JP6096464B2 - Proxy device and relay device - Google Patents

Description

  The present invention relates to a proxy device, and more particularly, to a lower-level relay device having a function of a proxy device when a plurality of relay devices are aggregated in a higher-order giant relay device.

  The global IP address of IPv4 is in a depleted state, and it is common for a plurality of terminals and devices to share one global IP address that the relay device has. As a method of sharing a single IP address not only with a global IP address but also with a plurality of devices and terminals, NAT (Network Address Translation) or NAPT (Network Address Port Translation) (hereinafter collectively referred to as “NAPT”). Is used). When the relay device executes NAPT, when a packet from the LAN (Local Area Network) side to the WAN (Wide Area Network) side is received, how the packet from which address on the LAN side is received is how the WAN A session management table that records whether the packet is sent to the network side is stored. When a packet is received from the WAN side, it is determined which address on the LAN (Local Area Network) side to relay based on the packet information. In general 5-tuple as NAPT, the LAN side uses the five information of “source IP address”, “source port number”, “destination IP address”, “destination port number”, and “protocol” of the packet received from the WAN side. To which address to relay.

  On the other hand, when a plurality of relay devices connected to individual user terminals and accessing the Internet by themselves are connected to the closed network, the higher-level relay device serving as an Internet gateway between the Internet aggregates communication. In some cases, communication with a server or the like on the Internet is performed using the global IP address of the higher-level relay device. When the closed network is an environment constructed with IPv6, automatic address translation between IPv4 and IPv6 is performed by SAM (Stateless Address Mapping) instead of translation referring to an external database. In other words, a plurality of relay devices connected under the higher level relay device (Provider-Stateless Address Mapping device: P-SAM device) that performs this conversion share the global IP address of this higher level relay device. The relay apparatus performs communication with the Internet using the same IP address. For this reason, when each relay device communicates with the same server on the Internet, which relay device originates the communication, and which relay device sends a response to the communication. Only the port number is used as a material for the higher-order relay device to determine whether or not the data should be transferred.

Here, because of the above-described IPv4 exhaustion state, it is not possible to prepare a sufficient P-SAM IPv4 address for the number of Internet gateway devices (upper relay devices) to be connected to the Internet. The number will be limited. An example in which this situation is simplified is shown in FIG. A number of relay devices close to the limit are connected to one Internet gateway device, and they share one global IP address (GWIP “100.1.1.1” in the figure). Specifically, sharing a single Internet gateway device (P-SAM 11) with 1024 relay devices is a practical limit.
In this case, the port number frame assigned to one relay apparatus (HGW) is obtained by dividing 65535 port numbers by 1024. Furthermore, since the well-known port cannot actually be used, only about 60 ports can be used per relay device (10001 to 10060 in the example). Assuming 60 ports per unit, one relay device (HGW1: 192.168.1.2) that receives a request from the terminal (PC1, 2) is connected to one server (200.1.1.1). If a TCP connection for 61 sessions or more is attempted, the 61st session and thereafter are discarded.

  In recent years, when the opportunity to provide rich contents on the Internet has increased, applications on the terminal have multiple sessions set up on one server for the purpose of downloading a large amount of information from the Internet at the same time. Implementations that communicate are increasing. Therefore, in a configuration in which a large number of relay devices are connected under the Internet gateway, even if the relay device tries to access a server on the Internet (that is, a plurality of terminals connected to the relay device), the port number of the Internet gateway device There is a possibility that a part of the session requested in parallel cannot be established due to a lack of vacancy, a part of content cannot be acquired, and information becomes insufficient.

  On the other hand, Patent Document 1 presents a technique for sharing the same port number among a plurality of applications.

  Patent Document 2 describes a technique for saving session resources by allowing terminals to transmit requests to the same server as a single session. In addition, when a proxy server is interposed between the terminal and the server, the terminal transmits a request to a plurality of servers as a session to the proxy server, and the proxy server distributes the destination server to perform transmission. A technique for saving session resources is described.

JP 2010-154518 A JP 2002-373149 A

  However, the technique described in Patent Document 1 is not a relay apparatus, but a terminal or server connected to the relay apparatus must perform processing that is out of the original implementation, and is not a generalizable technique.

  In addition, the technique described in Patent Document 2 also has to perform processing for collecting a plurality of requests into the same session on the terminal side, and has to deal with an enormous number of terminals more than the relay device. It was not easy to use for practical use.

  SUMMARY OF THE INVENTION Accordingly, an object of the present invention is to suppress session establishment failure due to port number frame restriction in an Internet gateway device by a method that can be easily handled on the terminal side.

The present invention relates to a proxy device that relays communication between a terminal and an Internet gateway device.
The number of sessions with one server on the Internet via the Internet gateway is limited to a certain number or less, and limited to the number of sessions with the terminal side destined for the one server,
When a communication request from the terminal side to the one server is newly received, a session that is not communicating at that time among the sessions with the one server is used to communicate with the one server. The above-mentioned problem has been solved by performing communication.

  In other words, the server-side session and the terminal-side session are not handled in a one-to-one correspondence, but are handled separately. In response to a request from the terminal, a free session to the server is appropriately linked, and the response ends. Once this is done, the association can be canceled. Here, the reason why the proxy device is not a simple relay device is that it is necessary to terminate the session once in this device in order to handle the session separately on the terminal side and the server side of the device. The function as the HTTP server and the HTTP client as the proxy device terminates the request message and the response message once, recreates the message, and relays the communication between the terminal and the server. You can communicate using different sessions.

  For example, in the HTTP 1.1 communication, a TCP session is kept open even when communication is not being performed by the Keep-Alive function. However, even if this session is maintained for a long time, there is a time zone in which communication is not actually performed. Therefore, a session that actually requires transmission / reception temporarily uses the session frame with the server side, and when communication is completed, the session on the server side can be interrupted while the session on the terminal side remains, so that the server side can be interrupted. You can make the most of the session frame with the side. As a result, since it is possible to communicate with the server with fewer session frames than before, the session frame (ie, the number of assigned port numbers) per unit is limited from the Internet gateway device, which is a higher-level relay device. Even in such a situation, it is possible to suppress the occurrence of a session that is discarded due to insufficient quota.

  From the viewpoint of HTTP, it is not necessary to distinguish the information of the TCP layer that is a transport part. Therefore, the present invention is established by utilizing that there is no particular problem in HTTP processing even if another HTTP communication is performed on a TCP session in which HTTP communication is not performed. In addition, in the case where a session exists on each of the server side and the terminal side, not limited to HTTP, and the session is continuously extended, the effect of the present invention can be obtained by similarly switching the session as necessary. Can be obtained.

  In the proxy device according to the present invention, the relay device itself that connects the LAN that holds the terminal to the closed network such as the network in the provider may have the capability, or is provided in the closed network separately from the relay device. It may be a thing. When the terminal implements the function of the proxy device as a local proxy software on a personal terminal such as a personal computer, it is used internally when the terminal has an IPv6 address and communicates with IPv6. It will be implemented as an internal NAPT that converts to a possible port (for example, 10001 to 10060).

  Here, the number of sessions (that is, the number of port numbers) that the proxy device or the relay device can establish for the same destination IP address is limited by the number of proxy devices or relay devices held by the Internet gateway device. Each proxy device (relay device) establishes a session with one server within the limited number of ranges. The number of sessions on the terminal side destined for the one server is the same as or more than the number of sessions on the server side, and a larger number of terminal-side sessions share a smaller number of server-side sessions. Become. However, if the number of terminal-side sessions decreases, it is not necessary to maintain more server-side sessions, so the server-side sessions may be arranged as appropriate.

  According to the present invention, when a large number of terminals and relay devices share the IP address of the Internet gateway, a limited number of port numbers assigned to each terminal or relay device can be operated more efficiently than before. It is possible to suppress the occurrence frequency of a failure that prevents a session from being established for a server on the Internet.

  In addition, since the proxy device is responsible for most of the work, there is no need to change the settings on the terminal side, or even if it is necessary, only the work of specifying the proxy device is required. Small and easy to install.

  In addition to serving as a relay device provided between the LAN and the WAN, the proxy device can be operated as a proxy device that relays access from a terminal or a relay device as a proxy device provided independently on a closed network. In this case, a user who tends to have a large number of sessions can rewrite the terminal settings as appropriate and use the proxy device to introduce it to the necessary parts with minimal work. it can.

Conceptual diagram of basic operation of proxy device according to the present invention Conceptual diagram showing an example of operation of the present invention Functional block diagram of the proxy device according to the present invention (A) (b) Example of a response management table used in the proxy device of FIG. FIG. 3 is an example of a session management table used in the proxy device of FIG. HTTP request message transmission / reception flow Flow of session termination part selection part in FIG. Flow of update part of session management table in FIG. Transmission / reception flow of HTTP response message Session deletion means execution flow from LAN side Session deletion means execution flow from WAN side Conceptual diagram of problems when using a conventional Internet gateway

  Hereinafter, embodiments of the proxy device according to the present invention will be described in detail. First, the concept of basic operation of the proxy device according to the present invention will be described with reference to FIG. The proxy device 13 according to this embodiment is provided between the server 11 and the terminal 14 and is omitted in the drawing, but an Internet gateway 12 exists between the proxy device 13 and the server 11. The side connected to the terminal 14 is the LAN side, and the side connected to the server 11 is the WAN side. The pipes connected to the left and right of the proxy device 13 represent sessions that connect the two.

  First, a request message issued from the terminal 14 is received from the session on the LAN side (FIG. 1A). The proxy device 13 associates the LAN side session that has received the request message with the WAN side session in the non-communication state, and transmits the request message from the WAN side session (FIG. 1B). Upon receiving the response message from the WAN side session, the proxy device 13 transmits it from the LAN side session attached to the WAN side session (FIG. 1C). After transmitting the response message, the proxy device 13 releases the binding between the LAN side session and the WAN side session (FIG. 1D). When the request message is received from the terminal 14 through another LAN side session, the request message and the response message are transmitted / received using the previously used WAN side session.

  Next, an example embodiment of the proxy device according to the present invention will be described. An example of such an embodiment is shown in FIG. The proxy device 13 (No. 1 to 1024) is a gateway between the local area network (abbreviated as “LAN” in the figure) 3 holding the terminal 14 (No. 1, 2,...) 3 and the closed network 2. An internet gateway (abbreviated as “P-SAM” in the figure) 12 is provided between the closed network 2 and the Internet 1. The terminal 14 accesses the server 11 on the Internet 1 through the proxy device 13 and the Internet gateway 12.

  The terminal 14 is a personal computer, a smart phone, or another terminal having a network function, and can establish a number of sessions with a browser or the like.

  The proxy device 13 is a device having a function as a proxy server, and has at least one physical network interface such as an Ethernet (registered trademark) terminal. An independent proxy device that operates by specifying its address on the network may be used, or a relay device that serves as a gateway having the local area network 3 may be a dual-purpose device that also operates as a proxy server. In the latter case, specifically, for example, a home gateway functioning as a router is mentioned, and communication is possible both on the LAN (local area network 3) side and on the WAN side (network side leading to the Internet gateway 12). Each has one or more physical network interfaces.

  The proxy may be a general proxy that terminates a session once, or a transparent proxy that does not terminate a session. In the case of a general proxy, the request message from the terminal 14 is set to be transmitted to the proxy device 13 once, and the session is once terminated at the proxy device 13. The proxy device 13 analyzes the request message, creates a request message for the server 11 with which the terminal 14 is to communicate, and transmits the request message to the server 11. Further, the session for transmitting the response message from the server 11 to the request message is once terminated, and the request message to the terminal 14 is recreated and transmitted. The terminal-side session and the server-side session of the proxy device 13 are independent and can be handled separately, and can be assigned to the server-side session as necessary. In the case of this general proxy, the proxy device 13 may be a relay device between the LAN and the WAN, or may be a device different from the relay device and provided in the WAN up to the Internet gateway 12. It may be a device.

  On the other hand, in the case of a transparent proxy, the terminal 14 does not recognize the proxy device 13 as a destination, but operates by specifying the server 11 directly as a destination. In this case, the proxy device 13 is provided as a relay device between the LAN and the WAN that relays all communications sent from the terminal 14 to the Internet. For the request message sent from the terminal 14 to the server 11, the proxy device 13 forcibly terminates the session and constructs a separate session for the server 11, thereby forcing a terminal-side session and a server-side session. Can be allocated to server-side sessions as needed. However, in maintaining the session on the terminal 14 side, it is necessary to operate so that a session is directly established with the server 11 with respect to the terminal 14.

  The Internet gateway 12 is a higher-level relay device having a NAT (NAPT) function, and is a gateway that relays all communications from the closed network 2 to the Internet 1. Therefore, all the relay devices such as the HGW that can be connected to the subordinate of the proxy device 13 and the like, and all the communication from the terminal 14 connected to the Internet to the Internet are concentrated here.

  The server 11 provides content in response to a request on the Internet 1 and includes, for example, a WEB server.

  1024 proxy devices 13 connected to the Internet gateway 12 are installed. 1 to 1024. Proxy device 13No. No. 1 of the terminal 14 constituting the LAN 3 of No. 1 The proxy device 13 according to the present invention that has received the requests from 1 and 2... Starts from 10001, and when trying to construct a total of more than 60 sessions for the server 11, the 61st and subsequent sessions are existing. Communication is performed by appropriately selecting a session that is not performing communication from 1 to 60 sessions. In FIG.2 (b), the 61st session is transmitted using the 2nd session between servers, and the 62nd session is transmitted using the 60th session between servers. . FIG. 2C shows whether each session designates the proxy device 13, the Internet gateway (P-SAM) 12, and the server 11 at this time. The IP of the proxy device 13 for the closed network 2 is 192.168.1.2, and from there through the Internet gateway 12, the port numbers 10001 to 10060 are set as the source port numbers to the server 11, and 100.1.1. 1 is the source IP address, the IP address of the server 11 is the destination IP address, and the default port number of HTTP is the destination port number. The Internet gateway 12 that directly establishes a session with the server 11 relays the session from the proxy device 13, uses the IP address 100.1.1.1 in its own Internet 1 as the source IP address, and numbers 10001 to 10060. A session is established for the server 11. That is, the proxy device 13 has 61 or more sessions with the server 11 with the terminal 14, but the number of sessions assigned to the proxy device 13 between the Internet gateway 12 and the server 11 is 60. Continue with each session. Further, even if a session is established from the terminal 14 to the server 11, the proxy device 13 searches for a session that is not used at that time from the port numbers 10001 to 10060, and if found, communicates using the session. Therefore, the Internet gateway 12 accepts and processes only sessions within a pre-assigned frame. That is, in the present invention, only the proxy device 13 needs to operate a function specific to the present invention, and the terminal 14, the Internet gateway 12, and the server 11 may operate in the conventional manner.

  FIG. 3 shows a functional block diagram between the proxy device 13 and the terminals 14 (No. 1, No. 2... 14a, 14b...) And the server 11 (11a, 11b). Explain the function. Here, an example is shown in which the proxy device 13 that is also a relay device having the LAN 3 that communicates with the terminal 14 operates as a general proxy server that is not a transparent type.

  As a basic function as a proxy, the proxy device 13 extracts an HTTP message from the received TCP stream, adds an HTTP server unit 62 that transmits a response message, and an appropriate IP header to the extracted HTTP message. And an HTTP client unit 67 for receiving the response. The roles played by these functional units are the same as the software processing performed by a normal proxy server. That is, the HTTP server unit 62 obtains the server name that is the true destination of the request message from the extracted HTTP message. When this server name is described not by an IPv4 or IPv6 address but by a domain name, the HTTP client unit 67 requests the DNS server to resolve the name, obtains the address of the server 11, and then sends the server name. 11 addresses are assigned to the destination of the IP header and transmitted. If an IPv4 or IPv6 address is specified in the HTTP message from the beginning, that address is assigned as it is to the destination of the IP header, but in such cases there are few. Note that the contents of the HTTP message as well as the header may be rewritten as necessary. By looking at the destination of the IP header thus designated, the relay management unit 63 determines the server 11 to which the session is established. In response to a request message from the server 11, the HTTP client unit 67 receives the request message and once terminates the session, and the HTTP server unit 62 creates a message addressed to the terminal 14 that was the original request source. Send.

  The terminal 14 includes an HTTP client unit 52 that transmits an HTTP request message, and the server 11 includes an HTTP server unit 72 that returns a response to the HTTP request message.

  Further, the terminal 14, the proxy device 13, and the server 11 have session termination units as many as the number of sessions established between them. The terminal-side session termination units 51a, b... Of the terminal 14 establish a session with the LAN-side session termination units 61a, b... Of the proxy device 13, and the WAN-side session termination units 66 of the proxy device 13 Are established with the server-side session termination units 71a, b. These session termination units correspond to TCP sockets in a specific example, and have their own IP address and port number, and perform transmission and reception at the network layer.

  Further, as a feature of the present invention, the proxy device 13 has a response management table 64 and a session management table 65. The contents of these tables are rewritten and referred to, and an instruction for transmission / reception to a designated destination is given. A relay management unit 63 is provided. In effect, the relay management unit 63 designates which session is allocated and used.

  The response management table 64 sends the response message received from any one of the WAN side session termination units 66 (that is, the server side session termination unit 71) to which LAN side session termination unit 61 (that is, the terminal side session termination unit 51). It is a table that manages whether to transmit. In the configuration of FIG. 3, an example at a certain point in the response management table 64 is shown in FIG. 4A, and an example at another point in time when the LAN side is rewritten by a request from another terminal 14 is shown in FIG. Show. The primary key of this table is session information including the IP address and port number of the server and client on the WAN side, and the LAN side session can be rewritten as necessary.

Each item of the response management table 64 has the following meaning.
The WAN-side server IP address is an IP address to which the server-side session termination unit 71 is bound (that is, the IP address of the server 11).
The WAN-side server port number is the port number to which the server-side session termination unit 71 is bound (in the case of HTTP, the number is usually 80).
The WAN side client IP address is the IP address to which the WAN side session termination unit 66 is bound (that is, the WAN side IP address of the proxy device 13).
The WAN-side client port number is a port number to which the WAN-side session termination unit 66 is bound, and this number is indefinite.
However, the number of records in which all three items except the client port number match is at most equal to or less than the number of ports assigned to the proxy device 13 by the Internet gateway 12. Of course, for a record destined for the server 11 having a different IP address (for example, the server 11b of 150.1.1.1), there may exist as many as the number of ports allocated separately. However, since the Internet gateway 12 is inserted between the sessions viewed from the server 11 side, the destination IP address is that of the Internet gateway 12, and the port number is converted by the NAPT function of the Internet gateway 12.

On the other hand, the LAN side server IP address is the IP address to which the LAN side session termination unit 61 is bound (that is, the LAN side IP address of the proxy device 13).
The LAN-side server port number is a port number to which the LAN-side session termination unit 61 is bound (set as a proxy standby port, typically 8080).
The LAN side client IP address is the IP address to which the terminal side session termination unit 51 is bound (that is, the IP address of the terminal 14).
The LAN-side client port number is a port number to which the terminal-side session termination unit 51 is bound, and this port number is not particularly limited in number from 1 to 65535.

  The relay management unit 63 creates a new entry in the response management table 64 along with the execution of the WAN side session establishment means for constructing the WAN side HTTP session (WAN side session termination unit 66-server side session termination unit 71). The entry generation means to execute is executed. In the execution, information on the WAN side server is acquired from a request HTTP header which is a header part of the HTTP request message received by the LAN side session termination unit 61. At this time, the primary key of the entry registered in the response management table 64 is determined. On the other hand, as information on the LAN side that is not the primary key of the entry, information on the HTTP session on the LAN side corresponding to the HTTP session on the WAN side is registered. However, the information on the LAN side is later cleared by entry blanking means described later.

  Further, the relay management unit 63 transfers the HTTP request message received by the LAN side session termination unit 61 from the WAN side session termination unit 66 to the server 11 specified in the HTTP message whose payload is rewritten by the HTTP client unit 67. A request message relay means to be transmitted is executed. At the time of transmission, when the relay management unit 63 does not establish a new WAN-side HTTP session and transmits using an existing session in a non-communication state, the response management table 64 corresponding to the session. The entry entry means for entering the LAN side information into the entry in which the WAN side information is already created is executed. In the execution, information on the LAN side client is acquired from the source IP address and source port number of the packet received by the LAN side session termination unit 61.

  Furthermore, the HTTP client unit 67 receives a response message addressed to the proxy device 13 from the server 11 to the request message sent to the server 11 from the relay management unit 63, analyzes the HTTP header, and responds to the request sent by itself. Check if it exists. Further, the contents of the packet are analyzed as necessary. At this time, the relay management unit 63 also receives information on the LAN-side session termination unit 61 that is the destination of the response message that has been analyzed and searched up to the TCP level immediately before. The HTTP server unit 62 extracts the content of the response message, creates a response message that creates a response message attached to the header with the terminal 14 that is the transmission source of the original request message as a destination, and transmits the response message from the relay management unit 63. Response message relay means for transmitting from the designated LAN side session termination unit 61 to the terminal side session termination unit 51 is executed.

  Although not shown, when executing the above series of response message relay means, the HTTP client unit 67 analyzes the HTTP header, and changes the packet if necessary. Thereafter, an HTTP packet is sent to the relay management unit 63. Upon receiving this, the relay management unit 63 uses the HTTP packet as a payload, applies a header below TCP, and thereafter transmits the packet from the LAN side session termination unit 61 in the same manner as described above.

  Further, in the exchange of these series of request and response messages, the HTTP client unit 67 is responsible for the HTTP session, and the HTTP server unit 62 is responsible for the LAN side. The relay management unit 63 controls the TCP session, and terminates at the WAN side session termination unit 66 and the LAN side session termination unit 61. In the present invention, the term “session” instead of “HTTP session” basically refers to a TCP session.

  After the transmission, the relay management unit 63 executes entry blanking means for deleting only information on the LAN side of the entry in the response management table 64. Therefore, the four items of the LAN side server IP address, the LAN side server port number, the LAN side client IP address, and the LAN side client port number may be blank.

  Furthermore, the relay management unit 63 executes an entry deletion unit that deletes the entry corresponding to the session from the response management table 64 when the HTTP session on the WAN side is disconnected by the session arrangement unit described later.

  Next, the session management table 65 will be described. In general NAPT devices and general HTTP proxies, both the WAN side and the LAN side have a transmission source so that addresses and port numbers can be converted in a one-to-one correspondence between the WAN side and the LAN side. In addition, a session management table in which the destination IP address and port number are fixed values is used. In this case, if the LAN side HTTP session is deleted, the corresponding WAN side HTTP session may be simply deleted, and if the WAN side HTTP session is deleted, the corresponding LAN side HTTP session may be simply deleted. However, in the case of the present invention, since the LAN side HTTP session and the WAN side HTTP session do not correspond one-to-one, it is not possible to perform simple management like the existing HTTP-Proxy. For this reason, the session management table 65 used in the proxy device of the present invention includes only the IP address and server port number of the server whose destination is the information on the WAN side, and the source port number on the WAN side of the proxy device is not registered. This is because which WAN side port number is used in the present invention is dynamic and is the information temporarily recorded in the response management table 64. An example of the session management table 65 is shown in FIG.

  Such a session management table 65 is referred to by the relay management unit 63 as a table for managing which LAN-side session termination unit 61 (which leads to the terminal-side session termination unit 51) is the destination server 11. That is, it is possible to narrow down which LAN-side session termination unit 61 can be connected to which WAN-side session termination unit 66 (which leads to the server-side session termination unit 71) by the server that is the destination. Further, when the WAN session (WAN session termination unit 66-server session termination unit 71) or the LAN side HTTP session (terminal session termination unit 51-LAN session termination unit 61) is disconnected, Used to manage the number of remaining sessions on the side.

  The relay management unit 63 executes entry addition means for adding an entry to the session management table 65 when a “first” HTTP request message is received from the new terminal-side session termination unit 51 to the LAN-side session termination unit 61. . Basically, the entry deletion means for the relay management unit 63 to delete the entry from the session management table 65 at the timing when the LAN side HTTP session (LAN side session termination unit 61-terminal side session termination unit 51) is deleted. Execute. Further, at the timing when the WAN-side HTTP session is deleted, if all the entries corresponding to the port number of the server 11 are deleted from the response management table 64 with the server 11 as the destination, the corresponding server is deleted from the session management table 65. It is also possible to execute a general entry deletion unit that deletes all entries having a corresponding port number with 11 as a destination.

  Further, the relay management unit 63 searches for whether there is a disconnectable session for each of the LAN side and WAN side sessions, and executes session organizing means for appropriately deleting the disconnectable sessions. As the session organizing means, there is a deleting means in the following cases.

  When the LAN-side HTTP session is deleted from the terminal-side session termination unit 51, the termination-side session deletion unit for deleting the LAN-side session is executed, and the terminal-side session termination unit 51 is the communication destination. An entry corresponding to the server 11 (server-side session termination unit 71) is retrieved from the response management table 64, and is used for communication from the WAN-side HTTP session that has established a session with the server-side session termination unit 71. A single session deletion means for appropriately disconnecting no HTTP session is executed. However, the number of WAN side HTTP sessions is always adjusted to be equal to or less than the number of LAN side HTTP sessions. Even if the LAN side HTTP session is deleted, if there are fewer WAN side HTTP sessions and all the WAN side HTTP sessions are used, the WAN side HTTP session is not deleted.

  Conversely, when the WAN-side HTTP session is deleted from the server-side session termination unit 71, the request from the server 11 side must be followed, so the forced session deletion means for deleting the session regardless of the situation on the LAN side. Execute. However, subsequently, if at least one WAN side session termination unit 66 that has established an HTTP session with the server side session termination unit 71 remains, the LAN side HTTP session is not deleted. Comprehensive session deletion that deletes all the LAN-side HTTP sessions connected to the server-side session termination unit 71 at the timing when the WAN-side session termination unit 66 that establishes an HTTP session with the server-side session termination unit 71 disappears Execute means. At this time, the relay management unit 63 may execute general entry deletion means for deleting all entries corresponding to the server-side session termination unit 71 remaining in the session management table 65. Leaving the entry has the advantage that the cache can be used and there is no need to create and delete the entry every time the same communication is received, but the number of entries is too large And there is a demerit that the amount of memory consumption increases accordingly. If the proxy device 13 is not rich in memory such as HGW, deleting the entries here can suppress the memory consumption and stabilize the operation.

An example of an actual processing flow of the proxy device 13 having such a configuration will be described.
A flow when an HTTP request message is received will be described with reference to an example of FIG.
First (S101), the LAN side session termination units 61a, 61b, etc. (hereinafter collectively referred to as “LAN side session termination unit 61x”), the terminal side session termination units 51a, 51b, etc. of the corresponding terminals (hereinafter, collectively). (The terminal-side session termination unit 51x. The subscript x corresponds to 61 and 51.) A TCP stream transmitted from the terminal is received, and an HTTP request message is extracted (S102). The HTTP server unit 62 analyzes the content of the HTTP request message, determines the destination and the like, and passes the content to the HTTP client unit 67 (S103). In the general proxy device 13, the destination of the received IP packet itself is the proxy device 13 itself. At this stage, the address of the server 11 that is the original destination can be finally determined by reading the HTTP header in the HTTP request message. However, since the read address of the server 11 is almost written in the domain name, it is necessary to resolve the DNS name and acquire the IPv4 or IPv6 address. This name resolution may be performed by a general DNS proxy function (not shown).

The HTTP client unit 67 to which the content of the received request message has been passed creates an HTTP request message addressed to the server 11 in the same manner as the general operation of the proxy, and the request line and host header field of the analyzed HTTP header. Then, the destination IP address and the port number for comprehensively specifying the server side session termination units 71a, 71b, etc. (hereinafter collectively referred to as “server side session termination unit 71y”) of the server 11 are determined ( S104).
Of course, the destination IP address is the global IP address of the server 11 on the Internet 1, and the port number is generally 80 if it is HTTP.

  The relay management unit 63 selects and determines the WAN side session termination unit 66y for transmitting the HTTP request message from the determined IP address out of the determined information (S105). At this time, there is a case where the WAN-side session termination unit 66y already exists and a case where the WAN-side session termination unit 66y does not yet exist, and the operation differs depending on whether the number of sessions has reached the upper limit value or not. Details will be described later. Then, the relay management unit 63 executes entry addition means for updating the information in the session management table 65 (S106). The contents will also be described later. The selected WAN-side session termination unit 66y transmits a TCP stream including an HTTP request message in the payload to the server-side session termination unit 71y of the server 11 (S107). This completes the processing of the request message and waits for reception of a response message (S108).

The selection flow of the session termination unit by the relay management unit 63 performed in S105 will be described with reference to FIG. It should be noted that the address of the server 11 that is the destination is fixed in S104 immediately before this.
First (S131), the relay management unit 63 searches the response management table 64 to determine whether there is a session that is not waiting for an HTTP response among sessions established with respect to the destination server 11 (S132). . That is, here, the IP address of the server side session termination unit 71y is the IP address of the server 11, the WAN side server IP address, which is one of the primary keys, is the destination server, and the LAN side is blank. Search whether there is an entry. If such an empty entry does not exist (S133 → No) and the number of WAN side session termination units 66 for the server 11 is less than the upper limit of the number of port numbers restricted by the Internet gateway 12 ( S134 → No), because there is room for establishing a new session, the WAN side session termination unit 66y (that is, the socket to which the port number is assigned) is created and the session is established with the server side session termination unit 71y of the server 11. WAN side session establishment means is executed (S135). This flow also applies when a session is first established with the server 11. Then, an entry creating means for creating the established session information as a new entry in the response management table 64 is executed (S136). Although the setting on the WAN side made at this time is fixed, the session information with the terminal 14 received at S102, which is registered as the setting on the LAN side, will be cleared later. When the entry creation to the response management table 64 is completed, the process proceeds to the next S106 with the created WAN session termination unit 66y as an argument (S137).

  On the other hand, if there is a corresponding entry in S133, that is, if the WAN side is applicable and the LAN side has an empty entry cleared by an entry deletion means described later (S133 → Yes), the LAN side column of the entry Then, entry entry means for registering information on both end points of the TCP session on the LAN side is executed (S141). If the IP addresses and port numbers of both end points of the LAN side session termination unit 61x and the terminal side session termination unit 51x are known, a TCP session is uniquely determined. Thereby, the LAN side session temporarily associated with the WAN side session which is the primary key is determined. Then, the WAN side session termination unit 66y matching the WAN side client IP address and the WAN side client port number is selected (S142), and the process proceeds to the next S106 using this as an argument (S137). That is, the port number that has been vacant is selected, and the request message relay means for transmitting in the session corresponding to the port number is prepared.

  If there is no entry in which the information on the WAN side matches and the LAN side is cleared (S133 → No), the number of WAN session termination units 66 for the server 11 (for example, the server 11a) has reached the upper limit ( Since the session addressed to the server 11 cannot be established at this time, the process waits until an entry becomes available (S132).

  Next, the update flow of the session management table 65 by the relay management unit 63 performed in S106 will be described with reference to FIG. First (S151), in the session management table 65, there is an entry that matches the IP address and server port number corresponding to the server-side session termination unit 71 of the server 11 that is the destination, and also matches the session information on the LAN side. It is searched whether or not there is (S152). If there is an entry (S153 → Yes), the session to the server is still communicated from before, so the process proceeds to the next S107 as it is, through the WAN side session termination unit 66y passed as an argument in S105. Send a request message. If the entry does not exist (S153 → No), since it is the first communication to the server 11, entry addition means is executed (S154), and through the WAN side session termination unit 66y passed as an argument in S105 Send a request message.

A flow when receiving and relaying a response message from the server 11 in response to the request message transmitted in S107 will be described with reference to FIG. First (S201), the WAN side session termination unit 66y receives a TCP stream from the server side session termination unit 71y of the server 11 and acquires an HTTP response message from the payload (S202). In response to this, the relay management unit 63 searches the response management table 64, searches for an entry with the same WAN side information, and obtains the LAN side information of the entry. Thereby, the session on the LAN side that has transmitted the request message corresponding to the response message just received is specified. As a result, the address of the terminal 14 that is the reply destination of the response message and the client port number can be specified, that is, the terminal-side session termination unit 51x that is a socket used for transmission, and the LAN-side LAN-side session termination unit 61x connected to the terminal side. Is specified (S203). After that, the HTTP client unit 67 that is a basic function of the proxy device 13 analyzes the HTTP response message (S204), and the HTTP server unit 62 that is also the basic function of the proxy device 13 receives the HTTP response message. Create (S205). That is, as a proxy, this is a response message to the previously received request message. This HTTP response message is transmitted from the LAN side session termination unit 61x previously identified in S203 to the terminal side session termination unit 51x of the terminal 14 that is the session destination, with a TCP stream including the HTTP response message in the payload. (S206). Once this is complete, the response to the request is over, so the session with the server 11 is no longer active. Therefore, the entry blanking means for clearing the LAN side portion of the entry used for transmission of the response destination is executed from the response management table 64 (S207). As a result, the association of the session between the LAN side and the WAN side is released, the WAN side session corresponding to the entry becomes a non-communication state, and other LAN side sessions can be used in the processing after S132.

  Although the request and response are made in the above-described steps, the WAN session not only clears only the information on the LAN side in the response management table 64 after the response is completed, but also the WAN session itself when it becomes unnecessary. Is preferably deleted. In some cases, the Internet gateway 12 dynamically changes the number of ports assigned to each proxy device 13, and in this case, one proxy device 13 deletes an unnecessary session, thereby causing another proxy device to be deleted. This is because the number of sessions in which 13 can be used increases. In order to speed up the network processing itself, it is preferable to delete unnecessary sessions on both the WAN side and the LAN side.

  First, a flow when the LAN side HTTP session is disconnected will be described with reference to FIG. When a disconnection trigger of the HTTP session established between the terminal side session termination unit 51x of the terminal 14 and the LAN side session termination unit 61x of the proxy device 13 occurs (S302), the following flow is performed. Here, the disconnection trigger of the session on the LAN side is in accordance with the general rules of RFC. Specifically, a Keep-Alive timeout or a TCP-FIN from the terminal-side session termination unit 51x is received. Cases. At this time, an entry is obtained from the session management table 65 in which the IP address and port number of the session in which the disconnection trigger occurs coincides with the information on the LAN side (S303). With reference to the WAN side information of the entry, the address of the server 11 with which the LAN side session to be disconnected communicated is specified (S304). Basically, it is assumed that the server port number is 80. However, if the server 11 permits use of various numbers as the server port number, the port number corresponding to the entry at this time is also set. In particular, the server-side session termination unit 71y is identified. Then, the number of LAN-side sessions communicating with the server 11 using the same server port number is counted in the session management table 65 and is set as X (S305). Next, in the response management table 64, the number of WAN sessions communicating with the same server 11 is counted and set to Y (S306). That is, the response management table 64 describes all WAN-side sessions regardless of whether they are active or inactive, and the session management table 65 does not take into account the WAN-side port number. Since all the sessions on the LAN side connected to the server port number) are described, the LAN side is counted as X and the WAN side as Y.

  Here, it is determined whether Y is larger than X (S307). That is, if there are more WAN-side sessions than LAN-side (S307 → Yes), the maximum number of WAN-side sessions is sufficient if the number of LAN-side sessions is sufficient, and the extra sessions are deleted. At this time, the response management table 64 is searched for a blank column on the LAN side, that is, a session in a dormant state not in a communication state, and one corresponding entry is deleted from the response management table 64, and Single session deletion means for deleting one corresponding WAN session termination unit 66 is executed (S311). At this time, as long as the corresponding entry and the WAN session termination unit 66 correspond to each other, any entry (WAN session termination unit 66) may be deleted. It is good to delete it according to a certain standard. After deleting one, Y is counted again (S312 → S313 → S306), X and Y are compared again (S307), and if still applicable, the entry and the WAN session termination unit 66 are further set. It is deleted (S311).

  On the other hand, if X is greater than or equal to Y (including the case where the number is the same due to S311) (S307 → No), the entry acquired in S303 is deleted from the session management table 65 (S308). Then, the end session deleting means for deleting the corresponding LAN side session termination unit 61x is executed (S309), and the flow is ended (S310).

Next, a flow when the WAN-side HTTP session is disconnected will be described with reference to FIG.
When an HTTP session disconnection trigger occurs between the server-side session termination unit 71y of the server 11 and the WAN-side session termination unit 66y of the proxy device 13 (S332), the following flow is performed. Here, the session disconnection trigger on the WAN side conforms to the general rules of RFC, and specifically, a Keep-Alive timeout or a TCP-FIN received from the server-side session termination unit 71y is received. Cases. This is because when a disconnection request is made from the server 11 side, the session must be deleted regardless of the circumstances on the Internet gateway 12 side (that is, the proxy device 13 side).
First, from the response management table 64, an entry in which the IP address and port number of the session in which the disconnection trigger has occurred matches the WAN information is deleted (S333), and the corresponding WAN session termination unit 66y is deleted. Forced session deletion means is executed (S334).

  Further, it is searched whether or not there is an entry in the response management table 64 that matches the IP address of the server 11 and the port number of the previously deleted session (S335). That is, it is searched whether there exists a TCP session on the WAN side that is communicating with the same server 11 where the trigger for deletion has occurred and the same server port. If this entry exists (S336 → Yes), there is still another session with the server 11 and there is a possibility that communication will continue. Leave as it is. Even if the LAN side session is left without resuming communication, it is deleted by the single session deletion means due to the timeout of the LAN side session itself as described above. On the other hand, if the entry does not exist (S336 → No), the communication with the server 11 is temporarily lost, so the entry of the session management table 65 that designates the server 11 as the destination IP address. And a general session deletion unit that deletes all the LAN side session termination units 61 connected to the terminal side session termination unit 51 matching the entry (S337). However, as described above, when the memory of the proxy device 13 is abundant, entries may be left, so that the general entry erasure unit does not have to be executed.

  In the flow shown in FIG. 11, only the steps up to S334 are indispensable for actual mounting, and other portions (S337 and the like) can be operated without mounting. In this case, although the WAN session with the server 11 is all disconnected, a state mismatch between the WAN and the LAN occurs that the LAN terminal does not detect it. However, if a request message is received from the LAN side in a state where all the WAN side sessions have been deleted, a new WAN side session is established according to the flow of S105 in FIG. 6 (ie, FIG. 7). There is no danger of communication becoming impossible due to inconsistencies.

  Note that the present invention is not limited to the HTTP protocol, and even with other protocols, it is guaranteed that the order of responses is guaranteed with respect to the order of transmitted requests, that is, the order of responses is not changed. Any protocol can be used as long as it is guaranteed that only communication from the terminal side (that is, the LAN side) occurs.

DESCRIPTION OF SYMBOLS 1 Internet 2 Closed network 3 Local area network 11, 11a, 11b Server 12 Internet gateway 13 Proxy apparatus 14 Terminal 51, 51a, 51b, 51x Terminal side session termination part 52 HTTP client part 61, 61a, 61b, 61x LAN side session termination Unit 62 HTTP server unit 63 relay management unit 64 response management table 65 session management table 66, 66a, 66b, 66y WAN side session termination unit 67 HTTP client unit 71, 71a, 71b, 71y server side session termination unit 72 HTTP server unit

Claims (6)

A proxy device that relays communication between an Internet gateway and a plurality of terminals,
The number of sessions between one proxy server on the Internet via the Internet gateway and the proxy device is equal to or less than the number obtained by dividing the port number frame obtained by subtracting the number of well-known ports from 65535 by the number of proxy devices installed. by and and limited sum to the following number of sessions end said plurality of end to said one server for relaying the proxy device itself destined,
When a communication request from the terminal side to the one server is newly received, communication is not performed at that time in the session between the one server and the proxy device, and the terminal side session and A proxy device that communicates with the one server using a session that has been unbundled. A plurality of LAN-side session termination units that exist for each port number, which transmits / receives a TCP stream to / from the terminal and extracts an HTTP request message from the received TCP stream;
A plurality of WAN-side session terminators existing for each port number for transmitting / receiving a TCP stream to / from the server and extracting an HTTP response message from the received TCP stream;
An HTTP server unit that analyzes the HTTP request message, reads a request HTTP header, and determines a LAN-side session termination unit to be a transfer destination from the response HTTP header of the HTTP response message;
An HTTP client that creates a request message by determining the IP address and port number of the WAN-side session terminator as a transmission destination from the request HTTP header, and analyzes the received HTTP response message to read the response HTTP header And
A session management table for recording the address and port number of the source and destination of the LAN-side session termination unit in association with the address and server port number of the server that is the destination of the session;
An entry is registered using the address and port number of the source and destination of the WAN session termination unit that relays the request message as a primary key, and temporarily stored in the server side session corresponding to the WAN session termination unit. Response management in which the session information on the terminal side to be linked is temporarily registered in the entry, and only the session information on the terminal side can be deleted from the entry when the transmission of the HTTP response message from the LAN side session termination unit is completed Table,
The proxy apparatus according to claim 1, further comprising: a relay management unit that updates the entries of the session management table and the response management table and relays communication by referring to the entries.   The relay management unit searches the LAN side and WAN side sessions for whether or not there is a disconnectable one, and can disconnect the LAN side session termination unit, the WAN side session termination unit, or both The proxy apparatus according to claim 2, wherein a session organizing unit that deletes the session is executed. As the above session organizing means,
4. The proxy according to claim 3, wherein the relay management unit can execute forced session deletion means for deleting the WAN session termination unit corresponding thereto when an HTTP disconnection trigger occurs with the server. 5. apparatus. As the above session organizing means,
The relay management unit, after executing the forcible session deletion means, from the response management table, the WAN side IP address and WAN side server port number in the WAN-side session termination unit which is removed by the forced delete session means If there is an entry that matches the WAN-side IP address and the WAN-side server port number, and if it does not exist, it corresponds to the WAN-side IP address and WAN-side server port number from the session management table. It is possible to execute a general session deletion unit that searches for an entry and deletes all the LAN side session termination units corresponding to the entry
The proxy device according to claim 4. As the above session organizing means,
The relay management unit compares the number of LAN-side sessions with the same server as the destination and the same server port number with the number of WAN-side sessions, and if the number of WAN-side sessions is larger, A single session deletion means for deleting at least one WAN session termination unit may be executed.
The proxy device according to claim 3.

Images