JP5215232B2 - Data communication device for internet - Google Patents

Description

  The present invention relates to a data communication apparatus for the Internet that can realize safe data communication between a user terminal and an arbitrary serial communication device via the Internet.

  In order to connect a serial communication device to the Ethernet (registered trademark) system, an Ethernet (registered trademark) / serial converter (so-called device server) is widely available on the market (for example, Non-Patent Document 1).

  Since the device server can bidirectionally convert serial data and TCP / IP protocol packet data on Ethernet (registered trademark), an arbitrary serial communication device is connected to the Ethernet (registered trademark) system, For example, data communication can be realized with a personal computer.

  On the other hand, on the Internet, a DNS (Domain Name System) server is used for associating a domain name with an IP address of each computer connected as a user terminal or server, and DHCP (Dynamic Host Configuration) from an ISP (Internet Service Provider). In order to associate a dynamic IP address distributed by Protocol with a domain name, a DDNS service by a DDNS (Dynamic Domain Name System) server has been introduced (for example, Patent Document 1).

Connect ME Device Server, Digi International, http://www.shoshin.co.jp/computer/digi/connme/index.html

JP 2003-169077 A

  According to such a conventional technique, the device server can be accessed from a remote user terminal via the Internet. However, in this case, since the IP address for access is made public on the Internet, for security reasons. It is not preferable. In particular, when the IP address is not a fixed address but a dynamic IP address distributed by DHCP, and access by a domain name is permitted using a DDNS server, it is safe only for a specific user terminal. There is a problem that access cannot be permitted.

  Therefore, in view of the problems of the prior art, an object of the present invention is data for the Internet that can improve security by allowing only access from a specific user terminal even when a DDNS server is used. It is to provide a communication device.

  In order to achieve the above object, a configuration of the present invention includes a microcomputer with a memory that can be connected to the Internet via an Internet interface, a protocol conversion module that can be connected to the Internet via an Internet interface, a protocol conversion module, and an external device. Each time it connects to the Internet, the microcomputer transmits the identification code in the memory and the current IP address to the DDNS server and the user. The serial communication module is activated only when the identification code notified from the DDNS server matches the identification code in the memory when the connection request based on the domain name from the terminal is authenticated, via the Internet As its gist to allow data communication between the over The terminal and the serial communication device.

  According to the configuration of the invention, each time the microcomputer is connected to the Internet, the microcomputer transmits the identification code stored in the memory in advance together with the current dynamic IP address to the DDNS server. On the other hand, in the DDNS server, the domain name of the data communication device and the identification code are registered in advance in association with each other. Accordingly, when the DDNS server is notified of the identification code and the current IP address from the data communication apparatus, the DDNS server can perform registration processing in association with the information in association with the domain name.

  Subsequently, when a connection request is made from a user terminal by specifying a data communication device having a specific domain name with a user ID and password, the DDNS server authenticates the user ID and password, and the connection request is received. If the authentication is successful, the data communication apparatus is notified of the identification code corresponding to the domain name from the user terminal. Therefore, the microcomputer activates the serial communication module only when the identification code from the DDNS server matches the identification code stored in the memory, and allows data communication between the user terminal and the serial communication device. Thus, only access from a specific user terminal is permitted, and safe bidirectional data communication can be realized between the user terminal and the serial communication device via the Internet. However, the DDNS server notifies the data communication device of the identification code, notifies the user terminal of the current IP address of the data communication device, and connects the user terminal to the data communication device via the Internet. to enable.

Note that data communication between the user terminal and the serial communication device is performed using SSL (Secure
It is preferable to perform encryption by applying Sockets Layer) or the like. The same applies to the identification code transmitted to the DDNS server each time the microcomputer is connected to the Internet. Moreover, the identification code transmitted from the microcomputer to the DDNS server may be a code unique to the data communication device, for example, a MAC address (Media Access Control Address) configured by combining a manufacturer name and a serial number. Good.

Overall block diagram showing usage Operation sequence diagram Program flow chart (1) Program flow chart (2) Program flow chart (3)

  Hereinafter, embodiments of the present invention will be described with reference to the drawings.

  The data communication apparatus 10 for the Internet includes a microcomputer 11 with a memory 11a, an Internet interface 12, a protocol conversion module 13, and a serial communication module 14 (FIG. 1).

  The memory 11a and the Internet interface 12 are bidirectionally connected to the microcomputer 11, respectively. The Internet interface 12, the protocol conversion module 13, and the serial communication module 14 are connected bidirectionally in this order, and the output of the microcomputer 11 is connected to the serial communication module 14. The Internet interface 12 is connected to the external Internet 1, and the user terminal 2 and the DDNS server 3 are connected to the Internet 1. The serial communication module 14 is bidirectionally connected to the external serial communication device 4.

  The protocol conversion module 13 can bidirectionally convert TCP / IP protocol packet data on the Internet 1 and serial data input / output to / from the serial communication device 4 via the serial communication module 14. The microcomputer 11 and the protocol conversion module 13 can be connected to the Internet 1 via the Internet interface 12. A plurality of sets of a data communication device 10 and a serial communication device 4 are connected to the Internet 1.

  It is assumed that each data communication device 10 and the user terminal 2 are given dynamic IP addresses by ISP DHCP (not shown). Each data communication device 10 is set with a domain name including a subdomain, and the correspondence between the domain name and the current IP address is registered and maintained in the DDNS server 3. The user terminal 2 is a client terminal of the DDNS server 3 together with a plurality of data communication devices 10,..., And an identification code of the data communication device 10 is stored in the memory 11 a of the microcomputer 11. In the DDNS server 3, the user ID and password of the user terminal 2 are pre-registered in association with each other, and the domain name and identification code of each data communication device 10 are pre-registered in association with each other.

  The microcomputer 11 of the data communication apparatus 10 operates together with the DDNS server 3 and the user terminal 2, for example, according to the operation sequence of FIG. However, the operation sequence in FIG. 2 indicates the progress of time from the top to the bottom, and the horizontal arrows indicate the transmission direction of packet communication among the data communication device 10, the DDNS server 3, and the user terminal 2. .

  In FIG. 2, the data communication apparatus 10 immediately connects the microcomputer 11 to the Internet 1 (W12) when the power is turned on (operation step W11 in FIG. 2, hereinafter simply referred to as (W11)). Therefore, the microcomputer 11 reads the identification code of the data communication device 10 stored in the memory 11a, and the DDNS server via the Internet interface 12 and the Internet 1 together with the current IP address assigned to the data communication device 10. 3 (communication step P1 in FIG. 2, hereinafter simply referred to as (P1)). After that, the microcomputer 11 waits while reconnecting to the Internet 1 at regular intervals and repeating the same operation until the identification code is notified from the DDNS server 3 in the communication step P3 (W12, P1).

  On the other hand, the DDNS server 3 pre-registers the user ID and password of the user terminal 2 in association with the domain name and identification code of each data communication device 10, and then identifies the identification code from the data communication device 10 in communication step P1. Waiting for the current IP address to be notified. Therefore, when the identification code and IP address from the data communication apparatus 10 arrive (P1), the DDNS server 3 collates the registered domain name and identification code, and associates the domain name, identification code and IP address with each other. The registration process is performed (W31), and a similar operation is repeated until there is a connection request from the user terminal 2 in the communication step P2 (P1, W31).

  When the user terminal 2 is activated (W21), it immediately connects to the Internet 1 (W22). Subsequently, when the user inputs the domain name of the designated data communication apparatus 10 together with the user ID and password (W23), the user terminal 2 sends a connection request to the DDNS server 3 together with the user ID, password and domain name. Transmit (P2). Therefore, the DDNS server 3 verifies the user ID and password from the user terminal 2 against the user ID and password registered in advance (W32), and the connection request from the user terminal 2 is correctly authenticated. Then, the identification code of the designated data communication device 10 corresponding to the domain name from the user terminal 2 is specified based on the registration processing data in the operation step W31 and notified to the data communication device 10 (P3). The DDNS server 3 notifies the current IP address of the data communication apparatus 10 to the user terminal 2 (P4).

  Note that if the authentication of the user ID and password from the user terminal 2 fails in the operation step W32, the DDNS server 3 sends message data to that effect to the user terminal 2. In addition, in the operation step W32, the DDNS server 3 also checks that the designated data communication device 10 is properly connected to the Internet 1, and if the designated data communication device 10 is not connected to the Internet 1. Sends message data to that effect to the user terminal 2. Therefore, the user terminal 2 can display each message to the user.

  When the identification code is notified from the DDNS server 3 in the communication step P3, the microcomputer 11 of the data communication apparatus 10 confirms that the notified identification code matches the identification code in the memory 11a and serializes it. The communication module 14 is activated (W13). On the other hand, the user terminal 2 registers the current IP address of the data communication device 10 notified from the DDNS server 3 in the communication step P4, and displays to the user that the preparation for connection to the designated data communication device 10 is completed. (W24).

  Thereafter, the user terminal 2 connects to the data communication device 10 via the Internet 1 and then starts predetermined data communication with the serial communication device 4 connected to the data communication device 10 (P5). The communication device 4 can respond to the user terminal 2 via the data communication device 10. As described above, when data communication is started between the user terminal 2, the data communication device 10, and the serial communication device 4 via the Internet 1, the user terminal 2 and the data communication device are thereafter transmitted. Even if one or both of the IP addresses 10 dynamically change, mutual data communication can be continued normally via a DNS server (not shown).

  The microcomputer 11 may encrypt the identification code of the data communication apparatus 10 and transmit it to the DDNS server 3 in the communication step P1 of FIG. Further, the protocol conversion module 13 and the user terminal 2 may encrypt and transmit mutual data communication contents after the communication step P5 in FIG.

  The data communication device 10, the DDNS server 3, and the user terminal 2 operate according to, for example, the program flowcharts of FIGS. 3 to 5 in order to realize the operation sequence of FIG.

  When the data communication device 10 is turned on, it automatically connects the microcomputer 11 to the Internet 1 (program step (1) in FIG. 3, hereinafter referred to simply as (1)), and the identification code in the memory 11a is displayed. It is read out and sent to the DDNS server 3 together with the current IP address (2). That is, program steps (1) and (2) in FIG. 3 correspond to operation step W12 and communication step P1 in FIG. 2, respectively. Thereafter, the program waits for the notification of the identification code from the DDNS server 3 in the communication step P3 of FIG. 2 (3), but during that time, the microcomputer 11 is reconnected to the Internet 1 at regular intervals, and the identification code The IP address is transmitted to the DDNS server 3 ((3), (4), (1) to (3)).

  When the identification code is notified from the DDNS server 3 in the communication step P3 in FIG. 2 (3), the program confirms that the identification code matches the identification code in the memory 11a (5), and the serial communication module 14 is Start (6) and wait for connection from the user terminal 2 in communication step P5 of FIG. 2 (7). That is, the program step (6) corresponds to the operation step W13 of FIG. When there is a connection from the user terminal 2 (7), the program realizes bidirectional data communication between the user terminal 2 and the serial communication device 4 (8), waits for its completion (9), and the serial After the communication module 14 is stopped (10), the series of operations are terminated and the original operation is returned (1).

  In the program step (5), if the identification codes do not match, the program returns to the program step (1) to reject the response. In the program step (7), if there is no connection from the user terminal 2 within a predetermined period of time (11), the serial communication module 14 is stopped (12), and another trial is waited (3).

  When the DDNS server 3 pre-registers the user ID and password of the user terminal 2 in correspondence with the domain name and identification code of each data communication device 10, the identification from the data communication device 10 is performed by the communication step P1 in FIG. Waiting for the notification of the code and the current IP address (program step (1) in FIG. 4, hereinafter simply indicated as (1)). When there is a notification of the identification code and IP address from the data communication device 10 (1), the registered domain name and identification code are collated, and the domain name, identification code and current IP address are associated with each other and registered ( 2) Wait for the connection request from the user terminal 2 to arrive at the communication step P2 in FIG. 2 ((3), (1) to (3)). The DDNS server 3 can maintain the latest correspondence data of the domain name, the identification code, and the IP address by reflecting the dynamic change of the IP address of the data communication apparatus 10 during standby. ((1), (2)). Therefore, the program step (2) in FIG. 4 corresponds to the operation step W31 in FIG.

  When there is a connection request from the user terminal 2 (3), the user ID and password from the user terminal 2 are authenticated (4), and when the connection request is properly authenticated (5), the domain name of the connection request (6), the identification code is notified to the data communication device 10 (7), and the user terminal 2 is notified to the user terminal 2 Then, the current IP address of the data communication apparatus 10 is notified (8). Thereafter, the DDNS server 3 returns to the original state and waits to cope with the other data communication apparatus 10 (1).

  Note that the identification code and the IP address of the data communication device 10 used in the program steps (7) and (8) are both the latest correspondence data registered in the program step (2). Therefore, program steps (4) to (6) correspond to the operation step W32 in FIG. 2, and program steps (7) and (8) correspond to the communication steps P3 and P4 in FIG. 2, respectively. .

  On the other hand, if authentication of the user ID and password from the user terminal 2 fails in the program step (5), if the designated data communication device 10 is not actually connected to the Internet 1 in the program step (6), A message to that effect is notified to the user terminal 2 ((9), (10)). Therefore, the user terminal 2 at this time can display a message to the user that the authentication has failed or that the designated data communication device 10 is not connected.

  As soon as the user terminal 2 is activated, it is automatically connected to the Internet 1 (program step (1) in FIG. 5, hereinafter simply referred to as (1)). Therefore, the user can input a user ID and a password, designate and input a specific data communication device 10 by a domain name, and transmit a connection request to the DDNS server 3 (2). Program step (1) corresponds to operation step W22 of FIG. 2, and program step (2) corresponds to operation step W23 and communication step P2.

  Subsequently, the user terminal 2 checks the absence of the authentication failure notification from the DDNS server 3 and the notification that the data communication device 10 is not connected to the Internet 1 while checking the DDNS server by the communication step P4 in FIG. 3 to wait for notification of the current IP address of the designated data communication device 10 ((3) to (5), (3)). When the IP address of the designated data communication device 10 is notified from the DDNS server 3 (5), the IP address is registered and the user is informed that the connection preparation is completed (6), and then via the Internet 1 The designated data communication device 10 is accessed and connected (7), and data communication with the serial communication device 4 connected to the data communication device 10 is started (8). When the predetermined data communication is completed (9), the process returns to the program step (2) to prepare for data communication with the other data communication device 10 and the serial communication device 4.

  Therefore, the program step (6) corresponds to the operation step W24 in FIG. 2, and the program steps (7) and (8) correspond to the communication step P5. In addition, in the program steps (3) and (4), when the notification of the authentication failure from the DDNS server 3 and the notification of the disconnection of the data communication device 10 are detected respectively, a message to that effect is displayed (10), Retry within the specified number of times is permitted ((11), (2) to (4), (10), (11)), and when the retry result is not good (11), the series of operations is terminated.

  The present invention can safely perform bidirectional data communication between the user terminal 2 and an arbitrary serial communication device 4 via the Internet 1. For example, when an industrial programmable sequencer is applied as the serial communication device 4, a remote maintenance system from a remote user terminal 2 can be realized via the Internet 1, and necessary and sufficient security can be realized.

DESCRIPTION OF SYMBOLS 1 ... Internet 2 ... User terminal 3 ... DDNS server 4 ... Serial communication apparatus 11 ... Microcomputer 11a ... Memory 12 ... Internet interface 13 ... Protocol conversion module 14 ... Serial communication module

Patent applicant
Attorney Tadaaki Matsuda, Attorney

Claims (1)

  A microcomputer with a memory that can be connected to the Internet via the Internet interface, a protocol conversion module that can be connected to the Internet via the Internet interface, and the protocol conversion module and an external serial communication device. Each time it connects to the Internet, the microcomputer transmits the identification code in the memory and the current IP address to the DDNS server, and a connection request based on the domain name from the user terminal is made. The serial communication module is activated only when the identification code notified from the DDNS server by the authentication and the identification code in the memory match, and communicates with the user terminal via the Internet. Data communication apparatus for the Internet, characterized in that to allow data communication between the devices.

Images