JP5133932B2 - VPN connection control system, authentication server - Google Patents

Description

The present invention, VPN connection control system that dynamically perform the VPN connection establishment, it relates to the authentication server.

  There is a VPN (Virtual Private Network) that can be used as a dedicated line without using a dedicated line (see Patent Document 1 and Non-Patent Document 1). A VPN service provider that provides this VPN service provides a VPN service by defining a virtual routing and forwarding (VRF) for each VPN contract in a VPN router, for example. VRF is a technique for holding a plurality of independent routing tables on a single router and routing each routing table as an independent IP network.

  The terminal device of the VPN service contract user uses a protocol such as PPPoE (PPP over Ethernet) or IPsec (Security Architecture for Internet Protocol) to connect to a VPN router in the VPN service provider network, and the VPN router is a connected user (terminal). Device). The VPN router can connect the user to an appropriate VPN by accommodating the user connection session in a VRF previously associated with an identifier such as a domain name presented by the user.

  The VPN router not only authenticates the user with an ID / password or the like, but can also authorize a VPN connection using identification information of a physical line used by the user to access the VPN router. For example, a contract company of VPN service can permit connection only from a home line of a registered employee.

Japanese Patent No. 3490358

Chris Metz, "The Latest in Virtual Private Networks: Part I," IEEE Internet Computing, vol.7, no.1, pp.87-91, January / February, 2003.

  The VPN service using VRF as described above is suitable for relatively static use in which a network between bases is always connected. On the other hand, when the user temporarily connects to the VPN from the destination and remotely accesses the resources of the local site, even if there is no user connected from the destination, the site between the local site and the VPN router A VPN session must be maintained.

  For this reason, even when accommodating a VPN for remote access purposes whose usage time is relatively limited, VPN sessions always exceeding the number of VPN contracts are established for the VPN router. In other words, the VPN connection for the purpose of remote access cannot be made unless the VPN connection that is not used is established to the VPN router. For this reason, there exists a problem that the accommodation efficiency of VPN cannot be raised. Further, it is necessary for VPN users who have contracted a plurality of VPN services to always maintain connections with all VPNs, and a relatively high performance VPN termination device is required.

  The present invention has been made to solve the above problems, and an object of the present invention is to make it possible to easily increase the accommodation efficiency of VPN.

V PN connection control system Ru engagement to the present invention is a VPN connection control system for establishing a VPN connection between the first 1VPN client and the 2VPN client, for connection to a 2VPN client sent from the first 1VPN client first A first connection request accepting means for accepting a first VPN connection request for establishing a VPN connection with the 1VPN client, and a first VPN connection with the first VPN client based on the first VPN connection request accepted by the first connection request accepting means; 1 VPN connection establishment means, a VPN connection request transmission instruction means for notifying the second VPN client of a VPN connection request transmission instruction for establishing a VPN connection, and after the VPN connection request transmission instruction means notifies the transmission instruction, Sent from 2VPN client Second connection request accepting means for accepting the second VPN connection request, second VPN connection establishing means for establishing the second VPN connection with the second VPN client by the second VPN connection request accepted by the second connection request accepting means, and the first VPN A VPN connection control device comprising a relay means for relaying the connection and the second VPN connection, an authentication means for performing authentication based on authentication information sent from the first VPN client and the second VPN client, and a physical connection to the second VPN client. Based on the information of the line information storage unit storing the line information and the second VPN client included in the first VPN connection request, the physical line information to the second VPN client is specified from the line information storage unit, and the specified physical to provide a line by a request from the VPN connection control device to the VPN connection controller Comprising an authentication server and a line information solutions, at least, first 2VPN client, a transmission instruction reception means receives a notification from the VPN connection controller, the transmission instruction of the transmission instruction reception means VPN connection request received And a VPN connection request sending means for sending a second VPN connection request to the VPN connection control device, and the VPN connection request sending instruction means notifies the second VPN client via the physical line specified by the line information resolution means. I do.

In the VPN connection control system, the line information storage unit stores connection permission domain information set for each access line of the connection source of the first VPN client and the second VPN client, and the authentication unit stores the connection permission domain information. It is possible to determine whether to permit domain connection of the first VPN client and the second VPN client by referencing and restricting the users who are permitted to connect by the domain name of the user .

The authentication server according to the present invention includes an authentication unit that performs authentication based on authentication information sent from the first VPN client and the second VPN client, and a line information storage in which physical line information to the second VPN client is stored. To the second VPN client based on the information of the second VPN client included in the first VPN connection request for establishing the VPN connection with the first VPN client for connecting to the second VPN client sent from the first VPN client. the physical line information identified from the line information storage unit includes at least a that provide specified physical line to the requestor times line information solutions.

In the authentication server, the line information storage unit stores connection permission domain information set for each access line of the connection source of the first VPN client and the second VPN client, and the authentication unit refers to the connection permission domain information. The user who is permitted to connect may be restricted by the domain name of the user to determine whether the first VPN client and the second VPN client are allowed to connect to the domain.

  As described above, according to the present invention, when the first VPN connection request is received from the first VPN client, the second VPN client is notified of the VPN connection request transmission instruction for establishing the VPN connection. The excellent effect that the accommodation efficiency of VPN can be improved is obtained.

It is a block diagram which shows the structure of the VPN connection control apparatus and VPN client in Embodiment 1 of this invention. 6 is a flowchart illustrating an operation example (VPN connection control method) of the VPN connection control device according to the first embodiment. It is a block diagram which shows the structure of the VPN connection control apparatus and VPN client in Embodiment 2 of this invention. FIG. 11 is an explanatory diagram showing an operation example (VPN connection control method) of the VPN connection control device in the second embodiment.

  Hereinafter, embodiments of the present invention will be described with reference to the drawings.

[Embodiment 1]
First, the first embodiment of the present invention will be described. FIG. 1 is a configuration diagram showing a configuration example of a VPN connection control apparatus according to Embodiment 1 of the present invention. The VPN connection control device according to the present embodiment first receives a first VPN connection request that establishes a VPN connection with the VPN client A131 to connect to the VPN client B132 sent from the VPN client A131. 101 and a first VPN connection establishment unit 102 that establishes a first VPN connection with the VPN client A 131 by a first VPN connection request received by the first connection request reception unit 101.

  In addition, the VPN connection control device includes a VPN connection request transmission instruction unit 103 that notifies the VPN client B 132 of a VPN connection request transmission instruction for establishing a VPN connection. In addition, after the VPN connection request transmission instruction unit 103 notifies the transmission instruction, the second connection request reception unit 104 that receives the second VPN connection request transmitted from the VPN client B 132 and the second connection request reception unit 104 that receives the second connection request reception unit 104. A second VPN connection establishment unit 105 that establishes a second VPN connection with the VPN client B132 by a 2VPN connection request, and a relay unit 106 that relays the first VPN connection and the second VPN connection are provided.

  The VPN connection control device described above can be connected to the VPN client A 131 and the VPN client B 132 via a network 121 such as a closed network, a public line, and the Internet of the VPN connection control device. In addition, the VPN client B 132 performs VPN connection control by a transmission instruction reception unit 132 a that receives a transmission instruction of a VPN connection request for establishing a VPN connection notified from the VPN connection control device, and a transmission instruction of the received VPN connection request. A VPN connection request sending unit 132b for sending a VPN connection request to the apparatus. The VPN client may be a terminal device (personal computer or server) on the user side having a VPN termination function, or may be a router having a VPN termination function.

  Next, an operation example (VPN connection control method) of the VPN connection control apparatus according to the present embodiment will be described with reference to the flowchart of FIG. First, as shown in FIG. 2A, the first connection request accepting unit 101 establishes a VPN connection with the VPN client A131 for connecting to the VPN client B132 sent from the VPN client A131. Is received (Y in step S201), the first VPN connection establishment unit 102 establishes the first VPN connection with the VPN connection source in accordance with the received first VPN connection request (step S202). The first VPN connection establishment unit 102 establishes the first VPN connection by PPPoE or IPsec, for example.

  Next, in step S203, the VPN connection request transmission instructing unit 103 notifies the VPN client B 132 of a VPN connection request transmission instruction for establishing a VPN connection. For example, the identification information of the network in which the VPN client A 131 is accommodated (information that can uniquely identify the contractor's line, for example, the IP address (NAS of the NAS (Network Access Server) apparatus in which the contractor's line is accommodated) (IP-Address) and physical port (NAS-Port) pair, etc.) to identify the contractor to whom the VPN service is provided, and the physical line information (such as the port number of the VPN terminating device) of the identified contractor in the database ( By acquiring from the line information storage unit), for example, a notification destination to which connection is permitted can be specified. As a result, only a specific visitor is allowed to use the access line to the VPN connection control device, and the VPN to which the visitor is connected can be restricted.

  Thereafter, when the second connection request accepting unit 104 accepts the second VPN connection request sent from the VPN client B 132 (Y in step S204), the second VPN connection establishing unit 105 responds to the VPN client by the accepted second VPN connection request. A second VPN connection with B132 is established (step S205). The second VPN connection establishment unit 105 establishes the second VPN connection by PPPoE or IPsec, for example. Here, the first VPN connection and the second VPN connection need not be connected by the same protocol. Finally, in step S206, the relay unit 106 relays the first VPN connection and the second VPN connection. For example, the relay unit 106 relays the first VPN connection and the second VPN connection by defining a VRF.

  On the other hand, in the VPN client B132, as shown in FIG. 2B, when the transmission instruction receiving unit 132a receives a VPN connection request transmission instruction for establishing the VPN connection notified from the VPN connection control device (step). In step S221, the VPN connection request sending unit 132b sends a VPN connection request to the VPN connection control device (step S222).

  As described above, according to the present embodiment, even if a VPN connection (VPN session) is not established between the VPN connection control device and the VPN client B132, the VPN client B132 from the VPN client A131. The VPN connection is established between the VPN connection control device and the VPN client B 132 in response to the VPN connection request for. As described above, according to the present embodiment, even if a VPN session with a VPN client as a communication destination is not established in advance, a VPN connection can be established based on a request, so that the VPN accommodation efficiency can be improved. It becomes like this.

[Embodiment 2]
Next, a second embodiment of the present invention will be described. FIG. 3 is a configuration diagram illustrating a configuration example of the VPN connection control apparatus 100 according to the second embodiment of the present invention. The VPN connection control device 100 first establishes a VPN connection with the user terminal device A334 to connect to the second VPN termination device (second VPN client) 332 sent from the user terminal device A (first VPN client) 334. A first connection request accepting unit 101 that accepts a first VPN connection request, and a first VPN connection establishing unit 102 that establishes a first VPN connection with the user terminal device A334 by a first VPN connection request accepted by the first connection request accepting unit 101. Prepare.

  The VPN connection control apparatus 100 also includes a VPN connection request transmission instruction unit 103 that notifies the second VPN termination apparatus 332 of a VPN connection request transmission instruction for establishing a VPN connection. In addition, after the VPN connection request transmission instructing unit 103 notifies the transmission instruction, the second connection request receiving unit 104 that receives the second VPN connection request transmitted from the second VPN terminating device 332 and the second connection request receiving unit 104 receive it. And a second VPN connection establishment unit 105 that establishes a second VPN connection with the second VPN termination device 332 in response to the second VPN connection request.

  The VPN connection control apparatus 100 includes a VRF management unit (relay unit) 306, an authentication unit 307, and a line information identification unit 308.

  The above-described VPN connection control device 100 can be connected to the user terminal device A334 via the network 121 that is a closed network of the VPN connection control device 100, the first VPN termination device 331, and the wireless access point 333. Similarly, the VPN connection control device 100 can be connected to the second VPN termination device 332 via the network 121. In addition, a user terminal device B 335 is connected to the second VPN termination device 332.

  The first VPN termination device 331 includes, for example, a PPPoE VPN connection function, and a PPPoE frame that allows a PPPoE frame to pass when a terminal (user terminal device A334) connected to the internal network makes a PPPoE connection to the VPN connection control device 100. A VPN router having a pass-through function. Note that the first VPN termination device 331 may or may not have a VPN connection function based on PPPoE.

  The second VPN terminator 332 receives the VPN connection request from the VPN connection control device 100 according to the sending instruction accepting unit 332a that accepts the sending instruction of the VPN connection request for establishing the VPN connection and the sending instruction of the accepted VPN connection request. A VPN connection request transmission unit 332b that transmits a VPN connection request to the control device 100 and an authentication unit 332c are provided. The second VPN termination device 332 also has a PPPoE VPN connection function, and a PPPoE frame that passes a PPPoE frame when a terminal (user terminal device B 335) connected to the internal network makes a PPPoE connection to the VPN connection control device 100. It has a pass-through function. Note that even if the second VPN termination device 332 has a PPPoE pass-through function for allowing a PPPoE frame to pass when a terminal (user terminal device B 335) connected to the internal network makes a PPPoE connection to the VPN connection control device 100. It doesn't have to be good.

  An authentication server 310 is connected to the VPN connection control apparatus 100. The authentication server 310 includes an authentication unit 311 for performing authentication requested by the authentication unit 307, and a line information resolution unit (line information storage unit) 312 that provides line information requested by the line information specifying unit 308. . The line information resolution unit 312 includes a line information storage unit that stores at least physical line information to the second VPN termination device 332, and is a user terminal for connecting to the second VPN termination device 332 transmitted from the user terminal device A334. Based on the information of the second VPN termination device 332 included in the first VPN connection request for establishing the VPN connection with the device A334, the physical line information to the second VPN termination device 332 is identified from the line information storage unit, and the identified physical The line is provided to the request source (line information specifying unit 308). Note that the VPN connection control device 100 and the authentication server 310 may realize their functions with the same device.

  Next, an operation example (VPN connection control method) of the VPN connection control apparatus according to the present embodiment will be described with reference to FIG. First, in response to the operation of a moving user, in step S401, the user terminal device A334 sends a connection request to the wireless AP 333 of the destination organization. Next, in step S402, the wireless AP 333 permits connection with the user terminal device A334. As a result, the user terminal device A334 is connected to the LAN of the destination organization. At this time, the wireless AP 333 may perform terminal authentication or user authentication on the user terminal device A334.

  Next, in step S403, the user terminal device A334 sends a VPN connection request to the VPN connection control device 100 via the first VPN termination device 331 using the PPPoE protocol. Next, in step S404, in the VPN connection control device 100, the first connection request accepting unit 101 accepts the VPN connection request described above, and the authentication unit 307 authenticates the user terminal device A334 that has transmitted the VPN connection request. Request information. Next, in step S405, the user terminal apparatus A334 that has received the request for authentication information transmits, for example, a user ID, a domain name, and a password to the VPN connection control apparatus 100 as authentication information. The authentication information described above may be set in the user terminal device A334 in advance, or may be input by a user using the user terminal device A334 at the time of connection.

  Next, in step S406, when the VPN connection control apparatus 100 receives the authentication information sent from the user terminal apparatus A334, the authentication unit 307 sends the authentication information received from the user terminal apparatus A334 and the user to the authentication server 310. The identification information of the access line of the terminal device A334 is transmitted to request authentication. The authentication server 310 is installed, for example, in the VPN service provider network of the VPN connection control apparatus 100, and the VPN connection control apparatus 100 communicates with the authentication server 310 using the RADIUS protocol.

  Next, in step S407, in the authentication server 310, the authentication unit 311 verifies the transmitted authentication information and performs user authentication, and refers to a connection-permitted access line list set in advance for each domain name. It is determined whether connection from the access line is permitted, and this determination result is returned as an authentication result to the VPN connection control apparatus 100 (authentication unit 307).

  In addition, referring to a connection permission domain list (line information storage unit) set in advance for each connection source access line, it is determined whether or not the domain connection of the user (user terminal device A334) is permitted. May be the authentication result. By doing so, the user terminal device A334 lends in the position of lending the access line by the “line contractor of the line used for VPN access (the line between the first VPN terminating device 331 and the network 121)”. "A line of access to the VPN service (= access)" by "a user who wants to restrict users" and "a contractor of a VPN service (a contract identified by the domain of the user terminal A334) to which the user terminal A334 is connected" From the viewpoint of “restricting possible locations” ”, a connection permission list can be set, and the authentication server 310 can perform connection determination (authentication) based on both of these viewpoints.

  Next, in step S408, in the VPN connection control device 100, when the authentication unit 307 receives a notification that the authentication result is connectable (permitted) from the authentication server 310, first, the first VPN connection establishment unit 102 determines that the user terminal A VPN connection (first VPN connection) is established with the device A334. Next, the VRF management unit 306 checks whether a VRF corresponding to the domain of the user terminal device A334 already exists. When the VRF exists, the first VPN connection establishment unit 102 accommodates the access session (VPN connection) of the user terminal device A334 in the VRF. On the other hand, if it does not exist, the VRF management unit 306 newly creates a VRF corresponding to the domain, and accommodates the access session of the user terminal device A334 in the created VRF. In step S409, the authentication unit 307 notifies the authentication result to the user terminal device A334. For example, when the authentication result of the authentication server 310 is not connectable, the user terminal device A334 is notified of the authentication failure.

  Next, in step S410, in the VPN connection control device 100, the line information specifying unit 308 transmits the domain name of the user terminal device A334 to the authentication server 310, and requests the user terminal device A334 to resolve the contracted line. In the authentication server 310 that has received this request, the line information resolution unit 312 refers to the correspondence relationship between the domain name registered in advance and the contracted line, and responds with contracted line (physical line) information (step S411). As described above, the line information resolution unit 312 transmits the second VPN termination included in the first VPN connection request for establishing the VPN connection with the user terminal device A334 for connection to the second VPN termination device 332 sent from the user terminal device A334. Based on the information of the device 332, the physical line information to the second VPN termination device 332 is specified from the line information storage unit, and the specified physical line is provided to the request source (line information specifying unit 308).

  Next, in step S412, in the VPN connection control apparatus 100, the VPN connection request transmission instructing unit 103 specifies the second VPN termination apparatus 332 as the transmission destination based on the contracted line information acquired from the authentication server 310, and the first 2 VPN termination device 332 is notified of a VPN connection request transmission instruction for establishing a VPN connection. The VPN connection request transmission instructing unit 103 performs the above notification to the second VPN terminating device 332 through the line (physical line) specified by the obtained contracted line information.

  Next, in step S413, in the second VPN termination device 332, the notification described above is received by the transmission instruction reception unit 332a, and the VPN connection request transmission unit 332b transmits a VPN connection request to the VPN connection control device 100. The VPN connection request sending unit 332b sends a VPN connection request using, for example, the PPPoE protocol.

  Next, in step S414, in the VPN connection control device 100, the first connection request accepting unit 101 accepts the VPN connection request described above, and the authentication unit 307 sends the VPN connection request to the second VPN terminating device 332. Request authentication information. Next, in step S415, in the second VPN termination device 332 that has received the request for authentication information, the authentication unit 332c transmits, for example, a user ID, a domain name, and a password to the VPN connection control device 100 as authentication information. To do. These are handled automatically.

  Next, in step S416, when the VPN connection control device 100 receives the authentication information sent from the second VPN termination device 332, the authentication unit 307 receives the authentication information received from the second VPN termination device 332 from the authentication server 310. And the identification information of the access line of the second VPN terminator 332 is transmitted to request authentication. Next, in step S417, in the authentication server 310, the authentication unit 311 verifies the transmitted authentication information and performs user authentication, and refers to a connection-permitted access line list set in advance for each domain name. It is determined whether connection from the access line is permitted, and this determination result is returned to the VPN connection control apparatus 100 as an authentication result.

  Next, in the VPN connection control device 100, when the authentication result from the authentication server 310 received by the authentication unit 307 is connectable (permitted), the second VPN connection establishment unit 105 performs VPN connection with the second VPN termination device 332 ( 2nd VPN connection) is established. Next, the VRF management unit 306 accommodates the newly established access session (VPN connection) of the second VPN termination device 332 in the VRF in which the access session of the user terminal device A334 is accommodated, and each VPN connection is relayed State.

  Thereafter, in step S418, in the VPN connection control device 100, the authentication unit 307 notifies the authentication result to the second VPN termination device 332, and in step S419, the user terminal device A334 and the user terminal device B335 connect to the VPN connection control device. Communication between terminals via VPN via 100 is started and access is possible.

  When the VPN connection control device 100 disconnects all the user terminal devices A334 connected to the VPN, the access session with the VPN termination device (first VPN termination device 331) under the contracted line of the user terminal device A334. Also disconnect and delete the VRF. Thereby, the VRF that is not used for the VPN connection is deleted, and the accommodation efficiency of the VPN can be improved.

  As described above, also in the present embodiment, even if the VPN connection is not established between the VPN connection control device 100 and the second VPN termination device 332, the second VPN termination device from the user terminal device A334. A VPN connection is established between the VPN connection control device 100 and the second VPN termination device 332 in response to a VPN connection request to 332 (user terminal device B335). As described above, according to the present embodiment, even if a VPN session with a VPN client as a communication destination is not established in advance, a VPN connection can be established based on a request, so that the VPN accommodation efficiency can be improved. It becomes like this.

  Further, according to the present embodiment, for example, a VPN connection request sending instruction is issued based on contracted line (physical line) information obtained by referring to the correspondence relationship between domain names registered in advance and contracted lines. The notification destination is determined. Therefore, complicated ID management is not required, and the use of an access line to the VPN service provider is permitted only for a specific visitor without incurring management costs, and the VPN to which the visitor is connected is restricted. It is also possible to do.

  In the above description, the authentication server 310 performs authentication based on a connection-permitted access line list set in advance for each domain name. However, the present invention is not limited to this. For example, referring to a connection-permitted domain list set in advance for each access line, authorization may be made based on whether or not a connection with a domain name on the user side (first VPN terminating device 331) is permitted. When a line contractor connected to the second VPN termination device 332 provides an access line (second VPN connection) to a visiting user (first VPN termination device 331), a user who is permitted to connect is specified as a user domain name. Can be limited.

  In addition, there may be a plurality of contract lines associated with the domain name on the user side. In this case, the VPN connection control apparatus 100 notifies the transmission instruction of the VPN connection request to the subordinates of each contract line. It may be.

  In addition, in the second VPN termination device 332, the IP address of the VPN connection control device 100 is registered in advance, and the notification of the instruction to send out the VPN connection request whose source is an IP address other than the registered IP address is discarded. May be. By doing in this way, it can prevent connecting with the VPN connection control apparatus 100 by the notification of the transmission instruction | indication of the VPN connection request which the third party transmitted. In addition to the IP address, information that can identify the VPN connection control apparatus 100 may be used.

  Incidentally, a gate control device having a firewall function may be provided between the VPN service provider network (network 121) of the VPN connection control device 100 and the user affiliated organization network of the second VPN termination device 332. In such a case, it is necessary to update the filtering rule of the gate control device in order to notify (transmit) the VPN connection request transmission instruction from the VPN connection control device 100 to the second VPN termination device 332.

  For example, a gate control device that updates filtering rules in conjunction with SIP (Session Initiation Protocol) signaling passes only SIP packets in the initial state, and in addition, a pair of IP address and port number negotiated by SIP. Only packets with the source and destination are passed.

  When this gate control device is installed, when the second VPN termination device 332 connects to the VPN connection control device 100, the second VPN termination device 332 makes a call to the VPN connection control device 100 by SIP, and the VPN connection is established. It is necessary to negotiate a pair of IP address and port number to be used by SIP. Furthermore, when transmitting a VPN connection request transmission instruction from the VPN connection control device 100 to the second VPN termination device 332, it is necessary to make a call from the VPN connection control device 100 to the second VPN termination device 332 by SIP. By these things, the filtering rule of a gate control apparatus can be updated and the transmission instruction | indication of a VPN connection request can be passed.

  The VPN connection control device 100 is a computer device (server) including a CPU, a main storage device, an external storage device, a network connection device, and the like, and the CPU is operated by a program developed in the main storage device. Each function described above is realized.

  For example, the VPN connection control device includes a first connection request reception function for receiving a first VPN connection request for establishing a VPN connection with the first VPN client for connecting to the second VPN client sent from the first VPN client, and the first connection request receiving function. The first VPN connection establishment function that establishes the first VPN connection with the first VPN client by the first VPN connection request accepted by the connection request acceptance function and the VPN connection request transmission instruction for establishing the VPN connection are notified to the second VPN client. VPN connection request transmission instruction function, a second connection request reception function for receiving a second VPN connection request transmitted from the second VPN client after the VPN connection request transmission instruction function notifies the transmission instruction, and reception of the second connection request Second VPN connection accepted by the function A first 2VPN connection establishment function for establishing the first 2VPN connection between the first 2VPN clients by sought, can be realized by executing a program and a relay function of relaying the 1VPN connected to the first 2VPN connected to the computer.

  Further, for example, the VPN client receives a transmission instruction reception function for receiving a VPN connection request transmission instruction for establishing a VPN connection notified from the VPN connection control device, and a VPN connection request transmission instruction received by the transmission instruction reception function. Thus, it can be realized by causing a computer to execute a program having a VPN connection request sending function for sending a VPN connection request to the VPN connection control device.

Further, for example, the authentication server includes an authentication function for performing authentication based on authentication information sent from the first VPN client and the second VPN client, a line information storage unit in which physical line information for the second VPN client is stored, Physical line information to the second VPN client based on the information of the second VPN client included in the first VPN connection request for establishing the VPN connection with the first VPN client for connecting to the second VPN client sent from the first VPN client was identified from the line information storage unit, can be realized by executing a program and a to that times line information identification provide specific physical line to the requesting the computer.

  Moreover, the program should just be what was recorded on the recording medium. Each function may be realized by a single computer device, or may be distributed to a plurality of computer devices.

  DESCRIPTION OF SYMBOLS 101 ... 1st connection request reception part, 102 ... 1st VPN connection establishment part, 103 ... VPN connection request transmission instruction | indication part, 104 ... 2nd connection request reception part, 105 ... 2nd VPN connection establishment part, 106 ... Relay part, 121 ... Network 131... VPN client A, 132... VPN client B, 132 a... Sending instruction receiving unit, 132 b.

Claims (4)

In a VPN connection control system for establishing a VPN connection between a first VPN client and a second VPN client,
First connection request accepting means for accepting a first VPN connection request for establishing a VPN connection with the first VPN client for connecting to the second VPN client sent from the first VPN client;
First VPN connection establishing means for establishing a first VPN connection with the first VPN client by the first VPN connection request received by the first connection request accepting means;
VPN connection request transmission instruction means for notifying the second VPN client of a transmission instruction of a VPN connection request for establishing a VPN connection;
A second connection request accepting means for accepting a second VPN connection request sent from the second VPN client after the VPN connection request sending instructing means notifies the sending instruction;
Second VPN connection establishing means for establishing a second VPN connection with the second VPN client by the second VPN connection request received by the second connection request receiving means;
A VPN connection control device comprising: relay means for relaying the first VPN connection and the second VPN connection;
Authentication means for performing authentication based on authentication information sent from the first VPN client and the second VPN client;
A line information storage unit in which physical line information to the second VPN client is stored;
Based on the information of the second VPN client included in the first VPN connection request, physical line information to the second VPN client is specified from the line information storage unit, and the specified physical line is sent from the VPN connection control device . An authentication server comprising: line information resolution means provided to the VPN connection control device upon request;
Comprising at least
The second VPN client is
Sending instruction receiving means for receiving notification from the VPN connection control device;
VPN connection request sending means for sending the second VPN connection request to the VPN connection control device according to a VPN connection request sending instruction received by the sending instruction receiving means,
The VPN connection request transmission instructing unit performs the notification to the second VPN client through the physical line specified by the line information resolution unit. The VPN connection control system according to claim 1 ,
The line information storage unit stores connection permission domain information set for each access line of the connection source of the first VPN client and the second VPN client,
The authentication means refers to the connection-permitted domain information, and restricts the users who are permitted to connect with the domain name of the user, thereby determining the domain connection permission of the first VPN client and the second VPN client. VPN connection control system. Authentication means for performing authentication based on authentication information sent from the first VPN client and the second VPN client;
A line information storage unit in which physical line information to the second VPN client is stored;
Based on the information of the second VPN client included in the first VPN connection request for establishing a VPN connection with the first VPN client for connecting to the second VPN client sent from the first VPN client, the second VPN client physical line information identified from the line information storage unit, the authentication server characterized in that it comprises at least a that provide specified physical line to the requestor times line information solutions to. The authentication server according to claim 3 ,
The line information storage unit stores connection permission domain information set for each access line of the connection source of the first VPN client and the second VPN client,
The authentication means refers to the connection-permitted domain information, and restricts the users who are permitted to connect with the domain name of the user, thereby determining the domain connection permission of the first VPN client and the second VPN client. Authentication server to do.

Images