process between the terminal device and the VPN and a transfer process of the IP packet, a plurality of VPNs, and members of the VPN And a VPN member management server that holds predetermined information for managing potential terminal devices, and is applied to a data communication system,
A request to join a VPN different from the participating VPN via a logical connection between the terminal device participating in one of the VPNs connected to the network constituting the overlay network and the edge device. Accordingly, when updating the VPN settings,
A VPN identifier notification step in which the terminal device notifies the edge device of a VPN identifier for identifying a newly participating VPN;
A terminal device identifier acquisition step in which the edge device acquires a terminal device identifier of the terminal device based on the VPN identifier;
The edge device notifies the VPN member management server of the VPN identifier and the terminal device identifier obtained in the VPN identifier notification step and the terminal device identifier acquisition step, and participates in the VPN corresponding to the VPN identifier. Requesting notification of information; and
VPN setting update method characterized by including. An edge device that constructs an overlay network on an IP network in which a plurality of VPNs (Virtual Private Networks) is configured, performs a connection process between the terminal device and the VPN and a transfer process of the IP packet, a plurality of VPNs, and members of the VPN And a VPN member management server that holds predetermined information for managing potential terminal devices, and is applied to a data communication system,
In response to a request to leave the participating VPN via a logical connection with an edge device from a terminal device participating in any of the VPNs connected to the network that constructs the overlay network, When updating the VPN settings,
The terminal device notifying the edge device of a VPN identifier for identifying a VPN desired to leave;
The edge device deleting information registered to join the VPN of the terminal device from the overlay network;
VPN setting update method characterized by including.

Images