KR20140093042A - Communication method and device thereof - Google Patents

Abstract

The present invention relates to a method and an apparatus for communication between a plurality of devices. The apparatus receives a message from at least one device; converts address information contained in the received message if the received message is a request for connection to other devices which are disposed in an external network; and sends the message containing the converted address to the other device. In other words, the apparatus of present invention converts the address information of the sender whenever there is a new session request, thereby enabling to prevent intrusion from the outside.

Description

[0001] COMMUNICATION METHOD AND DEVICE THEREOF [0002]

The present invention relates to a communication method and apparatus, and more particularly, to a method and apparatus for blocking unauthorized intrusion, such as hole punching from an unauthorized external network.

Network Address Translator (NAT) is one of the ways to mitigate IP exhaustion, and it is an address translation function that allows the use of a private network as a global network. Since the number of Public Internet Protocols (IPs) of the Internet is limited, it is necessary to have a method for sharing them as many client devices or servers as possible. By converting private IP to public IP using NAT, IP sharing. Indeed, systems in private IP clusters generally communicate using private IP, and when it becomes necessary to connect to a global network, by translating their private IP through NAT into one of the public IPs previously secured by NAT, And to provide a way to communicate with the global network while maintaining the state.

On the other hand, NAT is a problem when one-to-one communication between clients such as Voice over Internet Protocol (VoIP), online game, P2P file sharing is required. In this case, it is possible to enable 1: 1 communication in a NAT environment with the help of a third party other than a client desiring one-to-one communication. Network Address Tranlation Traversal allows post-to-post 1: 1 communication with the help of a third party.

Of these, hole punching is one of the relay methods of client devices such as NAT traversal. Hole punching is a much more aggressive system-level relay than simply using NAT. Although NAT allows clients from inside the private network to be allowed, it also blocks other client connection requests from the outside, but hole punching allows the connection from the external network to the internal network by utilizing the working principle of NAT. do.

Hole punching allows external systems to directly access the system inside the cluster.

1 is a conceptual diagram of a network in which two client devices communicate using hole punching; Referring to FIG. 1, the client 1 and the client 2 exist in an internal network managed by different NAT devices A and B, respectively, and a server 10 exists between them in an external network. The server 10, NAT A and NAT B may exist in an external network of the same band, and a session may already be connected between the server 10 and the clients 1 and 2 for hole punching.

In the communication using the hole punching, the client 1 requests the server 10 to make a connection first. In this case, the NAT A converts the private IP of the client 1 into a public IP that is used in the external network 100. The server 10 which has received the connection request not only knows the private IP and public IP of the client 1 but also the port information of the client 1. In addition, the server 10 also receives a connection request from the client 2. The NAT B converts the private IP of the client 2 into the public IP, and the server 10 can know not only the public IP and the private IP of the client 2 but also the port information of the client 2. [ The server 10 transmits the public IP and port information of the client 2 to the client 1 and transmits the public IP and the port information of the client 1 to the client 2. [ Accordingly, the clients 1 and 2 can try to communicate. For example, when Client 1 first transmits a connection request to Client 2, NAT A creates an address translation table from Client 1 to Client 2. On the other hand, even if the NAT B receives the connection request from the client 1, the NAT B blocks the corresponding message since the corresponding address translation information does not exist in the NAT B table. That is, when the client 2 wants to transmit a connection request to the client 1, the NAT B can store the address conversion information from the client 1 to the client 2 in the table, and the NAT A can store the address conversion information generated between the client 1 and the client 2 The connection request from the client 2 is not intercepted and can be normally converted and transmitted to the client 1. Accordingly, the communication by the hole punching between the clients 1 and 2 can be performed. The hole punching process is a method of allocating address conversion information and ports, and various changes may occur depending on the network configuration, and may be performed by other methods depending on the program and communication environment between the server 10 and the clients. The server 10 may be a Rendezvous Server.

However, in the normal NAT method, the session is connected by changing only the IP address of the packet transmitted to the external network without changing the port. Accordingly, even if the client apparatuses of the external destination are different, the session information can be transmitted while the port information remains unchanged. For example, if the IP address (port number) of the client 1 in the internal network 101 managed by the NAT A is 1.1.1.1 (1000) and the IP address (port number) of the client 2 to which the client 1 wants to communicate is 2.2.2.1 (1000), the client 1 can transmit a connection request message to the client 2. In this case, the IP address (port number) of Client 1 reached to Client 2 can be converted to 3.3.3.1 (1000) by NAT A. Accordingly, the connection information of the client 1, 1.1.1.1 (1000) -> 3.3.3.1 (1000) can be recognized by the server 10, and when there is a request from the client 2, the server 10 transmits this information Hole punching is possible. That is, hole punching can be performed by using only the address information is converted and the port number is not changed during address conversion. That is, the server 10 stores conversion information of the IP address and the port number of the client 1 and the client 2, respectively, and assists in forming a session between the client 1 and the client 2. At this time, even if the conversion of the IP address commonly used in the external network and the internal network occurs due to NAT A and NAT B, the port information is maintained, so that the server 10 can perform the hole punching by using it. Hole punching is advantageous in terms of efficiency of one-to-one communication between client devices, but it results in an unprotected state from intrusion from outside unauthorized devices.

In order to solve the above-described problems, the present invention provides a communication method capable of changing port information even when packets of a new session pass through a network address translation device in order to prevent external intrusion such as hole punching.

A communication method between a plurality of devices according to an embodiment of the present invention includes: receiving a message from a first device; Converting the address information included in the received message if the received message is a connection request to a second device existing in an external network; And transmitting the message including the converted address to the second device.

An apparatus for performing communication between a plurality of devices according to an embodiment of the present invention includes: receiving a message from a first one of a plurality of devices; Converting the address information included in the received message if the received message is a connection request to a second device existing in an external network; And transmitting the message including the converted address to the second device.

According to the present invention, external intrusion is blocked, thereby enabling reliable communication.

1 is a conceptual diagram of a network in which two client devices communicate using hole punching;
2 shows a data flow between devices for a communication method according to an embodiment of the present invention.

DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS Hereinafter, preferred embodiments of the present invention will be described in detail with reference to the accompanying drawings. However, the detailed description of known functions and configurations incorporated herein will be omitted when it may unnecessarily obscure the subject matter of the present invention.

FIG. 2 shows a data flow between device 1 for a communication method according to an embodiment of the present invention. Referring to FIG. 2, the client 1 and the device 1 are in the same private network, and the device 1 performs the network address translation of the client 1. The device 1 may be a network interface controller or a network interface card capable of blocking hole punching from an external network according to an embodiment of the present invention and may be exemplified by the communication device of the present invention.

In step (1), the client 1 transmits a connection request message to the client 2 existing in the external network. The message requested to be connected may include 1.1.1.1 (1000) which is the address information (port number) of the client 1 and 2.2.2.1 (100) which is the client 2 address information of the destination, 1 < / RTI >

In step (2), the device 1 can convert the address information contained in the received message. In this case, address information about the client 1 that transmitted the message can be converted from 1.1.1.1 (1000) to 3.3.3.1 (4000) to port information. In addition, the device 1 can store the address conversion information in the address conversion table. The address information conversion of the device 1 can be performed each time a new connection request is made from the client device 1. Thus, even if there is a rendezvous server that recognizes the address conversion information of the device 1, it is impossible to access the client 1 from any device in the external network using only the address conversion information.

Next, in step (3), the converted message information can be received by the client 2 via the external network.

In step (4), the client 2 can perform the connection request to the client 1 with the address information of the pre-generated client 1 of 3.3.3.1 (4000). Since the connection request from the client 2 is a response message corresponding to the connection request message of the step (1), and the address conversion information for communication between the client 1 and the client 2 is already stored in the device 1, . At this time, the external address (3.3.3.1 (4000)) of the client 1 can be converted to the internal address (1.1.1.1 (1000)) by the device 1. By this way, subsequent communication between the client 1 and the client 2 is possible.

1, for example, the rendezvous server recognizes the address translation information (3.3.3.1 (4000) -> Rendezvous server) to the other client 3, which knows the address translation information at the time of connection between the client 1 and the client 2, 2.2.2.1 (1000)).

Prior to step (5), the client 3 requests the address and port information of the client 1 to the rendezvous server for communication with the client 1, and the rendezvous server transmits the address and port information of the client 3 to the client 1, This can lead to session 3 connection to client 3. In this case, a session connection from the client 1 to the client 3 is attempted, and a session conversion table between them can be created in the device 1.

In step (6), the client 3 having the IP address (port number) of 2.2.2.2 (1000) tries to access the client 1 with the address translation information delivered to the rendezvous server. In the prior art, since the address translation information received from the rendezvous server is valid, the session can be directly connected between the clients 1 and 3. However, since the device 1 has converted both the address and port information by the hole punching blocking function of the present invention, the address / port relayed by the rendezvous server to the client 3 matches the address and port information on the session table previously created by the device 1 The session will not be connected.

In step 7, when the device 1 receives the connection request message from the client 3, it confirms that the address is not in the session table and blocks the message. That is, even if the client 3 knows the address translation information of the client 1, all connection requests from the client 3 are blocked unless the connection request is first tried from the client 1.

That is, in the communication method and the like according to the embodiment of the present invention, even if the client 1 of the internal network requests the connection to the external network, the external network intercepts the connection request to the client 1 in any case. To this end, the device 1 performing the address conversion converts all the port information in the address translation of the client 1 included in the connection request message from the client 1. [ Thus, even if an external new client 3 knows the address translation information stored in the device 1, it can block the connection request from the client 3 to the client 1.

The communication method according to the embodiment of the present invention has been described above. The present invention can also be applied to a computer-readable recording medium for executing an electronic recording code recording the communication method of the present invention on a computer. Also, the scope of the present invention is also applicable to any device such as a NIC (Network Interface Card), a computer, a router, etc. on which the communication method of the present invention can be performed.

The preferred embodiments of the present invention have been described above. It is to be understood, however, that the invention is not limited to the disclosed embodiments, but, on the contrary, is intended to cover various modifications and alternative arrangements included within the spirit and scope of the appended claims. Of course.

Claims (8)

In a communication method between a plurality of devices,
Receiving a message from a first device;
Converting the address information included in the received message if the received message is a connection request to a second device existing in an external network; And
And transmitting a message including the translated address to the second device. The method according to claim 1,
Wherein the converting the address information comprises converting an IP address and a port number of the first device included in the connection request message. 3. The method of claim 2,
Wherein the conversion of the address information is performed each time a new connection request message is received from the first device. 6. The method of claim 5,
Further comprising storing address translation information,
And when receiving a message from the external network in the same session as the connection request message, transmitting the message to the first device based on the stored address translation information. An apparatus for performing communication between a plurality of devices,
Receiving a message from a first one of the plurality of devices;
Converting the address information included in the received message if the received message is a connection request to a second device existing in an external network; And
And transmitting a message including the converted address to the second device. 6. The method of claim 5,
Wherein the converting the address information comprises converting an IP address and a port number of the first device included in the connection request message. 3. The method of claim 2,
Wherein the conversion of the address information is carried out randomly each time a new connection request message is received. 6. The method of claim 5,
The communication device stores address conversion information according to the address conversion,
When receiving a message by the same session as the connection request message from the external network, transmits the message received by the first device based on the stored address translation information.

Images