KR20040067885A - Gateway for supporting communication between network devices of different private networks - Google Patents

Abstract

PURPOSE: A network access system for supporting the communication between network elements located in respectively different private networks is provided to offer a service so that communication can be made between the network elements connected to respectively different private networks. CONSTITUTION: A gateway(100) comprises a public network interface(110), a private network interface(120), a memory(130), and a controller(140). The public network interface(110), connected to the Internet physically, has an authorized IP address allocated from an ISP(Internet Service Provider). The private network interface(120) has a private IP address. A network address to be used at a private network is randomly selected among the addresses approved by IANA(Internet Assigned Numbers Authority). The memory(130) stores programs associated with system operations and newly created or updated data. The controller(140) comprises a NAT(Network Address Translation)/NAPT(Network Address Port Translation) processing part(141), an IP processing part(142), a DNS(Domain Name Service) processing part(143), a DHCP(Dynamic Host Configuration Protocol) processing part(144), a routing part(145), an HTIP processing part(146A), a VPN(Virtual Private Network) processing part(146B), a web/middleware server(147), an encryption processing part(148), and a user authentication part(149).

Description

Gateway for supporting communication between network devices of different private networks

The present invention relates to a network connection device, and more particularly, to a network connection device that enables communication between network devices connected to different networks.

Recently, with the development of communication technology, high-speed communication network is widely used in each home. In addition, companies are releasing various digital information appliances with network functions such as Internet refrigerators, digital TVs, and set-top boxes to access the Internet through home appliances. As the network function is added to the home appliances used in the home and the information terminal becomes a new network type, the home network has emerged.

Since the home electrical / electronic products that make up the home network are connected to the Internet through wired / wireless, users can send and receive information regardless of their location at home and remote locations, and control the electrical / electronic products through the Internet. It became.

Meanwhile, in order to connect electrical / electronic products with the Internet, new network devices and programs to be installed in each device are required in the home. Among these devices, a network device that connects the Internet and a home network and controls the flow of network packets is called a home gateway.

In current homes, novice home gateways, such as ADSL and cable modems, can be used to access the Internet by being assigned one public Internet Protocol (IP) address from an Internet Service Provider (ISP).

However, the conventional home gateway as described above merely provides a simple connection from one home network device to the Internet and does not provide various services. In other words, as more and more network devices are distributed in the home, SOHO, telecommuting, home appliance automation, and remote control are required, a variety of services are required for the home gateway. It does not satisfy the desire of.

In order to accommodate the above user needs, a method of using a private IP address for a home network has been proposed. In the case of using a private IP address, a network address port translation (NAPT) technology is applied to a home gateway so that a plurality of network devices in a home network can share a public IP address to access the Internet. . In addition, a virtual private network (VPN) technology is applied to a home gateway so that a remote user connected to the Internet can access a private home network.

However, since the public IP address assigned by the home gateway changes from time to time, a user connected to the Internet must know the public IP address currently assigned to the home gateway in order to access the home network. In order to solve the problem of having to know the variable public IP address assigned to the home gateway from the ISP, the home gateway is assigned a public IP address from the ISP, and then the home gateway domain name and the assigned public IP address are located on the Internet. Register with a dynamic DNS server.

In addition, the home gateway is assigned one public IP address from the ISP, but in a home network environment, since a plurality of information devices are used in the home, only one public IP address can simultaneously connect them to the Internet. Therefore, private IP addresses are used in the home and NAPT technology is used to connect them to the Internet using one public IP address.

If there is a packet outgoing from the home to the Internet, the home gateway converts the packet's source private IP address and pre-departure port number to a port number different from the assigned public IP address and records it in the NAPT conversion table. When the response packet is transmitted from the Internet to the home network, the home gateway converts the packet's destination public IP address and destination port number into a private IP address and port number by referring to the NAPT conversion table, and then routes to the final destination. If a packet transmitted from the Internet to a home network is not recorded in the NAPT conversion table, the packet is discarded.

NAPT technology allows access from the home network to the Internet. That is, it is possible for a plurality of network devices located in a private network to access the Internet by sharing one public IP address. However, it is impossible to access the home network from the Internet, which means that private IP addresses, ports, and home gateway ports are included in the NAPT conversion table in order for packets sent by external users connected to the Internet to be converted / routed through the home gateway. Information such as number, public IP address and port, and IP protocol should be recorded because it is not known in advance.

VPN is a technology applied to home gateways to allow external users connected to the Internet to access network devices on private networks. VPNs vary depending on the environment and network layer. However, in the home network environment, two-layer tunneling protocols such as PPTP and L2TP are commonly used. A VPN server is located in the home gateway, and a remote user connected to the Internet acts as a VPN client. The home gateways of each home network can operate as a VPN server or a VPN client in each home network. First, the VPN client requests the creation of a tunnel to the VPN server by using a public IP address on the Internet. Once the tunnel is established, the VPN server authenticates the VPN client and assigns the VPN client a private IP address that can be used inside the home network. The VPN client creates a virtual network interface using the assigned private IP address, which is connected to the home network and acts as if it were a single network. The public IP address of the VPN client is used to create a tunnel to the VPN server, and the private IP address is used on the home network connected through the tunnel.

If you apply NAPT and VPN technology to your home gateway as above, you can connect to the Internet through multiple network devices in your home, and remote users on the Internet can connect to your home network.

However, as described above, the technologies such as NAPT and VPN connect the home network and the Internet, but cannot provide a connection between an arbitrary home network and another home network. In other words, in the home network, since a private IP address is used, a plurality of home networks using different public IP addresses can use the same private IP address. If the IP address of the host in the home network of the host and the host in the remote home network is the same, it is impossible to determine which home network the data is sent to, which causes a data transmission error.

An object of the present invention is to provide a network access device that provides a service to enable communication between network devices connected to different private networks in order to solve the above problems.

1 is a configuration diagram of a network including a network access device according to the present invention;

2 is a schematic block diagram according to an embodiment of the network connection apparatus shown in FIG. 1;

3 is a signal flow diagram illustrating a VPN tunnel formation process of two private networks having different extended network IDs;

4 is a signal flow diagram illustrating a packet delivery process of the host A and the host B through the tunnel formed between the private network A and the private network B by the process of FIG.

5 is a signal flow diagram illustrating a process of forming a VPN tunnel of two private networks where the extended network IDs match each other.

6 is a signal flow diagram illustrating a packet delivery process of the host A and the host B through the tunnel formed between the private network A and the private network B by the process of FIG.

7 is a signal flow diagram illustrating a process of forming a VPN tunnel between two private networks when the extended network ID of private network A is included in the extended network ID of private network B.

8 is a schematic block diagram according to still another embodiment of the network access apparatus shown in FIG. 1;

9 is a signal flow diagram illustrating a process of forming a VPN tunnel of two private networks having different extended network IDs.

10 is a signal flow diagram illustrating a packet delivery process of the host A and the host B through the tunnel formed between the private network A and the private network B by the process of FIG.

11 is a signal flow diagram illustrating a process of forming a VPN tunnel of two private networks in which extended network IDs match each other.

12 is a signal flow diagram illustrating a packet delivery process between Host A and Host B through a tunnel formed between Private Network A and Private Network B by the process of FIG.

FIG. 13 is a signal flow diagram illustrating a process of forming a VPN tunnel between two private networks when the extended network ID of private network A is included in the extended network ID of private network B. Referring to FIG.

* Description of the symbols for the main parts of the drawings *

100: gateway 110: public network interface

120: private network interface 130: memory unit

132, 132 ': private network connection management table

140: control unit 141: NAT / NAT processing unit

142: IP processing unit 143, 143 ': private network DNS processing unit

144: DHCP processing unit 145, 145 ': routing unit

146, 146 ': VPN processing unit 146A, 146A': HTIP processing unit

146B, 146B ': VPN processing unit 147: Web server / middleware server

148: encryption processing unit 149: user authentication processing unit

150: Internet Service Provider (ISP)

200: private network 210, 310, 320: host

212: Web browser 214: Application

300: Internet 330: Internet DNS Server

Network connection device of the present invention for achieving the above object, at least one public network interface connected to the public network; At least one private network interface connected to the private network; When a tunnel creation request message for a third party network connected to the public network is received from a host connected to the private network, a VPN tunnel is formed by communicating with a gateway of the third party network, and the network addresses of the private network and the third party network are the same or equal. If the private network includes the network addresses of the other private network, create a new network address table so that the two private networks use different network addresses in the VPN tunnel, and add the data packets transmitted from the host connected to the private network or the third party network. And converting and forwarding a destination address or a source address based on the new network address table.

The controller may include a web server providing a tunnel creation request page so that a host connected to the private network can request to create a tunnel; A private network DNS processing unit for obtaining a public IP (Internet Protocol) address of the third-party network gateway from a DNS (Domain Name Server) connected to the public network in response to a tunnel creation request for the third-party network of a host connected to the private network; A virtual private network (VPN) processing unit operating as a server or a client according to the tunnel creation request transmitted through the public network interface or the tunnel creation request transmitted through the private network interface to form a tunnel with the requesting private network; Converting a private IP address into a public IP address or a public IP address into a private IP address using a NAPT protocol for a data packet transmitted from the private network to the public network or a data packet transmitted from the public network to the private network; And a NAT / NAPT processing unit for performing address translation in the VPN tunnel using a NAT protocol when the VPN tunnel is formed between the private network and the third party network. Here, the web server can be replaced by a middleware server.

The VPN processing unit may include a network address of the private network and second network addresses to be used instead of the network address of the private network in the VPN tunnel when the tunnel creation request for the third party network is transmitted from the host connected to the private network. The tunnel creation request message is transmitted to the third party gateway. And the VPN processing unit includes a network address of the third party network, the second network address, and third network addresses to be used in place of the network address of the third party network in the VPN tunnel with respect to the tunnel creation request. If a response is received, an ACK (Acknowledge) including the network address of the private network, the network address of the third-party network, the second network address, and the third network address is transmitted to the third-party network gateway. The VPN processor generates a connection management table between private networks through a process of generating a tunnel creation request message for the third party network and transmitting the ACK. The private network connection management table includes a network address of the private network, a network address of the third party network, the second network address, and the third network address, and a domain name of the third party network gateway and a VPN operation of the third party network gateway. It may further include a server / client status display item according to.

When the NAT / NAPT processor generates the private network connection management table in the VPN processor as described above, the NAT / NAPT processor sets NAT (Network Address Translation) for the hosts connected to the private network.

In addition, the DNS processing unit, when a communication request is transmitted from the first host connected to the private network with the second host connected to the third-party network in a state where a VPN tunnel is formed between the third-party network, the second host of the second host. 3, the third-party gateway is contacted for a network address; and when a response to the third network address of the second host is received from the third-party gateway, the third network address of the second host is transmitted to the first host. do.

The control unit forwards the data packet having the third network address of the second host as the destination address from the first host to the third-party network gateway through the VPN tunnel.

Meanwhile, when the VPN processing unit receives a tunnel request message including a network address of the third party network and second network addresses to be used in place of the network address of the third party network in the VPN tunnel, the network address of the private network, Send a response message to the third party network including a second network address and third network addresses to be used in place of the private network's network address in the VPN tunnel. The VPN processing unit generates a connection management table between private networks through a process from receiving a tunnel creation request message from the third-party network to receiving an ACK for the response message. The private network connection management table includes a network address of the private network, a network address of the third party network, the second network address, and the third network address, and a domain name of the third party network gateway and a VPN operation of the third party network gateway. It may further include a server / client status display item according to.

When the NAT / NAPT processing unit generates the private network connection management table in the VPN processing unit as described above, the NAT / NAPT processing unit sets NAT (Network Address Translation) for hosts connected to the private network with reference to the private network connection management table.

In addition, when the DNS processing unit receives an inquiry about a host connected to the private network from the third-party network, the DNS processing unit transmits the network address of the host used in the VPN tunnel as a response.

If the data packet is transmitted from the third-party network as a destination address to the third network address of the host, the controller transmits the received data packet to the host with reference to the NAT.

On the other hand, the control unit, a web server for providing a tunnel creation request page to request the creation of the tunnel from the host connected to the private network; A DNS processing unit for obtaining an IP (Internet Protocol) address for a domain name at the request of a host connected to the private network or the controller; In response to the tunnel creation request transmitted through the public network interface or the tunnel creation request transmitted through the private network interface, the server or client operates to communicate with a network access device of the target private network to exchange and negotiate necessary information, and the VPN processing unit. And HTIP processing unit for controlling the NAT / NAT processing unit; A virtual private network (VPN) processing unit configured to operate as a server or a client according to the tunnel creation request transmitted through the public network interface or the tunnel creation request transmitted through the HTIP processing unit to form a tunnel with the requesting private network; Converts a private IP address into a public IP address or a public IP address into a private IP address using a NAPT protocol for a data packet transmitted from a private network to the public network or a data packet transmitted from the public network to the private network; And a NAT / NAPT processing unit for performing address translation at both ends of the VPN tunnel, if necessary, for the VPN tunnel formed between the network and the third party network. Here, the web server may be replaced with a middleware server.

The HTIP processing unit may be used in place of the VPN protocol to be used for the tunnel, the network address of the private network, and the network address of the private network in the VPN tunnel when the tunnel creation request for the third party network is transmitted from the host connected to the private network. The tunnel creation request message including the second network addresses is transmitted to the third party network gateway. The HTIP processing unit may be a VPN protocol to be used for the tunnel from the gateway of the third party network for the tunnel creation request, a network address of the third party network, third network addresses to be used instead of the network address of the third party network in the VPN tunnel, If a response is received that includes an address of the private network and second network addresses to be used in place of the network address of the private network in the VPN tunnel, the VPN protocol, the network address of the private network, the network address of the third-party network, and the second network. Send an ACK (Acknowledge) including the address, the third network address to the third-party network gateway. The HTIP processing unit may be a VPN protocol to be used for the tunnel from the gateway of the third party network for the ACK message, a network address of the third party network, a third network address to be used instead of the network address of the third party network in the VPN tunnel, Upon receiving a READY message including an address of a private network and a second network address to be used in place of the network address of the private network in the VPN tunnel, the VPN processor is configured as a VPN client and the HTIP processor is configured to drive a VPN client. .

The HTIP processing unit generates a connection management table between private networks through a process of generating a tunnel creation request message for the third party network and receiving the READY. The private network connection management table includes a network address of the private network, a VPN protocol of the tunnel, an ID of the tunnel, a network address of the third party network, the second network address, and the third network address. It may further include the domain name and the server / client status display items according to the VPN operation of the third-party network gateway.

In addition, when the VPN tunnel is formed between the private network and the third-party network, and the address translation is required at both ends of the VPN tunnel, the HTIP processor may refer to the private network connection management table to configure address translation at both ends of the VPN tunnel. Control the NAPT processing unit.

In addition, the DNS processing unit, if a communication request is transmitted from a first host connected to the private network to a second host connected to the third-party network while a VPN tunnel is formed between the third-party network, the domain of the second host. Contact the gateway of the third-party network for the IP address for the name. The third-party network gateway sends an IP address of the second host used in the VPN tunnel as a response, and the DNS processor receives it and transmits it to the first host.

The controller, when a data packet having the IP address of the second host as the destination address is transmitted from the first host, routes the packet to the third-party network gateway through the VPN tunnel, and when address translation is set in the VPN tunnel. Perform source address translation of data packets.

Meanwhile, when the HTIP processing unit receives a tunnel request message including a VPN protocol of the tunnel, a network address of the third party network, and second network addresses to be used instead of the network address of the third party network in the VPN tunnel, A response message including the VPN protocol of the tunnel, the network address of the private network, third network addresses to be used in place of the network address of the private network in the VPN tunnel, the network address of the third-party network, and the second network address. To transmit.

The HTIP processing unit, when an ACK message arrives from the other private network, sets the VPN processing unit as a VPN server, and replaces the VPN protocol of the tunnel, the network address of the private network, and the network address of the private network in the VPN tunnel. A READY message including a third network address to be used, a network address of the third party network, a second network address to be used in place of the network address of the third party network in the VPN tunnel, and the like, are transmitted to the network access device of the third party network.

The HTIP processing unit generates a connection management table between private networks through a process from receiving a tunnel creation request message from the third-party network to transmitting the READY for the response message. The private network connection management table includes a VPN protocol of the tunnel, an ID of the tunnel, a network address of the private network, a network address of the third party network, the second network address, and the third network address. It may further include the domain name and the server / client status display items according to the VPN operation of the third-party network gateway.

In addition, when the VPN tunnel is formed between the private network and the third-party network, and the address translation is required at both ends of the VPN tunnel, the HTIP processing unit may refer to the private network connection management table to configure address translation at both ends of the VPN tunnel. Control the NAPT processing unit.

In addition, when the DNS processing unit receives an inquiry about a host connected to the private network from the third-party network, the DNS processing unit transmits the network address of the host used in the VPN tunnel as a response.

If the data packet is transmitted from the third-party network as a destination address to the third network address of the host, the controller converts the destination address of the data packet by referring to the conversion table of the NAT / NAPT processing unit and then sends the data packet to the host. Send the received data packet.

As described above, the network connection device of the present invention enables not only the networking from the private network to the public network (Internet) and the networking from the Internet to the private network, but also from the private network to the third party network, thereby further extending the scope of the user's networking. You can do it.

Hereinafter, an embodiment of the present invention will be described in detail with reference to the accompanying drawings. In the following description, it is specified that a plurality of members uses a single member number that includes a plurality of members.

1 is a diagram illustrating a network including a home gateway according to an embodiment of the present invention. The network includes a plurality of private networks 200A and 200B, an access network, and the Internet 300. Private network hosts 210A, 210B, 210C, and 210D are connected to the private networks 200A and 200B, respectively, and the DNS server 330 and the plurality of public network hosts 310 and 320 are connected to the Internet 300. have. Each private network 200 and the Internet 300 are connected to each other through an access network including an ISP 150 and a home gateway 100.

The home gateway 100 connecting the private network 200 and the Internet 300 receives a public IP address from the ISP 150 and registers a domain name in the DNS server 330 connected to the Internet for the assigned IP address. . In addition, the home gateway 100 services through the NAPT protocol and the VPN so that the hosts 210 and the hosts 310 and 320 connected to the Internet 300 can communicate with each other. In addition, the home gateway 100 provides a service for allowing hosts 210A / 210C located in each private network 200 and hosts 210B / 210D connected to other private networks to communicate with each other through VPN and private IP address assignment. do. That is, the home gateway A (100A) and the home gateway B (100B) is a host (host B) located in the other private network (200B) from one host (for example, host A) located in each private network (for example, 200A). For the connection request with the other), create a VPN tunnel through communication with the other home gateway (100B), and assign different private IP addresses to be used in the VPN tunnel for the hosts (210) connected to each private network (200A / 200B). Then, at both ends of the tunnel, Host A 210A or Host C 210C connected to Private Network A 200A through NAT can communicate with Host B 210B or Host D 210D connected to Private Network B 200B. Service to help.

2 is a block diagram of a gateway according to an embodiment of the present invention. The gateway 100 includes a public network interface 110, a private network interface 120, a memory unit 130, and a controller 140.

The interface is provided with at least two network interfaces as described above, at least one is a public network interface, and at least one is a private network interface. The public network interface 110 is physically connected to the Internet 300 by ADSL, Cable Modem, Ethernet, etc., and has one public IP address assigned from the ISP 150. The private network interface 120 may be configured by wired / wireless such as Ethernet, wireless LAN, home PNA, etc., and has a private IP address in the controller 140. The network address used for the private network is randomly selected from addresses authorized by the Internet Assigned Numbers Authority (IANA).

The memory unit 130 stores programs related to system operation and newly generated and updated data.

The control unit 140 includes a NAT / NAPT processing unit 141, an IP (Internet Protocol) processing unit 142, a domain name service (DNS) processing unit 143, a dynamic host configuration protocol (DHCP) processing unit 144, and a routing unit 145. ), A VPN processing unit 146, a web / middleware server 147, an encryption processing unit 148, and a user authentication processing unit 149.

The NAT / NAPT processor 141 converts a private IP address into a public IP address or a public IP address into a private IP address for a packet transmitted from a private network to the Internet or a packet transmitted from the Internet to a private network. In addition, the NAT / NAPT processing unit 141 performs address translation in a VPN tunnel using a NAT protocol when private networks are connected to each other using a VPN tunnel. The NAT / NAPT processing unit 141 generates and continuously updates the NAT and NAPT tables in the memory unit 130.

The IP processing unit 142 performs processing on IP datagrams of packets transmitted from the public network interface 110 and the private network interface 120.

The routing unit 145 establishes an optimal path with an external host connected to the public network and a host connected with a third party network. The routing unit 145 generates and continuously updates a routing table in the memory unit 130.

The DNS processor 146 manages domain names and private IP addresses for hosts in the private network. In addition, when a query for a host outside the private network occurs from a host inside the private network, the DNS processing unit 146 obtains an answer from a DNS server 330 located on the Internet or a home gateway located at the front end of a third party network. The DNS processing unit 146 manages DNS tables related to hosts in the private network.

When the network device in the private network is booted, the DHCP processor 144 responds to a request for a private IP address, a gateway address, a DNS processor address, and the like, available from the hosts in the private network. The DHCP processor 144 acquires the domain name of the host as part of the response, and transfers the obtained domain name to the DNS processor 146 so that the DNS table can be generated and updated.

The web / middleware server 147 provides a means for a user of a private network to request to create a tunnel between other private networks. The user may request a service using a web browser or a middleware client.

The VPN processing unit 146 operates as a VPN server for a host located on the Internet, and operates as a VPN server or a VPN client so as to enable connection with other private networks. In addition, when the VPN processing unit 146 is requested to connect with other private networks through a WEB / Middleware server 147 from a host located inside the private network, it forms a VPN tunnel by communicating with a third party network and establishes a VPN according to the network address of the private network. Configure NAT at the end of the tunnel. Information necessary for connection with other private networks is generated by managing a private network connection management table, and the data generated as a table is stored in the memory unit 130. The private network connection management table includes the network address of its own private network, the network address of the third party's network, the network address of its own private network to be used within the VPN tunnel, and the network address of the third party's network to be used within the VPN tunnel. The server / client status display item according to the VPN operation of the private network gateway may be further included.

The encryption processing unit 148 performs encryption on packets transmitted between the private network and the public network or between the private network and the third party network.

The user authentication processing unit 149 performs an authentication procedure for an external user who wants to access a private network from a public network and a user who accesses a configuration change for a gateway in a private network.

When the above gateway forms a VPN tunnel with a third-party network, it performs corresponding operations according to the following three cases. Each case will be described with reference to FIG. 1.

First, the extended network ID (the product of the network ID and the subnet mask) of the private network A 200A and the private network B 200B is different from each other (case1). For example, when the network ID of private network A 200A is set to 10.0.0.0/24 and the network ID of private network B 200B is set to 10.0.1.0/24 (case1), the extended network of private network A 200A is set. ID is 10.0.0.x and private network B's extended network address is 10.0.1.x. In this case, private network A and private network B can communicate with each other only by forming a VPN tunnel.

Second, the extended network IDs of the private network A 200A and the private network B 200B coincide with each other (case2). For example, when both network IDs of private network A and private network B are set to 10.0.0.0/24 (case2), the extended network ID of both private network A (200A) and private network B (200B) is 10.0.0.x. And match each other. In this case, when Host A 210A located in Private Network A 200A tries to send a packet to Host B 210B located in Private Network B 200B, Host C 210C has the same IP address as Host B 120B. If Home Gateway A (100A) does not know whether to send a packet transmitted from Host A (210A) to Host B (210B) or Host C (210C) does not know whether to generate a transmission error, both There will be no communication between private networks. Thus, in this case, a new IP address that can be used in the tunnel formed between private network A 200A and private network B 200B is assigned. For example, after assigning a network address of 10.0.1.0/24 to private network A and 10.0.2.0/24 to private network B, NAT is performed at both ends of the VPN tunnel. As a result, when looking at the host 210B / 210D located in the private network B 200B in the private network A 200A, the host located in the private network B 200B is recognized as having a network address of 10.0.2.x. Since the B 200B recognizes that the host 210A / 210C located in the private network A 200A has a network address of 10.0.2.y, the host 210A / 210C and the private network B of the private network A 200A may be identified. The host 210B / 210D of the 200B can communicate with each other.

Third, the network ID of private network A is included in the network ID of private network B (case3). For example, when private network A (200A) is given as 10.0.0.0/24 and private network B (200B) is given as 10.0.0.0/16 (case3), the extended network ID of private network A (200A) is 10.0.0. .x, the extended network ID of the private network B (200B) is 10.0.xx different, but 10.0.0.x is included as part of 10.0.xx. In this case as well, create a VPN tunnel between private network A (200A) and private network B (200B), assign a network address of 10.0.1.0/24 to private network A (200A), and 10.1.0.0/16 to private network B (200B). NAT is performed at both ends of the tunnel. As a result, when looking at the host located in private network A (200B) in private network A (200A), it appears to have an address of 10.1.xy, and when looking at the host located in private network A (200A) in private network B (200B), 10.0.1. Since it appears to have an address of z, the host of private network A 200A and the host of private network B 200B can communicate with each other.

In the above three cases, if the extended network IDs of the private network A (200A) and the private network B (200B) are different from each other, it is possible to communicate with each other without setting up simply by creating a VPN tunnel therebetween. It can be seen that it is desirable to set the private network network addresses randomly so that they differ from each other.

Hereinafter, VPN tunnel formation and packet delivery process between two private networks according to the above three cases will be described.

3 is a signal flow diagram illustrating a VPN tunnel formation process of two private networks having different extended network IDs. First, the tunnel formation request page provided from the web server 147 of the gateway A 100A is used by the user of the private network A 200A to create a tunnel with the private network B 200B through the web browser 212 in the host A 210A. When the request is made, the gateway A 100A receiving the tunnel creation request between the private network A 200A and the private network B 200B is connected to the gateway B 100B from the DNS server 330 located in the Internet through the DNS processing unit 143. Obtain a public IP address (211.32.119.136). Next, the gateway A 100A requests the creation of the tunnel to the VPN processing unit 146 ′ of the gateway B 100B by driving the client program in the VPN processing unit 146. The tunnel creation request message between private networks includes the network address (10.0.0.0/24) of private network A (200A) and the network addresses (10.0.0.0/24, 10.0) to be used instead of the network address of private network A (200A) in the VPN tunnel. .1.0 / 24, 10.0.2.0/24, ...). At this time, if the network addresses of private network A (200A) and private network B (200B) are different from each other, since NAT is not required in the VPN tunnel, the address of private network A (10.0.0.0/24) is selected as it is, and private network A and private network B are If the expanded network addresses of s match, the available ones are selected from 10.0.1.0/24, 10.0.2.0/24, ...

When the gateway B 100B transmits the private network tunnel creation request message from the gateway A 100A, the VPN processor 146 transmits the tunnel creation response message between the private networks to the gateway A 100A. The response message includes the network address (10.0.1.0/24) of private network B (200B), the network address (10.0.0.0/24) to be used instead of the network address of private network A (200A) in the VPN tunnel, and the private network within the VPN tunnel. Network addresses (10.0.1.0/24, 10.0.2.0/24, 10.0.3.0/24, ...) to be used instead of the network address of B 200B are included.

The gateway A (100A) receiving the response message transmits the tunnel creation ACK between the private networks to the gateway B (100B). The ACK is used to replace the network address of private network A (200A) (10.0.0.0/24), the network address of private network B (200B) (10.0.1.0/24), and the network address of private network A (200A) within the VPN tunnel. Address (10.0.0.0/24), and the network address (10.0.1.0/24) to use in place of the network address of private network B 200B in the VPN tunnel. At this time, if the address of the private network A (200A) and the network address to be used instead of the network address of the private network A (200A) in the VPN tunnel match, it means that NAT does not occur in the VPN tunnel, otherwise, NAT occurs. it means.

After sending and receiving an ACK message, private network connection management tables 132 and 132 'are generated in the gateway A 100A and the gateway B 100B, respectively. The private network connection management table 132 includes items indicating the domain name of the other gateway, whether the other gateway is a VPN server or a client, a network address of the private network A (200A), a network address of the private network B (200B), and a private network within the VPN tunnel. The network address to be used instead of the network address of A 200A, the network address to be used instead of the network address of private network B 200B in the VPN tunnel, and the like.

Looking at the table generated by Gateway A (100A), the domain name (Gateway B) of Gateway B (100B), the item indicating that Gateway B is a VPN server (server), the network address of private network A (10.0.0.0/24) , The network address of Private Network B (10.0.1.0/24), the network address to use instead of Private Network A's network address within the VPN tunnel (10.0.0.0/24), and the network address to use instead of Private Network B's network address within the VPN tunnel. (10.0.1.0/24) and the like.

When the ACK signal is exchanged between the two private networks as described above, a VPN tunnel is formed between the gateway A 100A and the gateway B 100B, and a PPP connection is created in the tunnel. Thereafter, the packet transferred from the host A 210A to the end of the VPN tunnel of the gateway A 100A is transferred to the end of the VPN tunnel of the gateway B 100B through the PPP connection.

4 is a signal flow diagram illustrating a packet transfer process between the host A 210A and the host B 210B through the tunnel formed between the private network A 200A and the private network B 200B by the process of FIG. 3. First, the user of the private network A (200A) knows the domain name of the host B (210A), the application installed in the host A (210A) is the gateway A to know the IP address corresponding to the domain name of the host B (210B) Send DNS inquiry to 100A. Then, the DNS processing unit 143 of the gateway A 100A first examines the private network connection management table 132. If a VPN tunnel is established between the private network A (200A) and the private network B (200B), the DNS query for the host B (210B) is sent to the gateway B (100B).

When the DNS query is transmitted from the gateway A (100A) to the gateway B (100B) as described above, the DNS processing unit 143 'of the gateway B (100B) is the host B (in the VPN tunnel instead of the network address of the host B (210B)). A response message is sent to the gateway A 100A with the network address (10.0.1.5) indicating 210B).

Gateway A (100A) forwards the private IP address (10.0.1.5) responded to host B (210B) from DNS processing unit 143 'of gateway B (100B) to host A (210A).

Host A 210A receives the private IP address of Host B 210B from Gateway A 100A, receives the received private IP address (10.0.1.5) for the destination address and the private address of Host A 210A for the source address. Enter the IP address (10.0.04) and send the packet to Gateway A (100A).

When the packet is received from the host A 210A, the gateway A 100A forwards the received packet to the end of the tunnel of the gateway A 100A with reference to the routing table 145 and the forwarding setting. Since the PPP connection is established in the VPN tunnel between the gateway A 100A and the gateway B 100B, the packet sent to the tunnel end of the gateway A 100A is delivered to the tunnel end of the gateway B 100B.

When the packet is delivered through the VPN tunnel, the gateway B 100B forwards the packet to the host B 210B with reference to the routing table 145 'and the forwarding setting.

When a packet is received, Host B 210B enters the private IP address (10.0.1.5) of Host B 210B in the source address and the private IP address (10.0.04) of Host A 210A in the destination address. Send a response.

Thereafter, the host A 210A and the host B 210B repeat the packet forwarding process through the tunnel formed between the private network A 200A and the private network B 200B.

FIG. 5 is a signal flow diagram illustrating a process of forming a VPN tunnel of two private networks in which extended network IDs coincide with each other. First, the tunnel formation request page provided by the web server 147 of the gateway A 100A is created by the user of the private network A 200A in the tunnel with the private network B 200B through the web browser 212 in the host A 210A. In response to the request, the gateway A (100A) receiving the tunnel creation request between the private network A (200A) and the private network B (200B) from the DNS server 330 located in the Internet through the DNS processing unit 143 of the gateway B (100B) Obtain a public IP address (211.32.119.136). Next, the gateway A 100A, which has obtained the public IP address of the gateway B 100B, requests the VPN processing unit 146 'of the gateway B 100B to create a private network tunnel by running the client program in the VPN processing unit 146. . The tunnel creation request message between private networks includes the network address (10.0.0.0/24) of private network A (200A) and the network addresses (10.0.0.0/24, 10.0) to be used instead of the network address of private network A (200A) in the VPN tunnel. .1.0 / 24, 10.0.2.0/24, ...).

When the VPN processing unit 146 ′ of the gateway B 100B receives the tunnel creation request from the gateway A 100A, the VPN processing unit 146 ′ transmits a response message for the tunnel creation request between the private networks to the gateway A 100A. The response message includes the network address (10.0.0.0/24) of private network B (200B), the network address (10.0.1.0/24) to be used instead of the network address of private network A (200A) in the VPN tunnel, and the private network within the VPN tunnel. Network addresses (10.0.2.0/24, 10.0.3.0/24, 10.0.4.0/24, ...) to be used instead of the network address of B 200B are included.

When the gateway A 100A receives the response message from the gateway B 100B, the gateway A 100A sends a tunnel creation ACK between the private networks to the gateway B 100B. ACK is used instead of the network address of private network A (200A) (10.0.0.0/24), the network address of private network B (200B) (10.0.0.0/24), and the network address of private network A (100A) within the VPN tunnel. Address (10.0.1.0/24), and the network address (10.0.2.0/24) to be used in place of the network address of the private network B 200B in the VPN tunnel. Since the address of the private network A 200A and the network address to be used instead of the network address of the private network A 200A in the VPN tunnel do not match, the gateway A 100A recognizes that address translation will be used by the NAT protocol.

After sending and receiving an ACK message, private network connection management tables 132 and 132 'are generated in the gateway A 100A and the gateway B 100B, respectively. The private network connection management table 132 includes items indicating the domain name of the other gateway 100, an item indicating whether the other gateway 100 is a VPN server or a client, a network address of the private network A 200A, and a network address of the private network B 200B. , A network address to be used instead of the network address of the private network A 200A in the VPN tunnel, and a network address to be used instead of the network address of the private network B 200B in the VPN tunnel.

Looking at the table generated by Gateway A (100A), the domain name (Gateway B) of Gateway B (100B), the item indicating that Gateway B is a VPN server (server), and the network address (10.0.0.0) of private network A (200A). / 24), the network address of private network B (200B) (10.0.0.0/24), the network address (10.0.1.0/24) to use instead of the network address of private network A (200A) in the VPN tunnel, and the private network within the VPN tunnel. A network address (10.0.2.0/24) or the like to be used instead of the network address of the B 200B.

Through the above process, a VPN tunnel is formed between the gateway A 100A and the gateway B 100B, and a PPP connection is generated in the tunnel. Thereafter, the packet delivered to the end of the VPN tunnel of the gateway A 100A is delivered to the end of the VPN tunnel of the gateway B 100B through the PPP connection.

After the VPN tunnel is created and the PPP connection is completed, the gateway A 100A sets up NAT in the gateway A 100A of the VPN tunnel with reference to the private network connection management table 132. When NAT is set, when a packet is sent from the private network A (200A) through the gateway A (100A) to the VPN tunnel, the source address 10.0.0.x is converted to 10.0.1.x, and the packet is transferred from the VPN tunnel to Gateway A. When it passes over (100A) to private network A, the destination address 10.0.1.y is converted to 10.0.0.y. Gateway B also sets up NAT on the gateway B side of the VPN tunnel.

FIG. 6 is a signal flow diagram illustrating a packet forwarding process between the host A 210A and the host B 210B through the tunnel formed between the private network A and the private network B by the process of FIG. 5. First, a user of private network A 200A knows the domain name of host B 210B, and an application 214 installed on host A 210A queries gateway A 100A for DNS for host B 210B. Then, the DNS processing unit 143 of the gateway A 100A examines the private network connection management table 132. If a VPN tunnel is established between the private network A (200A) and the private network B (200B), it is recognized that NAT for the packet passing through the tunnel is required. In order to know private IP address to be used in DNS, send DNS query to Gateway B.

When the DNS processing unit 143 'of the gateway B 100B receives an inquiry about the host B 210B, the DNS processing unit 143' receives the IP address (10.0.2.5) used in the VPN tunnel of the host B 210B. Sends a response message, and gateway A (100A) retransmits it to host A (210A).

Host A 210A then sends the packet to Gateway A (100A) to send the packet to Host B 210B. The destination address of the packet is 10.0.2.5 and the source address is 10.0.0.4. do.

When a packet destined for the host B 210B is received from the host A 210A, the gateway A 100A forwards the packet to the end of the tunnel of the gateway A 100A with reference to the routing table and the forwarding setting. Then, since NAT is set at the end of the VPN tunnel of the gateway A 100A, the source address 10.0.0.4 is converted to 10.0.1.4. Since the PPP connection is established in the tunnel between the gateway A (100A) and the gateway B (100B), the packet whose source address is converted through NAT is transmitted to the end of the tunnel of the gateway B (100B).

Gateway B (100B) uses the NAT set at the VPN tunnel end of Gateway B (100B) to forward the destination address 10.0.2.5 to 10.0. Convert it to .0.5. The packet whose destination address is converted through NAT is forwarded to the host B 210B by referring to the routing table and the forwarding setting.

Thereafter, the host B 210B sends a response to the host A 210A, and communication is performed by repetition of the packet forwarding process.

FIG. 7 is a signal flow diagram illustrating a process of forming a VPN tunnel between two private networks when the extended network ID of private network A is included in the extended network ID of private network B. Referring to FIG. First, the tunnel formation request page provided by the web server 147 of the gateway A 100A is read by the user of the private network A 200A from the host A 210A through the web browser 212, and then the private network B 200B. If a request is made to create a tunnel, the gateway A (100A) receiving the tunnel creation request between the private network A (200A) and the private network B (200B) is a gateway from the DNS server 330 located in the Internet through the DNS processing unit 143. Obtain a public IP address of B (100B) (211.32.119.136). Next, the gateway A 100A having obtained the public IP address of the gateway B 100B drives the client program in the VPN processing unit 146 to request the private network tunnel generation to the VPN processing unit of the gateway B 100B. The message requesting the creation of a tunnel between private networks includes the network address of private network A (10.0.0.0/24) and the network addresses (10.0.0.0/24, 10.0.1.0/24, etc.) to be used instead of the network address of private network A in the VPN tunnel. 10.0.2.0/24, ...).

When the gateway B 100B receives the tunnel formation request message from the gateway A 100A, the VPN processing unit 146 'sends a tunnel creation response message between the private networks. The response message will be used instead of Private Network B's network address (10.0.0.0/16), Network address to be used in place of Private Network A's network address within the VPN tunnel (10.0.1.0/24), and Private Network B's network address within the VPN tunnel. Network addresses (10.1.0.0/16, 10.2.0.0/16, 10.3.0.0/16, ...).

When the gateway A 100A receives a response message from the gateway B 100B, the gateway A 100A transmits a tunnel creation ACK between the private networks to the gateway B 100B. ACK is the network address of private network A (10.0.0.0/24), the network address of private network B (10.0.0.0/16), the network address (10.0.1.0/24) to use in place of the private network A network address in the VPN tunnel, Include the network address (10.1.0.0/24) to use in place of private network B's network address in the VPN tunnel. Since the address of the private network A and the network address to be used instead of the network address of the private network A in the VPN tunnel do not match, the gateway A 100A recognizes that NAT should be used.

After exchanging the ACK message, private network connection management tables 132 and 132 'are generated in the gateway A 100A and the gateway B 100B. Referring to the table 132 generated by the gateway A 100A, the domain name of the gateway B 100B, the item indicating that the gateway B 100B is the VPN server, the network address of the private network A (10.0.0.0/24), The network address of Private Network B (10.0.0.0/16), the network address to use instead of Private Network A's network address within the VPN tunnel (10.0.1.0/24), and the network address to use instead of Private Network B's network address within the VPN tunnel ( 10.1.0.0/16), and the like.

Through the above process, a PPP connection is generated in the VPN tunnel between the gateway A 100A and the gateway B 100B. Thereafter, the packet delivered to the end of the VPN tunnel of the gateway A 100A is delivered to the end of the VPN tunnel of the gateway B 100B through the PPP connection.

Next, when the VPN tunnel is created and the PPP connection is completed, the gateway A 100A sets NAT on the gateway A 100A side of the VPN tunnel with reference to the private network connection management table 132. If NAT is enabled, when a packet is sent from VPN A through Gateway A (100A) to the VPN tunnel, the source address 10.0.0.x will be converted to 10.0.1.x, and the packet will be routed from the VPN tunnel to Gateway A (100A). When it is sent to private network A, the destination address 10.0.1.y is converted to 10.0.0.y. Similarly, gateway B 100B also establishes NAT on the gateway B 100B side of the VPN tunnel.

When NAT is set at both ends of the VPN tunnel formed between the gateway A (100A) and the gateway B (100B) as described above, the host A (210A) and the host B (210B) mutually through the data packet delivery process shown in FIG. Communication is possible.

Hereinafter, a network connection apparatus according to another embodiment of the present invention will be described.

8 is a block diagram of a gateway according to another embodiment of the present invention. The gateway 100 includes a public network interface 110, a private network interface 120, a memory unit 130, and a controller 140.

Operations and functions of the interface 110, the private network interface 120, and the memory 130 are as described above. The control unit 140 includes a NAT / NAPT processing unit 141, an IP (Internet Protocol) processing unit 142, a domain name service (DNS) processing unit 143, a dynamic host configuration protocol (DHCP) processing unit 144, and a routing unit 145. ), The HTIP processing unit 146A, the VPN processing unit 146B, the web / middleware server 147, the encryption processing unit 148, and the user authentication processing unit 149.

NAT / NAPT processing unit 141, IP (Internet Protocol) processing unit 142, DNS (Domain Name Service) processing unit 143, Dynamic Host Configuration Protocol (DHCP) processing unit 144, routing unit 145, web / middleware The operations and functions of the server 147, the encryption processing unit 148, and the user authentication processing unit 149 are as described above.

On the other hand, the HTIP processing unit 146A negotiates parameters necessary for creating a tunnel between different private networks, and then controls the VPN processing unit 146B and the NAT / NAPT processing unit 141 by using the same. In this case, the necessary parameters include the type of VPN protocol used to create the VPN tunnel, the network address of its own private network, the network address of the third party's network, the network address of its own private network to be used within the VPN tunnel, and the network address of the third party's network to be used within the VPN tunnel. And the like.

The HTIP processing unit 146A enables communication devices in the private network to directly communicate with each other between a plurality of private networks regardless of the type of private IP address and VPN protocol in the private network. Meanwhile, the variables obtained through the negotiation or the list of generated VPN tunnels between the private networks are stored in the memory unit 130. That is, information necessary for connection with other private networks is generated by managing a private network connection management table, and the data generated as a table is stored in the memory unit 130.

That is, when the HTIP processing unit 146A is requested to connect with another private network through the WEB / Middleware server 147 from a host located inside the private network, the HTIP processing unit 146A negotiates variables for forming a VPN tunnel by communicating with a third party network and negotiates the negotiation. Control the VPN processing unit 146B to create a VPN tunnel, and control the NAT / NAPT processing unit 141 to set NAT at the end of the VPN tunnel according to the network address of the private network. The private network connection management table contains the VPN protocol used, the network address of its own private network, the network address of the third party's network, the network address of its own private network to be used within the VPN tunnel, and the network address of the third party's network to be used within the VPN tunnel. The server may further include a server / client status display item according to a VPN operation of a domain name and a counterpart private network gateway.

The VPN processing unit 146B operates as a VPN server for a host located on the Internet, and operates as a VPN server or a VPN client to enable connection with other private networks. In addition, the HTIP processing unit 146A communicates with the HTIP processing unit 146A 'located in another network connection device to complete the negotiation, and then controls the VPN processing unit 146B to form VPN tunnels between different private networks.

When the above gateway forms a VPN tunnel with a third-party network, it performs corresponding operations according to the following three cases. In the above three cases, namely, first, when the extended network ID (the product of the network ID and the subnet mask) of the private network A (200A) and the private network B (200B) is different (case1), and the second, the private network A (200A) Referring to FIG. 1 for the case where the extended network IDs of the and private network B 200B coincide with each other (case2) and the third case, the network ID of the private network A is included in the network ID of the private network B (case3), In some cases, the process of VPN tunnel formation and packet delivery between two private networks will be explained.

9 is a signal flow diagram illustrating a VPN tunnel formation process of two private networks having different extended network IDs. First, the tunnel formation request page provided from the web server 147 of the gateway A 100A is used by the user of the private network A 200A to create a tunnel with the private network B 200B through the web browser 212 in the host A 210A. When the request is made, the gateway A 100A receiving the tunnel creation request between the private network A 200A and the private network B 200B is connected to the gateway B 100B from the DNS server 330 located in the Internet through the DNS processing unit 143. Obtain a public IP address (211.32.119.136).

Next, the gateway A 100A drives the HTIPD program in the HTIP processing unit 146A and requests the tunnel generation from the HTIP processing unit 146A 'of the gateway B 100B. The tunnel creation request message between private networks should be used instead of the VPN protocol to be used (eg L2TP), the network address of private network A (200A) (10.0.0.0/24), and the network address of private network A (200A) within the VPN tunnel. Network addresses (10.0.0.0/24, 10.0.1.0/24, 10.0.2.0/24, ...) are included. At this time, if the network addresses of the private network A (200A) and private network B (200B) is different, or if the network address of the private network A (200A) is not used to connect the private network B (200B) and the third private network by a VPN tunnel Since the NAT is not needed in the VPN tunnel, the address of private network A (10.0.0.0/24) is selected as it is.If the extended network addresses of private network A and private network B match, 10.0.1.0/24, 10.0.2.0 The available ones are selected from / 24, ....

When the gateway B 100B receives the private network tunnel creation request message from the gateway A 100A, the HTIP processing unit 146A transmits the tunnel creation response message between the private networks to the gateway A 100A. The response message includes the VPN protocol to be used (e.g., L2TP), the network address of private network B (200B) (10.0.1.0/24), and the network addresses to be used instead of the network address of private network B (200B) within the VPN tunnel. 10.0.1.0/24, 10.0.2.0/24, 10.0.3.0/24, ...), network address of private network A (200A) (10.0.0.0/24), network of private network A (200A) in VPN tunnel This includes the network address (10.0.0.0/24) to be used instead of the address.

The gateway A (100A) receiving the response message transmits the tunnel creation ACK between the private networks to the gateway B (100B). The ACK is used instead of the network address (10.0.0.0/24) of private network A (200A), the network address of private network B (200B) (10.0.1.0/24), and the network address of private network A (200A) within the VPN tunnel. Address (10.0.0.0/24), a network address (10.0.1.0/24) to be used instead of the network address of the private network B 200B in the VPN tunnel, and the like. At this time, if the address of the private network A (200A) and the network address to be used instead of the network address of the private network A (200A) in the VPN tunnel match, it means that NAT does not occur in the VPN tunnel, otherwise, NAT occurs. it means.

After sending and receiving an ACK message, private network connection management tables 132 and 132 'are generated in the gateway A 100A and the gateway B 100B, respectively. The private network connection management table 132 includes items indicating the domain name of the other gateway, the VPN protocol (L2TP) used, the tunnel ID between the private networks, whether the other gateway is a VPN server or a client, the network address of the private network A (200A), and the private network. The network address of B 200B, the network address to be used instead of the network address of private network A 200A in the VPN tunnel, the network address to be used instead of the network address of private network B 200B within the VPN tunnel, and the like.

Looking at the table generated by Gateway A (100A), the domain name (Gateway B) of Gateway B (100B), the item indicating that Gateway B is a VPN server (server), the network address of private network A (10.0.0.0/24) , The network address of Private Network B (10.0.1.0/24), the network address to use instead of Private Network A's network address within the VPN tunnel (10.0.0.0/24), and the network address to use instead of Private Network B's network address within the VPN tunnel. (10.0.1.0/24) and the like.

After receiving the ACK message, the gateway B 100B sets the VPN processing unit 146B 'as a VPN server to generate a VPN tunnel according to the VPN protocol to be used. When the VPN processing unit 146B 'is set as the VPN server and the preparation for creating the tunnel between the private networks is completed, the HTIP processing unit 146A' of the gateway B 100B sends a READY message indicating that preparation for creating the tunnel between the private networks is completed. To 100A. The READY message includes the VPN protocol used (L2TP), the network address of private network A (200A) (10.0.0.0/24), the network address of private network B (200B) (10.0.1.0/24), and the private network A to be used within the VPN tunnel. Network address (10.0.0.0/24) of the 200A, network address (10.0.1.0/24) of the private network B 200B to be used in the VPN tunnel, and the like.

After receiving the READY message, the gateway A 100A sets the VPN processing unit 146B as the VPN client of the gateway B 100B according to the VPN protocol to be used. When the HTIP processing unit 146A drives the VPN client, a VPN (L2TP) tunnel is created between the gateway A 100A and the gateway B 100B.

When the ACK signal and the READY signal are exchanged between the two private networks as above, a VPN tunnel is generated between the gateway A (100A) and the gateway B (100B), and from the host A (210A) to the end of the VPN tunnel of the gateway A (100A). The forwarded packet is delivered to the end of the VPN tunnel of gateway B (100B).

FIG. 10 is a signal flow diagram illustrating a packet transmission process between a host A 210A and a host B 210B through a tunnel formed between the private network A 200A and the private network B 200B by the process of FIG. 9. First, the user of the private network A (200A) knows the domain name of the host B (210A), the application installed in the host A (210A) is the gateway A to know the IP address corresponding to the domain name of the host B (210B) Send DNS inquiry to 100A. Then, the DNS processing unit 143 of the gateway A 100A first examines the private network connection management table 132. If a VPN tunnel is established between the private network A (200A) and the private network B (200B), the DNS query for the host B (210B) is sent to the gateway B (100B).

When the DNS query is transmitted from the gateway A 100A to the gateway B 100B as described above, the DNS processing unit 143 'of the gateway B 100B refers to the private network connection management table 132' of the host B 210B. Instead of the network address, the response message is transmitted to the gateway A 100A using the network address (10.0.1.5) indicating the host B 210B in the VPN tunnel. DNS query and response processes are omitted in the drawings.

Gateway A (100A) forwards the private IP address (10.0.1.5) responded to host B (210B) from DNS processing unit 143 'of gateway B (100B) to host A (210A). Host A 210A receives the private IP address of Host B 210B from Gateway A 100A, receives the received private IP address (10.0.1.5) for the destination address and the private address of Host A 210A for the source address. Enter the IP address (10.0.0.4) and send the packet to Gateway A (100A).

When a packet is received from the host A 210A, the gateway A 100A refers to the routing table 145 and the forwarding setting to the end of the VPN formed between the gateway A 100A and the gateway B 100B. The packet sent to the tunnel end of the gateway A 100A is delivered to the tunnel end of the gateway B 100B.

When the packet is delivered through the VPN tunnel, the gateway B 100B forwards the packet to the host B 210B with reference to the routing table 145 'and the forwarding setting.

Host B 210B processes the packet when it is received, and then returns the private IP address (10.0.1.5) of Host B 210B to the source address and the private IP address (10.0.0.4) of Host A 210A to the destination address. Send a response.

Thereafter, the host A 210A and the host B 210B repeat the packet forwarding process through the tunnel formed between the private network A 200A and the private network B 200B.

FIG. 11 is a signal flow diagram illustrating a process of forming a VPN tunnel of two private networks where extended network IDs match each other. First, the tunnel creation request page provided from the web server 147 of the gateway A 100A is created by the user of the private network A 200A in the tunnel with the private network B 200B through the web browser 212 in the host A 210A. In response to the request, the gateway A (100A) receiving the tunnel creation request between the private network A (200A) and the private network B (200B) from the DNS server 330 located in the Internet through the DNS processing unit 143 of the gateway B (100B) Obtain a public IP address (211.32.119.136). DNS query and response processes are omitted in the drawings.

Next, the gateway A (100A) having obtained the public IP address of the gateway B (100B) requests the HTIP processing unit (146A ') of the gateway B (100B) to create a private network tunnel by driving the HTIP program in the HTIP processing unit (146A). . The tunnel creation request message between private networks includes the VPN protocol (L2TP) to be used, the network address of private network A (200A) (10.0.0.0/24), and the network addresses to be used instead of the network address of private network A (200A) within the VPN tunnel. 10.0.0.0/24, 10.0.1.0/24, 10.0.2.0/24, ...).

When the HTIP processing unit 146A 'of the gateway B 100B receives the tunnel creation request from the gateway A 100A, the HTIP processing unit 146A' transmits a response message for the tunnel creation request between the private networks to the gateway A 100A. The response message includes the VPN protocol to be used (L2TP), the network address of private network B (200B) (10.0.0.0/24), and the network addresses (10.0.2.0/) to be used instead of the network address of private network B (200B) within the VPN tunnel. 24, 10.0.3.0/24, 10.0.4.0/24, ...), network address of private network A (200A) (10.0.0.0/24), used in place of network address of private network A (200A) within VPN tunnel The network address to be configured (10.0.1.0/24) is included.

When the gateway A 100A receives the response message from the gateway B 100B, the gateway A 100A sends a tunnel creation ACK between the private networks to the gateway B 100B. ACK is the VPN protocol to be used (L2TP), the network address of private network A (200A) (10.0.0.0/24), the network address of private network B (200B) (10.0.0.0/24), and private network A (100A) within the VPN tunnel. It includes a network address (10.0.1.0/24) to be used instead of the network address of the network address (10.0.2.0/24) to be used instead of the network address of the private network B (200B) in the VPN tunnel. Since the address of private network A (200A) and the network address to use instead of the network address of private network A (200A) in the VPN tunnel do not match, gateway A (100A) is assumed to use address translation by NAT protocol at both ends of VPN tunnel. Recognize.

After sending and receiving an ACK message, private network connection management tables 132 and 132 'are generated in the gateway A 100A and the gateway B 100B, respectively. Private network connection management table 132 is an item indicating whether the VPN protocol (L2TP), private network tunnel ID, the gateway name of the other gateway 100, the other gateway 100 is a VPN server or client, private network A (200A) Network address, private network B (200B) network address, network address to use instead of private network A (200A) network address within VPN tunnel, network address to use instead of network address of private network B (200B) within VPN tunnel, etc. It includes.

Looking at the table generated by the gateway A (100A), the VPN protocol (L2TP) to use, the domain name (gateway B) of the gateway B (100B), the item indicating that the gateway B is a VPN server (server), private network A (200A) Network address (10.0.0.0/24), network address of private network B (200B) (10.0.0.0/24), and network address (10.0.1.0/ to use instead of the network address of private network A (200A) within the VPN tunnel. 24) a network address (10.0.2.0/24), etc. to be used instead of the network address of the private network B 200B in the VPN tunnel.

After receiving the ACK message, the gateway B 100B sets the VPN processing unit 146B 'as a VPN server to generate a VPN tunnel according to the VPN protocol to be used. When the VPN processing unit 146B 'is set as the VPN server and the preparation for creating the tunnel between the private networks is completed, the HTIP processing unit 146A' of the gateway B 100B sends a READY message indicating that preparation for creating the tunnel between the private networks is completed. To 100A. The READY message includes the VPN protocol used (L2TP), the network address of private network A (200A) (10.0.0.0/24), the network address of private network B (200B) (10.0.0.0/24), and the private network A ( Network address (10.0.1.0/24) of the 200A, network address (10.0.2.0/24) of the private network B 200B to be used in the VPN tunnel, and the like.

After receiving the READY message, the gateway A 100A sets the VPN processing unit 146B as the VPN client of the gateway B 100B according to the VPN protocol to be used. When the HTIP processing unit 146A 'drives the VPN client, a VPN (L2TP) tunnel is created between the gateway A 100A and the gateway B 100B.

Through the above process, a VPN tunnel is formed between the gateway A (100A) and the gateway B (100B), and the packet transmitted to the end of the VPN tunnel of the gateway A (100A) is delivered to the end of the VPN tunnel of the gateway B (100B). .

When the creation and connection of the VPN tunnel is completed, the gateway A 100A sets up NAT on the gateway A 100A side of the VPN tunnel with reference to the private network connection management table 132. When NAT is set, when a packet is sent from the private network A (200A) through the gateway A (100A) to the VPN tunnel, the source address 10.0.0.x is converted to 10.0.1.x, and the packet is transferred from the VPN tunnel to Gateway A. When it passes over (100A) to private network A, the destination address 10.0.1.y is converted to 10.0.0.y. Gateway B also sets up NAT on the gateway B side of the VPN tunnel.

FIG. 12 is a signal flow diagram illustrating a packet forwarding process between the host A 210A and the host B 210B through the tunnel formed between the private network A and the private network B by the process of FIG. 11. First, the user of the private network A 200A knows the domain name of the host B 210B, and the application 214 installed in the host A 210A corresponds to the domain name of the host B 210B to the gateway A 100A. If a DNS query is sent to know the IP address, the DNS processing unit 143 of the gateway A 100A examines the private network connection management table 132. The VPN tunnel between the private network A (200A) and the private network B (200B). If this is set, NAT for the packet passing through the tunnel is recognized as necessary. Therefore, the gateway B 100B sends a DNS query to the gateway B to know the private IP address to be used in the VPN tunnel of the host B 210B. .

When the DNS processing unit 143 'of the gateway B 100B receives an inquiry about the host B 210B, the DNS processing unit 143' receives the IP address (10.0.2.5) used in the VPN tunnel of the host B 210B. Sends a response message, and gateway A (100A) retransmits it to host (A) 210A. DNS query and response processes are omitted in the drawings. Host A 210A then sends the packet to Gateway A (100A) to send the packet to Host B 210B. The destination address of the packet is 10.0.2.5 and the source address is 10.0.0.4. do.

When a packet destined for the host B 210B is received from the host A 210A, the gateway A 100A forwards the packet to the end of the tunnel of the gateway A 100A with reference to the routing table and the forwarding setting. Then, since NAT is set at the end of the VPN tunnel of Gateway A (100A), source address 10.0.0.4 is converted to 10.0.1.4, and the packet whose source address is converted through NAT is transmitted to the tunnel end of Gateway B (100B). .

Gateway B (100B) uses the NAT set at the VPN tunnel end of Gateway B (100B) to forward the destination address 10.0.2.5 to 10.0. Convert it to .0.5. The packet whose destination address is converted through NAT is forwarded to host B 210B by referring to the routing table and the forwarding configuration.

Thereafter, the host B 210B sends a response to the host A 210A, and communication is performed by repetition of the packet forwarding process.

FIG. 13 is a signal flow diagram illustrating a process of forming a VPN tunnel between two private networks when the extended network ID of private network A is included in the extended network ID of private network B. Referring to FIG. First, the tunnel formation request page provided by the web server 147 of the gateway A 100A is read by the user of the private network A 200A from the host A 210A through the web browser 212, and then the private network B 200B. If a request is made to create a tunnel, the gateway A (100A) receiving the tunnel creation request between the private network A (200A) and the private network B (200B) is a gateway from the DNS server 330 located in the Internet through the DNS processing unit 143. Obtain a public IP address of B (100B) (211.32.119.136). DNS query and response processes are omitted in the drawings.

Next, the gateway A (100A) having obtained the public IP address of the gateway B (100B) requests the HTIP processing unit (146A ') of the gateway B (100B) to create a private network tunnel by driving the HTIP program in the HTIP processing unit (146A). . Messages requesting tunnel creation between private networks include the VPN protocol to be used (L2TP), the network address of private network A (10.0.0.0/24), and the network addresses to be used instead of the network address of private network A in the VPN tunnel (10.0.0.0/24). , 10.0.1.0/24, 10.0.2.0/24, ...).

The HTIP processing unit 146A 'of the gateway B 100B receives the tunnel creation request message from the gateway A 100A and analyzes it. Since the network addresses (10.0.0.0/24, 10.0.1.0/24, ...) to be used in place of the network address of the private network A in the VPN tunnel are included in the network address of the private network B, the HTIP processing part of the gateway B 100B. 146A 'sends a NAK to gateway A 100A. In the NAK, the tunnel creation request message sent by Gateway A (100A) to Gateway B (100B) is the portion of the content that needs to be renegotiated (network addresses to be used in place of the network address of Private Network A in the VPN tunnel) and the network address (10.0) of Private Network B. .0.0 / 16).

After receiving the NAK from the gateway B 100B, the HTIP processing unit 146A of the gateway A 100A analyzes the contents of the NAK and resends the tunnel creation request between the private networks. The message requesting to create a tunnel between the private networks again includes the VPN protocol to be used (L2TP), the network address of private network A (10.0.0.0/24), and the network addresses to be used instead of the network address of private network A in the VPN tunnel (10.2.0.0/ 24, 10.2.1.0/24, ...).

When the tunnel creation request message is received from the gateway A 100A of the gateway B 100B, the HTIP processing unit 146A 'analyzes this and sends a tunnel creation response message between the private networks when appropriate. The response message includes the VPN protocol to be used (L2TP), the network address of private network B (200B) (10.0.0.0/16), and the network addresses (10.1.0.0/16) to be used instead of the network address of private network B (200B) within the VPN tunnel. , 10.2.0.0/16, ...), the network address of private network A (200A) (10.0.0.0/24), the network address to be used instead of the network address of private network A (200A) within the VPN tunnel (10.2.0.0/ 24) and the like.

When a response message is received from the gateway B 100B, the gateway A 100A analyzes it in the HTIP processing unit 146A, and if it is determined to be appropriate, sends the tunnel creation ACK between the private networks to the gateway B 100B. ACK is the VPN protocol to use (L2TP), the network address of private network A (200A) (10.0.0.0/24), the network address to use in place of the network address of private network A (100A) within the VPN tunnel (10.2.0.0/24), The network address (10.0.0.0/16) of the private network B 200B, the network address (10.1.0.0/16) to be used instead of the network address of the private network B 200B in the VPN tunnel, and the like. Since the address of the private network A 200A and the network address to be used instead of the network address of the private network A 200A in the VPN tunnel do not match, the gateway A 100A recognizes that NAT should be used.

After exchanging the ACK message, private network connection management tables 132 and 132 'are generated in the gateway A 100A and the gateway B 100B. Looking at the table 132 generated by the gateway A (100A), the VPN protocol (L2TP) used, the tunnel ID between the private network, the domain name of the gateway B (100B), the item indicating that the gateway B (100B) is a VPN server, Network address of private network A (10.0.0.0/24), network address of private network B (10.0.0.0/16), network address to use in place of network A's network address (10.2.0.0/24) within the VPN tunnel, VPN tunnel Contains the network address (10.1.0.0/16) to use in place of the network address of private network B.

After receiving the ACK message, the gateway B 100B sets the VPN processing unit 146B 'as a VPN server to generate a VPN tunnel according to the VPN protocol to be used. When the HTIP processing unit 146A 'of the gateway B 100B sets the VPN processing unit 146B' as a VPN server and is ready to create a tunnel between the private networks, the HTIP processing unit 146A 'of the gateway B 100B is a private network. A READY message indicating that the preparation for creating a tunnel is completed is transmitted to the gateway A 100A. The READY message includes the VPN protocol used (L2TP), the network address of private network A (200A) (10.0.0.0/24), the network address of private network B (200B) (10.0.0.0/16), and the private network A to be used within the VPN tunnel. The network address (10.2.0.0/24) of 200A, and the network address (10.1.0.0/16) of private network B 200B to be used in the VPN tunnel.

After receiving the READY message, the HTIP processing unit 146A of the gateway A 100A sets the VPN processing unit 146B as the VPN client of the gateway B 100B according to the VPN protocol to be used. When the HTIP processing unit 146A drives the VPN client, a VPN (L2TP) tunnel is created between the gateway A 100A and the gateway B 100B.

Through the above process, a VPN tunnel is formed between the gateway A 100A and the gateway B 100B. Thereafter, the packet delivered to the end of the VPN tunnel of the gateway A 100A is delivered to the end of the VPN tunnel of the gateway B 100B.

Next, after the creation and connection of the VPN tunnel is completed, the HTIP processing unit 146A of the gateway A 100A sets NAT on the gateway A 100A side of the VPN tunnel with reference to the private network connection management table 132. When NAT is set, when a packet is sent from VPN A through 100A to the VPN tunnel, the source address 10.0.0.x is converted to 10.2.0.x, and the packet is transferred from the VPN tunnel to Gateway A (100A). When it is sent to private network A, the destination address 10.2.0.y is converted to 10.0.0.y. Similarly, the HTIP processing unit 146A 'of the gateway B 100B also sets NAT on the gateway B 100B side of the VPN tunnel.

When NAT is set at both ends of the VPN tunnel formed between the gateway A (100A) and the gateway B (100B) as described above, the host A (210A) and the host B (210B) mutually through the data packet delivery process shown in FIG. Communication is possible.

Network connection device according to an embodiment of the present invention can be connected between the private network and public network or private network and private network to further expand the user's use network to facilitate the user's convenience in the home, the newly emerging home In addition to enabling more diverse communities with other home network users in the network, services that share devices or data between home networks become possible, which can contribute to the activation of the home network market. The shortage of IP addresses can be eliminated and the performance of the entire network can be improved.

In particular, the method proposed in another embodiment of the present invention is called a Home-to-Home Tunneling Initiation (HTIP) protocol. Since the HTIP protocol is used to exchange and negotiate information necessary to create a VPN tunnel between private networks in advance. It is possible to minimize the preset settings necessary for creating a VPN tunnel between private networks, and by using the negotiated information from the HTIP processor to control the VPN processor and NAT / NAPT processor, it is possible to use existing VPN protocols such as PPTP and L2TP without modification. Do. In addition, the HTIP protocol makes it possible to negotiate ahead of time so that network addresses used in existing VPN tunnels and network addresses of newly created VPN tunnels do not collide, thus allowing VPN tunnels to cross over two or more private networks. It is possible to form

Although the preferred embodiments of the present invention have been illustrated and described above, the present invention is not limited to the specific embodiments described above, and the present invention is not limited to the specific embodiments of the present invention without departing from the spirit of the present invention as claimed in the claims. Anyone skilled in the art can make various modifications, as well as such modifications are within the scope of the claims.

Claims (16)

At least one public network interface connected to the public network; At least one private network interface connected to the private network; And When a tunnel creation request message for a third party network connected to the public network is received from a host connected to the private network, a VPN tunnel is formed by communicating with a gateway of the third party network, and the network addresses of the private network and the third party network are the same or equal. If the private network includes the network addresses of the other private network, create a new network address table so that the two private networks use different network addresses in the VPN tunnel, and add the data packets transmitted from the host connected to the private network or the third party network. And a controller for converting and forwarding an address based on the new network address table. The method of claim 1, The control unit, A web server providing a tunnel creation request page to request a tunnel creation from a host connected to the private network; A private network DNS processing unit for obtaining a public IP (Internet Protocol) address of the third-party network gateway from a DNS (Domain Name Server) connected to the public network in response to a tunnel creation request of the host connected to the private network to the other private network; A virtual private network (VPN) processing unit operating as a server or a client according to the tunnel creation request transmitted through the public network interface or the tunnel creation request transmitted through the private network interface to form a tunnel with the requesting private network; And Convert a private IP address into a public IP address or convert a public IP address into a private IP address using a network address port translation (NAPT) protocol for data packets transmitted from the private network to the public network or from the public network to the private network. And a NAT / NAPT processing unit for converting a private IP address in the VPN tunnel using a NAT (Network Address Translation) protocol when the VPN tunnel is formed between the private network and the third-party network. Network connection device, characterized in that. The method of claim 2, The VPN processing unit transmits the tunnel creation request message to the third-party network gateway when the tunnel creation request for the third-party network is transmitted from the host connected to the private network, and transmits the tunnel creation request message to the tunnel creation request from the gateway of the third-party network. And receiving an acknowledgment, transmitting an ACK (Acknowledge) to the third-party network gateway. The method of claim 3, wherein The tunnel creation request message for the third-party network includes a network address of the private network and second network addresses to be used instead of the network address of the private network in the VPN tunnel. The method of claim 3, wherein When the VPN processing unit receives a tunnel request message including a network address of the third-party network and second network addresses to be used instead of the network address of the third-party network in the VPN tunnel from the third-party network, the network address of the private network, the second And a response message including a network address and third network addresses to be used in place of the network address of the private network in the VPN tunnel. The method of claim 2, The web server is a network connection device, characterized in that replaceable with a middleware server. The method of claim 1, The control unit, A web server providing a tunnel creation request page to request a tunnel creation from a host connected to the private network; A private network DNS processing unit for obtaining a public IP address of the third-party network gateway from a DNS connected to the public network in response to a tunnel creation request for the other private network of a host connected to the private network; HTIP (Home-to-) for transmitting / receiving a tunnel creation request message including a parameter required to form a tunnel with the requesting private network according to the tunnel creation request transmitted through the public network interface or the tunnel creation request transmitted through the private network interface Home Tunneling Initiation Protocol) processing unit; A virtual private network (VPN) processing unit operating as a server or a client under the control of the HTIP processing unit so as to form the tunnel with the request target private network; And Convert a private IP address into a public IP address or convert a public IP address into a private IP address using a network address port translation (NAPT) protocol for data packets transmitted from the private network to the public network or from the public network to the private network. NAT / NAPT for translating a private IP address in the VPN tunnel using a NAT (Network Address Translation) protocol when the VPN tunnel is formed between the private network and the third-party network, and an address translation is required. Network connection apparatus comprising a; processing unit. The method of claim 7, wherein The HTIP processing unit, when the tunnel creation request for the third party network is transmitted from the host connected to the private network, transmits the message to the third party network gateway, and the response to the tunnel creation request is transmitted from the gateway of the third party network. When received, the network access device, characterized in that for transmitting an ACK (Acknowledge) to the third-party network gateway. The method of claim 8, The variable included in the tunnel creation request message for the third party network includes a VPN protocol to be used when creating the tunnel, a network address of the private network, and second network addresses to be used instead of the network address of the private network in the VPN tunnel. Network connection device. The method of claim 8, When the HTIP processing unit receives a tunnel request message including a VPN protocol to be used when creating the tunnel, a network address of the third party network, and second network addresses to be used instead of the network address of the third party network in the VPN tunnel, The response message includes a VPN protocol to be used when creating the tunnel, a network address of a private network, third network addresses to be used instead of the network address of the private network in the VPN tunnel, a network address of the third party network, and the second network address. Network connection device, characterized in that the transmission to other companies. The method of claim 8, The HTIP processing unit, when the ACK is received from the other company's network, the VPN processing unit is set to the VPN server, the network connection device, characterized in that for transmitting the READY message indicating that the setting of the VPN processing unit is completed to the third party network. The method of claim 11, When the HTIP processing unit receives the READY message from the third party network, the HTIP processing unit sets the VPN processing unit as a VPN client for the VPN server of the third party network, and drives the VPN client to establish a VPN tunnel between the private network and the third party network. Network connection device, characterized in that for generating. The method of claim 8, The HTIP processing unit analyzes the tunnel creation request message or the response message received from the third-party network, and transmits a NAK message to the third-party network when the variable and the variable value included in the message are not appropriate. Network connection device characterized in that. The method of claim 13, When the HTIP processing unit receives the NAK message with respect to the tunnel creation request message or the response message transmitted to the third-party network, the HTIP processor newly sets a variable and a variable value included in the messages, and retransmits it to the third-party network. Network connection device, characterized in that. The method of claim 8, The HTIP processing unit may include a VPN protocol to be used when creating the tunnel, a network address of the private network, a second network address to be used instead of the network address of the private network in the VPN tunnel, a network address of the third party network, and the other private network in the VPN tunnel. By pre-negotiating variables including the third network address to be used instead of the network address of the network address, the network addresses used in the existing VPN tunnels and the network addresses used in the VPN tunnel do not conflict with each other. Network connection device, characterized in that to form a VPN tunnel with them. The method of claim 7, wherein The web server is a network connection device, characterized in that replaceable with a middleware server.