JP5633693B2 - Relay server and relay communication system - Google Patents

Description

  The present invention mainly relates to a relay server that enables communication between terminals connected to different LANs (Local Area Networks).

  Conventionally, a communication technique called a virtual private network (VPN) is known (see, for example, Patent Document 1). This VPN is used, for example, for applications in which terminals connected to LANs of a plurality of branch offices (bases) provided for each region communicate via the Internet. If the VPN is used, another remote LAN can be used as if it were a directly connected network.

JP 2002-217938 A

  However, this type of system tends to be rigid, and it is not easy to construct a system that is extensible and flexible. For example, a communication system such as that disclosed in Patent Document 1 cannot construct a virtual network with only a part of selected devices among the devices constituting the system. In particular, when the setting is changed after starting the virtual network, it is difficult to reflect the change in the setting while maintaining the state in which the virtual network operates normally.

  The present invention has been made in view of the above circumstances, and a main object of the present invention is to provide a relay server that can construct a VPN that can flexibly cope with changes in settings after the virtual network is started. It is in.

Means and effects for solving the problems

  The problems to be solved by the present invention are as described above. Next, means for solving the problems and the effects thereof will be described.

According to a first aspect of the present invention, a relay server having the following configuration is provided. That is, the relay server includes a relay group information storage unit, a relay server information storage unit, a VPN group information storage unit, an address filter information storage unit, and a communication control unit. The relay group information storage unit stores information on relay groups including other relay servers that can be connected to each other. The relay server information storage unit stores relay server information including start information of the relay server belonging to the relay group and start information and registration information of a client terminal connected to the relay server belonging to the relay group. To do. The VPN group information storage section is a said relay server and the client terminal that is set as the routing point of the relay server and the client terminal constituting the relay communication system based on the relay group information and the relay server information With respect to a VPN group that is configured by a routing device and communicates with the virtual private network via the routing device, the identification information of the routing device configuring the VPN group and the connection information indicating the routing device connected to each other are stored. . The address filter information storage unit stores address filter information indicating a partner that can be designated by the routing device as a packet transmission destination in association with identification information of the routing device. The communication control unit performs control to notify the update contents when the address filter information associated with its own identification information is updated after starting a virtual private network in the VPN group.

  As a result, the relay server can construct a VPN with a routing device selected from other communication devices (other relay servers and client terminals) constituting the relay communication system. Share and so on. Further, the relay server can notify other routing devices and the like that the address filter information associated with itself has been updated after starting the virtual private network in the VPN group. Therefore, it is possible to cause another routing device to take an appropriate action according to the change of the address filter information.

  In the relay server, when the communication control unit receives a notification that the address filter information has been updated after starting the virtual private network in the VPN group, the communication control unit, based on the updated content, Control for updating the storage content of the filter information storage unit, control based on the updated address filter information, referencing a partner that can be designated as a transmission destination by the routing device, and routing based on the content, It is preferable to perform this without stopping the virtual private network.

  As a result, the number of destinations that can be specified by the routing device as the packet transmission destination can be increased or decreased while maintaining the VPN.

  The relay server preferably has the following configuration. That is, when the destination of the received packet is specified in the address filter information associated with its own identification information, the relay server transmits the packet to the destination. When the destination of the received packet is specified in the address filter information associated with the identification information of the routing device other than itself, the relay server establishes the routing established between itself and the routing device. A packet is transmitted to the routing device via the session. The relay server does not transmit the packet when the destination of the received packet is not specified in the address filter information associated with the identification information of the routing device.

  Thereby, the relay server can perform routing appropriately based on the address filter information.

  According to the 2nd viewpoint of this invention, the relay communication system of the following structures is provided. That is, this relay communication system includes a plurality of relay servers and client terminals. The client terminals can be connected to each other via the relay server. The relay server includes a relay group information storage unit, a relay server information storage unit, a VPN group information storage unit, an address filter information storage unit, and a communication control unit. The relay group information storage unit stores information on relay groups including other relay servers that are mutually connectable with the relay server. The relay server information storage unit stores relay server information including start information of the relay server belonging to the relay group, start information and registration information of the client terminal. The VPN group information storage unit includes a routing device that is set as a routing point among the relay server and the client terminal, and relates to a VPN group that performs communication through a virtual private network via the routing device. The identification information of the routing device to be configured and the connection information indicating the routing device connected to each other are stored. The address filter information storage unit stores address filter information indicating a partner that can be designated by the routing device as a packet transmission destination in association with identification information of the routing device. The communication control unit performs control to notify the update contents when the address filter information associated with its own identification information is updated after starting a virtual private network in the VPN group.

  As a result, the VPN can be constructed using the routing device selected from the relay server and the client terminal, so that the file can be shared only with the necessary device. In addition, after starting VPN in the VPN group, it is possible to notify other routing devices and the like that the address filter information has been updated later. Therefore, it is possible to cause another routing device to take an appropriate action according to the change of the address filter information.

BRIEF DESCRIPTION OF THE DRAWINGS Explanatory drawing which shows the whole structure of the relay communication system which concerns on one Embodiment of this invention. The functional block diagram of a relay server. The figure which shows the content of relay group information. The figure which shows the content of relay server information. The figure which shows the content of client terminal information. The figure which shows the content of VPN group information. The figure which shows the memory content of an address filter information storage part. The flowchart which shows the process which produces a VPN group. The flowchart which shows the first half part of the process which starts VPN. The flowchart which shows the second half part of the process which starts VPN. The sequence diagram which shows the communication process which creates a VPN group, and the communication process which updates address filter information. The sequence diagram which shows the communication process which establishes a routing session, and performs the transmission of a packet. The sequence diagram which shows a communication process when address filter information is changed after the start of VPN. The figure which shows the memory content of the address filter information storage part after the address filter information matched with the relay server 3 is updated. The sequence diagram which shows the communication process which complete | finishes a VPN group.

  Next, embodiments of the present invention will be described with reference to the drawings. First, an overview of the relay communication system 100 of the present embodiment will be described with reference to FIG. FIG. 1 is an explanatory diagram showing the overall configuration of a relay communication system 100 according to an embodiment of the present invention.

  As shown in FIG. 1, the relay communication system 100 includes a plurality of LANs 10, 20, 30, and 40 connected to a wide area network (WAN) 80. Each of the LANs 10, 20, 30, 40 is a relatively small network constructed in a limited place, and each is constructed in a physically separated place. In the present embodiment, the Internet is used as the WAN 80.

  Each LAN will be specifically described below. As shown in FIG. 1, a relay server 1, a client terminal 11, and a processing device 12 are connected to the LAN 10. A relay server 2, a client terminal 21, a processing device 22, and a processing device 23 are connected to the LAN 20. A relay server 3, a client terminal 31, a processing device 32, and a processing device 33 are connected to the LAN 30. A relay server 4, a client terminal 41, and a processing device 42 are connected to the LAN 40.

  Since each relay server 1, 2, 3, 4 is connected not only to the LAN 10, 20, 30, 40 but also to the WAN 80, not only can it communicate with a client terminal connected to the same LAN, Communication is possible with a relay server arranged in another LAN. Therefore, a private IP address is given to the relay servers 1, 2, 3, and 4 in addition to the global IP address.

  The client terminals 11, 21, 31, 41 are constituted by personal computers, for example, and can communicate with each other via the relay servers 1, 2, 3, 4. The processing devices 12, 22, 23, 32, 33, and 42 are constituted by personal computers, for example, and can transmit packets to the client terminals 11, 21, 31, and 41 via the LANs 10, 20, 30, and 40. .

  Next, the relay servers 1, 2, 3, and 4 will be described. Since these four relay servers have substantially the same configuration except for some stored data, the relay server 1 will be described as a representative. First, the configuration of the relay server 1 will be described with reference to FIG. FIG. 2 is a functional block diagram of the relay servers 1, 2, 3, and 4.

  As illustrated in FIG. 2, the relay server 1 includes a storage unit 50, a control unit 60, and an interface unit 70.

  The interface unit 70 can communicate with a terminal in the LAN 10 using a private IP address. In addition, the interface unit 70 can perform communication via the WAN 80 using a global IP address.

  The control unit 60 is a CPU having control and calculation functions, for example, and can execute various processes by a program read from the storage unit 50. The control unit 60 can control various communication processes according to protocols such as TCP / IP, UDP, and SIP. As shown in FIG. 2, the control unit 60 includes an interface driver 61, a LAN side IP packet processing unit 62, a communication control unit 63, and a WAN side IP packet processing unit 64.

  The interface driver 61 is driver software that controls the interface unit 70. The LAN side IP packet processing unit 62 performs appropriate processing on the packet received from the LAN 10 and outputs the packet to the communication control unit 63. The WAN-side IP packet processing unit 64 performs appropriate processing on the packet received from the WAN 80 and outputs the packet to the communication control unit 63.

  The communication control unit 63 determines the transmission destination of the received packet based on the information indicated by the packet and the information stored in the storage unit 50, and transmits the transmission destination to the determined transmission destination. Moreover, the communication control part 63 can update the memory content of the memory | storage part 50 based on the information received from the other terminal.

  The storage unit 50 is composed of, for example, a hard disk or a nonvolatile RAM, and can store various data. The storage unit 50 includes a relay group information storage unit 51, a relay server information storage unit 52, a client terminal information storage unit 53, a VPN group information storage unit 54, and an address filter information storage unit 55. Hereinafter, the configuration of the storage unit 50 will be described with reference to FIGS. FIG. 3 is a diagram showing the contents of the relay group information. FIG. 4 is a diagram showing the contents of the relay server information. FIG. 5 is a diagram showing the contents of the client terminal information. FIG. 6 is a diagram showing the contents of VPN group information. FIG. 7 is a diagram showing the contents of the address filter information.

  The relay group information storage unit 51 stores relay group information indicating a relay group and a relay server that constitutes the relay group.

  As shown in FIG. 3, in the relay group information, a group tag and a site tag of a child element whose parent element is the group tag are described. In the group tag, group information 511 related to the relay group is described. As the group information 511, relay group identification information (“id”), last update time (“lastmod”), and relay group name (“name”) are described. In the site tag, group configuration information 512 related to the relay server that configures the relay group is described. In this group configuration information 512, identification information (“id”) of the relay server is described. Further, additional relay groups can be created. In this case, unique identification information different from other relay groups is given to the new relay group. As a result, settings such as data exchange only within a specific relay group are possible.

  Note that this relay group information is shared among the relay servers 1, 2, 3, and 4 constituting the relay group. When a process for changing a relay group is performed in a certain relay server, the fact is transmitted to the other relay server and the relay group information is updated. In this way, relay group information is dynamically shared.

  The relay server information storage unit 52 stores relay server information indicating an outline of a relay server that performs relay communication and a client terminal that belongs to the relay server.

  In the relay server information shown in FIG. 4, a site tag described for each relay server and a node tag of a child element whose parent element is the site tag are described. In the site tag, server information 521 regarding the relay server 1 is described. As the server information 521, relay server identification information (“id”), a relay server name (“name”), and activation information (“stat”) are described. When the content of stat is “active”, it indicates that the relay server is logged in to the relay communication system 100, and when stat is blank, it indicates that the log-off is being performed. In a node tag that is a child element of the site tag, affiliation information 522 indicating a client terminal belonging to the relay server is described. The belonging information 522 includes the name of the relay group to which it belongs (“group”), the identification information of the client terminal (“id”), the name of the client terminal (“name”), and the identification information of the login destination relay server. ("Site"). When the client terminal is not logged in to the relay server (relay communication system 100), “site” is blank.

  Note that the communication by the relay group is performed as follows based on the relay group information and the relay server information. For example, when a packet is transmitted from the client terminal 11 to the client terminal 21, first, the client terminal 11 transmits the packet to the relay server 1, which is a relay server to which the client terminal 11 is connected. Note that the relay server capable of exchanging packets is known based on the relay group information, and the identification information of the client terminals belonging to the relay server and the possibility of connection are known based on the relay server information. Based on these pieces of information, the relay server 1 transmits a packet to the relay server 2 that is a relay server to which the client terminal 21 is connected. Then, the relay server 2 transmits a packet to the client terminal 21. In this way, relay communication can be performed between client terminals.

  As with the relay group information, the relay server information is shared between the relay servers 1, 2, 3, and 4 constituting the relay group. When a process for changing the relay server information is performed in a certain relay server, the fact is transmitted to the other relay server and the relay server information is updated. In this way, the relay server information is dynamically shared.

  The client terminal information storage unit 53 stores client terminal information that is detailed information about the client terminal. Note that the relay servers 1, 2, 3, and 4 store only client terminal information related to client terminals belonging to the relay server. For example, since the client terminal 11 belongs to the relay server 1 as shown in FIG. 1, only the client terminal information of the client terminal 11 is stored in the client terminal information storage unit 53 provided in the relay server 1. Yes.

  The client terminal information stored in the client terminal information storage unit 53 of the relay server 1 is shown in FIG. Similarly, the client terminal information stored in the relay server 2 is shown in FIG. 5B, the client terminal information stored in the relay server 3 is shown in FIG. 5C, and the client terminal information stored in the relay server 4 is shown in FIG. Each is shown in d).

  In the client terminal information shown in FIG. 5, a node tag is described. The node tag includes a private IP address (“addr”) of the client terminal, a name of the relay group to which the client terminal belongs (“group”), identification information (“id”), a name (“name”), a relay A password for logging in to the server (“pass”) and port information (“port”) are described.

  The VPN group information storage unit 54 stores VPN group information, which is information relating to a VPN group configured by a device selected from a relay server and a client terminal (hereinafter referred to as a routing device) configuring the relay group. A VPN group is a group configured in a relay group, and a virtual network can be constructed by establishing a routing session between routing devices.

  In the VPN group information shown in FIG. 6, a vnet tag is described. In this vnet tag, VPN group basic information 541, routing point information 542, and routing session information 543 are described. The VPN group basic information 541 includes a relay group name (“group”) to which the VPN group belongs, a VPN group identification information (“id”), a last update time (“lastmod”), and a VPN group name. ("Name"). The routing point information 542 describes identification information of a routing device that performs routing when communication is performed between VPN groups. In the example of FIG. 6, a client terminal 11, a client terminal 21, and a relay server 3 are described as routing devices. The routing session information 543 describes routing devices connected to each other in the VPN group. In the routing session information 543, the routing device performs communication control first (“sp (start point)”) in the routing session establishment process for starting VPN in the VPN group, and the side receiving the communication control “ ep (end point) ". In the following description, a routing device that first performs communication control for establishing a routing session may be referred to as a “start point”, and a routing device that receives the communication control may be referred to as a “end point”.

  As with the relay server information and the relay group information, the VPN group information is also shared between the relay servers 1, 2, and 3 constituting the VPN group. When a process for changing the VPN group information is performed in a certain relay server, the fact is transmitted to the other relay servers constituting the VPN group, and the VPN group information is updated. In this way, VPN group information is dynamically shared. The process for creating this VPN group will be described later.

  The address filter information storage unit 55 stores address filter information indicating a partner that can be designated by the routing device as a packet transmission destination when the routing device performs routing after starting the VPN.

  FIG. 7A shows the contents of the address filter information associated with the routing device. As shown in FIG. 7A, the client terminal 11 can transmit a packet to the processing device 12. The client terminal 21 can transmit a packet to the processing device 22 and the processing device 23. The relay server 3 can transmit a packet to all devices connected to the LAN 30.

  As shown in FIG. 7B, the address filter information storage unit 55 stores the identification information of the routing device and the IP address and name of the other party that can be designated as the packet transmission destination by the routing device in association with each other. doing. The name of the other party that can be specified as the packet transmission destination can be set to an arbitrary name such as a name that can be easily recognized by the user. For example, the name can be set in consideration of the location where the device and the LAN are arranged. Each routing device can display the address filter information on a display or the like. The address filter information is configured to be exchanged between routing devices when VPN is started.

  The relay servers 1, 2, 3, 4 are configured as described above. Although detailed description of the configuration of the client terminals 11, 21, 31, and 41 is omitted, the storage unit 50 and the control unit 60 are configured substantially the same as the relay servers 1, 2, 3, and 4. ing.

  Next, a process for constructing a VPN group and performing packet routing with the constructed VPN group will be described.

  First, the flow when building a VPN group will be described with reference to FIGS. FIG. 8 is a flowchart showing processing for creating a VPN group. FIG. 11 is a sequence diagram illustrating a communication process for creating a VPN group and a communication process for updating address filter information.

  A user using the relay communication system 100 can display a VPN group setting screen by operating the client terminals 11, 21, 31, and the like. Here, a case where setting is performed using the client terminal 11 will be described. On the setting screen displayed on the client terminal 11, a plurality of relay groups to which the client terminal 11 belongs are displayed. The user selects a relay group in which a VPN group is to be constructed from the plurality of relay groups (S101).

  When a relay group is selected, a list of identification information of relay servers and client terminals that belong to the selected relay group and that can function as a routing point is displayed on the screen of the client terminal 11 (S102). Then, the user selects identification information of a relay server and a client terminal that function as a routing point in the VPN group to be constructed (S103). In this description, it is assumed that the identification information of the client terminal 11, the client terminal 21, and the relay server 3 is selected by the user.

  Then, routing session information is created based on the selected routing point (S104). Further, the identification information of the routing point is created based on the identification information of the selected relay server or the like (S104). The VPN group information shown in FIG. 6 is created by adding VPN group identification information or the like to the created information, and the VPN group information storage unit 54 stores the VPN group information (S105).

  Then, the client terminal 11 sends the created VPN group information to other routing devices (the client terminal 21 and the relay server 3) (S106), thereby notifying that the VPN group has been created. The VPN group information is transmitted to the client terminal 21 via the relay server 1 and the relay server 2 as shown in FIG. 11 (sequence number 1, createVpnGroup). The VPN group information is transmitted to the relay server 3 via the relay server 1 (sequence number 2, createVpnGroup).

  Thereby, the construction process of the VPN group is completed. As described above, in this embodiment, communication between devices may be performed via the relay servers 1, 2, 3, and 4. In the following description, the relay servers 1, 2, and 3 are used. , 4 may be omitted, and may be described as “the client terminal 11 transmits to the client terminal 21”.

  Next, the flow when VPN is started in the constructed VPN group will be described with reference to FIGS. FIG. 9 is a flowchart showing the first half of the process for starting the VPN. FIG. 10 is a flowchart showing the latter half of the process for starting VPN. FIG. 12 is a sequence diagram illustrating a communication process for establishing a routing session and a communication process for transmitting a packet.

  The user can display the constructed VPN group on the screen by operating the client terminals 11 and 21 and the like. Then, by selecting an appropriate VPN group from the displayed VPN groups (S201), a process for starting the VPN can be performed. In this description, it is assumed that the user operates the client terminal 11 and selects the VPN group created above (VPN group having the client terminal 11, the client terminal 21, and the relay server 3 as routing devices).

  The client terminal 11 first reads address filter information associated with itself (S202). As shown in FIG. 7, the address filter information associated with the identification information of the client terminal 11 describes that the packet can be transmitted to the processing device 12. Next, the client terminal 11 reads out the routing points belonging to the selected VPN group (S203). Thereby, the identification information of the client terminal 21 and the relay server 3 is read based on the contents of the VPN group information shown in FIG.

  Based on the relay server information, the client terminal 11 first determines whether or not the client terminal 21 is logged in (whether the relay server identification information is described in “site” or is blank) (S204). . According to the relay server information shown in FIG. 4, since the client terminal 21 is logged in, the client terminal 11 transmits a VPN group start command to the client terminal 21 (sequence number 3, startVpn in FIG. 11). At this time, the identification information (VpnGroupID) of the selected VPN group and the address filter information (addr01) associated with the identification information of the client terminal 11 are also transmitted simultaneously.

  Thereby, the client terminal 21 can specify the VPN group that performs the start process, and can acquire the latest address filter associated with the identification information of the client terminal 11. Further, the client terminal 21 notifies the client terminal 11 that the signal has been received, and transmits address filter information (addr02) associated with the client terminal 11 to the client terminal 11.

  The client terminal 11 receives the response from the client terminal 21 (S206), and stores the received address filter information in the address filter information storage unit 55 (S207). Further, the client terminal 11 registers the client terminal 21 as a routing point that is ready to start VPN (S208).

  Next, the client terminal 11 determines whether there is another routing point (S209). At the time when the VPN start process for the client terminal 21 is completed, the VPN start process is not performed for the relay server 3, so that the client terminal 11 performs the processes of S 204 to S 208 for the relay server 3 this time. . As a result, the client terminal 11 transmits a VPN start command and address filter information to the relay server 3 (sequence number 5, startVpn in FIG. 11). Then, as in the case of the client terminal 21, the address filter information is received from the relay server 3 and stored.

  The transmission / reception of the VPN group start command and the address filter information is also performed between the client terminal 21 and the relay server 3 (sequence number 4, startVpn). As described above, the client terminal 11, the client terminal 21, and the relay server 3 can acquire the address filter information of other routing points.

  As described above, when starting VPN, each routing device exchanges (acquires) address filter information with other routing devices, and can construct a VPN using the latest address filter information. Therefore, even if the address filter information is changed in some routing devices at the stage before the VPN start, the VPN can be started in a state in which the change is reflected in all the routing devices. Can be prevented and reliability can be improved.

  Next, the client terminal 11 extracts the routing session information stored in the VPN group information storage unit 54 (S210), and determines whether a routing session starting from itself is described (S211). The routing session information in FIG. 6 describes that the client terminal 11 is the starting point in the routing session to be established between the client terminal 21 and the relay server 3.

  Therefore, first, the client terminal 11 selects the client terminal 21, and determines whether or not the client terminal 21 is a routing point that is ready to start VPN (S212). Since the client terminal 21 has been prepared by S208 described above, communication control for establishing a routing session from the client terminal 11 to the client terminal 21 is performed (S213, sequence number 6, createVpnSsn).

  Next, the client terminal 11 determines whether or not there is another description of the routing session that is the starting point of the connection (S214). At the time when the routing session establishment process for the client terminal 21 is completed, since the routing session establishment process with the relay server 3 is not performed, the client terminal 11 has also performed the relay server 3 on the client terminal 21. Communication similar to the communication is performed (sequence number 8, createVpnSsn). Thereby, a routing session is established between the client terminal 11 and the relay server 3.

  Further, as shown in FIG. 6, since the routing session information describes that the client terminal 21 should be the starting point of the routing session with the relay server 3, the communication control for establishing the routing session is This is also performed from the client terminal 21 to the relay server 3 (sequence number 7, createVpnSsn). As described above, routing sessions can be established between the client terminal 11 and the client terminal 21, between the client terminal 11 and the relay server 3, and between the client terminal 21 and the relay server 3, respectively. Thereafter, packet routing control is started (S215). Each routing device does not perform the initial communication control for establishing a routing session unless the routing session information indicates that it is the starting point. The routing session can be established with simple control.

  Next, processing for routing a packet using an established routing session will be described with reference to FIGS. Hereinafter, processing performed by the client terminal 11 when the client terminal 11 functioning as a routing point receives three types of packets from the first packet to the third packet from the processing device 12 will be described.

  First, the case where the first packet whose destination IP address is (192.168.2.22) is received (sequence number 9, packet 01) will be described. After receiving the first packet, the client terminal 11 compares the destination IP address with the address filter information shown in FIG. And the routing point which can transmit a packet with respect to the destination described in the 1st packet is detected.

  As shown in FIG. 7, the destination IP address of the first packet is included in the address filter information associated with the identification information of the client terminal 21. In this case, the client terminal 11 transmits the first packet to the client terminal 21 via a routing session established between itself and the client terminal 21.

  Similarly to the client terminal 11, the client terminal 21 that has received the first packet compares the destination IP address with the address filter information. Then, it detects that itself is described as a routing point capable of transmitting the packet to the destination described in the first packet. In this case, the first packet is transmitted to the destination processing device 22.

  Next, a case where the client terminal 11 receives the second packet whose destination IP address is (192.168.3.32) (sequence number 10, packet 02) will be described. According to the address filter information of FIG. 7, the relay server 3 is designated as a routing point capable of transmitting a packet to the destination described in the second packet. Accordingly, the client terminal 11 transmits the second packet to the relay server 3 via a routing session established between itself and the relay server 3. Then, the relay server 3 detects that it is described as a routing point capable of transmitting the packet to the destination described in the second packet, and transmits the second packet to the processing device 32 of the destination. To do.

  Next, the case where the client terminal 11 receives the third packet whose destination IP address is (192.168.5.51) (sequence number 11, packet 03) will be described. As a result of comparing the destination IP address and the address filter information, the client terminal 11 detects that a routing point capable of transmitting a packet to the destination is not described. In this case, the client terminal 11 does not transmit the received third packet anywhere.

  As described above, in the present embodiment, the routing target data is flowed in the routing session of the application layer. Therefore, the routing described above is different from normal IP routing.

  By performing routing in the application layer in this manner, remote LANs can communicate with each other using private IP addresses without being aware of the WAN. In addition, as described above, the address filter information storage unit 55 can display the names of counterparts that can be specified as packet transmission destinations. Therefore, the user can easily recognize to which device the packet can be transmitted using the VPN.

  Next, a case where the address filter information associated with the relay server 3 is changed after the VPN is started will be described with reference to FIGS. FIG. 13 is a sequence diagram showing communication processing when the address filter information is changed after the VPN is started. FIG. 14 is a diagram illustrating the storage contents of the address filter information storage unit after the address filter information associated with the relay server 3 is updated.

  The user can change the address filter information associated with the relay server 3 by operating the client terminal 31 or the like connected to the relay server 3. In the following, communication processing when the partner to which the relay server 3 can be specified as the packet transmission destination is changed from “all devices connected to the LAN 30” to “processing device 33” as shown in FIG. explain.

  When the address filter information associated with itself is changed, the relay server 3 notifies the client terminal 11 to that effect (sequence number 12, updateFilter). This notification of the change of the address filter information (and notification of a sequence number 13 described later) is performed using a route different from the routing session. In FIG. 13, the address filter information before change associated with the relay server 3 is indicated by “addr03”, and the address filter information after change associated with the relay server 3 is indicated by “addr04”. Then, the client terminal 11 that has received the notification of the change of the address filter information updates the address filter information associated with the relay server 3 to the changed one.

  The relay server 3 also notifies the client terminal 21 that the address filter information associated with itself has been changed (sequence number 13, updateFilter). Similarly to the client terminal 11, the client terminal 21 updates the address filter information associated with the relay server 3 to the changed one. The control for updating the address filter information by the client terminal 11 and the client terminal 21 is performed without stopping the VPN.

  In this state, a case where the client terminal 11 receives the fourth packet whose destination IP address is (192.168.3.33) from the processing device 12 (sequence number 14, packet 04) will be described. Note that this routing control is also performed without stopping the VPN. The destination described in the fourth packet is the processing device 33, and the relay server 3 is designated as a routing point capable of transmitting the packet to the processing device 33. Accordingly, the fourth packet is transmitted from the client terminal 11 to the relay server 3 in the same manner as the routing described above. Then, the relay server 3 detects that it is described as a routing point capable of transmitting the packet to the destination described in the fourth packet, and transmits the fourth packet to the processing device 33 of the destination. To do.

  Next, a case where the client terminal 11 receives the fifth packet whose destination IP address is (192.168.3.32) from the processing device 12 (sequence number 15, packet 05) will be described. In this case, as a result of comparing the destination IP address and the address filter information, the client terminal 11 detects that a routing point capable of transmitting a packet to the destination is not described. In this case, the client terminal 11 does not transmit the received third packet anywhere.

  By notifying and updating the address filter information as described above, it is possible to change the address filter information and perform routing based on the changed address filter information without stopping the VPN.

  Next, a process for terminating the VPN will be described with reference to FIG. FIG. 15 is a sequence diagram showing communication processing for ending a VPN group. The user can start the process of terminating the VPN by operating the client terminals 11 and 21 and the like. In this description, it is assumed that the user operates the client terminal 11 to start processing for terminating the VPN.

  When the client terminal 11 receives the instruction to end the VPN, the client terminal 11 transmits the fact to the client terminal 21 and the relay server 3 together with the VPN group identification information (sequence numbers 16, 17, stopVpn). Note that the client terminal 21 and the relay server 3 can know which VPN group the VPN is to be terminated by, based on the VPN group identification information received from the client terminal 11.

  The client terminal 11 transmits a routing session end command to the client terminal 21 after receiving a signal indicating that the VPN end has been accepted from the client terminal 21 and the relay server 3 (sequence number 18, closeVpnSsn). In addition, the client terminal 11 also transmits a routing session end command to the relay server 3 (sequence number 20, closeVpnSsn).

  This routing session end command is also transmitted from the client terminal 21 to the relay server 3 (sequence number 19, closeVpnSsn). As described above, the routing sessions established between the client terminal 11 and the client terminal 21, between the client terminal 11 and the relay server 3, and between the client terminal 21 and the relay server 3 can be terminated. And VPN by a VPN group is complete | finished.

  As described above, the relay server 3 of this embodiment includes the relay group information storage unit 51, the relay server information storage unit 52, the VPN group information storage unit 54, the address filter information storage unit 55, and the communication control. Unit 63. The relay group information storage unit 51 stores information on relay groups including other relay servers (relay servers 1, 2, 4) that can be connected to each other (the relay server 3). The relay server information storage unit 52 stores relay server information including start information of relay servers belonging to the relay group and start information and registration information of client terminals connected to the relay servers belonging to the relay group. The VPN group information storage unit 54 relates to a VPN group that performs communication by VPN via a communication device set as a routing point among communication devices that constitute the relay communication system 100, and identification information of the routing device that constitutes the VPN group And routing session information 543 including information on routing devices connected to each other. The address filter information storage unit 55 stores address filter information indicating a partner that can be specified by the routing device as a packet transmission destination in association with the identification information of the routing device. The communication control unit 63 performs control to notify the update contents when the address filter information associated with its own identification information is updated after starting VPN in the VPN group.

  Thereby, since the relay server 3 can construct | assemble a VPN with the routing apparatus selected from the other communication apparatus which comprises the relay communication system 100, it can share a file etc. only to a required communication apparatus. Further, after starting VPN in the VPN group, the relay server 3 can notify other routing devices and the like that the address filter information associated with the relay server 3 has been updated. Therefore, it is possible to cause another routing device to take an appropriate action according to the change of the address filter information.

  In the relay server 3 of the present embodiment, when the communication control unit 63 receives a notification that the address filter information has been updated after starting VPN in the VPN group, the address filter information is based on the updated content. A control for updating the storage contents of the storage unit 55, a control for referring to a partner that can be designated as a transmission destination by the routing device based on the updated address filter information, and performing a routing based on the contents. Do it without stopping.

  As a result, the number of destinations that can be specified by the routing device as the packet transmission destination can be increased or decreased while maintaining the VPN.

  In addition, when the destination of the received packet is specified in the address filter information associated with its own identification information, the relay server 3 of the present embodiment transmits the packet to the destination. When the destination of the received packet is specified in the address filter information associated with the identification information of the routing device other than itself, the relay server 3 establishes a routing session established between itself and the routing device. The packet is transmitted to the routing device via The relay server 3 does not transmit the packet when the destination of the received packet is not specified in the address filter information associated with the identification information of the routing device.

  Thereby, the relay server 3 can perform routing appropriately based on the address filter information.

  The preferred embodiment of the present invention has been described above, but the above configuration can be modified as follows, for example.

  The format for storing the relay group information, relay server information, client terminal information, VPN group information, address filter information, etc. is not limited to the XML format, and each information can be stored in an appropriate format.

  Instead of the configuration of the above-described embodiment, an external server used for communication between each relay server may be installed on the Internet, and a communication may be performed by exhibiting a function as a SIP (Session Initiation Protocol) server. .

1, 2, 3, 4 Relay server 11, 21, 31, 41 Client terminal 10, 20, 30, 40 LAN
50 storage unit 60 control unit 63 communication control unit 100 relay communication system

Claims (4)

A relay group information storage unit that stores information of a relay group including other relay servers that can be connected to each other;
A relay server information storage unit for storing relay server information including start information of the relay server belonging to the relay group and start information and registration information of a client terminal connected to the relay server belonging to the relay group;
The relay server configured as a routing point among the relay server and the client terminal constituting the relay communication system based on the relay group information and the relay server information, and the routing device that is the client terminal , and the routing device A VPN group information storage unit that stores identification information of the routing devices that constitute the VPN group and connection information that indicates the routing devices that are connected to each other, with respect to a VPN group that communicates via a virtual private network via the devices;
An address filter information storage unit that stores address filter information indicating a partner that can be designated by the routing device as a packet transmission destination in association with identification information of the routing device;
A communication control unit that controls to notify the update contents when the address filter information associated with its own identification information is updated after starting a virtual private network in the VPN group;
A relay server comprising:
The relay server according to claim 1,
When the communication control unit receives a notification that the address filter information has been updated after starting a virtual private network in the VPN group,
Control to update the storage content of the address filter information storage unit based on the update content;
Based on the updated address filter information, the routing device refers to a partner that can be specified as a transmission destination, and performs routing based on the content,
A relay server characterized in that it performs without stopping the virtual private network. The relay server according to claim 1 or 2,
The communication control unit
When the destination of the received packet is specified in the address filter information associated with its own identification information, the packet is transmitted to the destination,
When the destination of the received packet is specified in the address filter information associated with the identification information of the routing device other than itself, via a routing session established between itself and the routing device Send the packet to the routing device,
A relay server, wherein a packet is not transmitted when a destination of a received packet is not designated in the address filter information associated with identification information of the routing device. Multiple relay servers,
A client terminal connectable to each other via the relay server;
With
The relay server is
A relay group information storage unit that stores information of a relay group including other relay servers that can be mutually connected to the relay server;
A relay server information storage unit for storing relay server information including start information of the relay server belonging to the relay group, start information and registration information of the client terminal;
Identification information of the routing device constituting the VPN group with respect to the VPN group configured by the routing device set as a routing point among the relay server and the client terminal and performing communication through the virtual private network via the routing device A VPN group information storage unit for storing connection information indicating the routing devices connected to each other;
An address filter information storage unit that stores address filter information indicating a partner that can be designated by the routing device as a packet transmission destination in association with identification information of the routing device;
A communication control unit that controls to notify the update contents when the address filter information associated with its own identification information is updated after starting a virtual private network in the VPN group;
A relay communication system comprising:

Images