WO2014148483A1

WO2014148483A1 - Dns server device, network machine, communication system, and communication method

Info

Publication number: WO2014148483A1
Application number: PCT/JP2014/057310
Authority: WO
Inventors: 秀岳荻野; 良太 ▲廣▼瀬
Original assignee: ヤマハ株式会社
Priority date: 2013-03-18
Filing date: 2014-03-18
Publication date: 2014-09-25
Also published as: JP6127622B2; CN105144642A; JP2014183415A; CN105144642B

Abstract

The purpose is to make it possible to achieve highly confidential data communication by using a VPN without forcing an excessive workload on a network machine user or a network manager. A DNS server device is made to execute a process in which network machines that store domain names and communication addresses in the managing table of a host device are grouped in upper domains, and each of the network machines in a group belonging to the plurality of network machines is notified of the communication addresses of other network machines belonging to the same group, the communication addresses being the communication addresses of a destination for establishing a virtual communication path.

Description

DNS server device, network device, communication system, and communication method

The present invention relates to a technique for ensuring the confidentiality of data communication by using a VPN (Virtual Private Network).

VPN refers to a communication technology that establishes a virtual communication path for encrypted communication between network devices such as routers via a general public network such as the Internet and ensures confidentiality of data communication. By using VPN, it is possible to secure the secrecy of data communication while suppressing costs compared to the case where a dedicated line is used for connection between network devices.

In order to secure the confidentiality of data communication by constructing a VPN, it is necessary to perform the work of setting the communication address of the network device at the other base that is the establishment destination of the virtual communication path to each network device without omission. Further, prior to the construction of the VPN, it is of course necessary to select each network device to participate in the VPN and to check the communication address of those network devices. Conventionally, these operations have been performed manually by the network administrator, and the work burden on the network administrator has been large. For this reason, various techniques for reducing the workload of such network managers have been proposed in the past, and examples thereof include the techniques disclosed in Patent Document 1 and Patent Document 2.

The technology disclosed in Patent Document 1 enables automatic construction of a VPN between bases by registering VPN connection device information in a VPN connection management device and authenticating the VPN connection device itself. More specifically, the network address of the VPN connection device and the identifier of the device are registered in the VPN connection management device, so that even if the IP (Internet Protocol) address of the VPN connection device changes, it is constructed. The VPN connection management device notifies the VPN connection device of information necessary for the VPN connection disconnection process and the reconnection process with the new IP address, and the VPN connection is automatically established. In the technique disclosed in Patent Document 2, a VPN for control is constructed by IPsec between a router installed at a base and a control server, and for VPN connection with a router installed at another base via the control VPN The setting is acquired from the control server, and the VPN is established in each router according to the VPN connection setting.

Japanese Unexamined Patent Publication No. 2006-166028 Japanese Unexamined Patent Publication No. 2005-012485

In the technique disclosed in Patent Document 1, it is necessary to select network devices (VPN connection devices) to participate in the VPN and register the information of the VPN connection devices in the VPN connection management device in advance. For this reason, the labor required for the selection work is not reduced. In the technique disclosed in Patent Document 2, it is necessary to construct a control VPN between a router installed at each base and a control server. For this reason, various information (password, etc.) for establishing a control VPN with the control server must be set in advance in the router at each site, and also for establishing a control VPN in the control server. Information must be set in advance. In other words, in the technique disclosed in Patent Document 2, a new work load is generated, and there remains a question as to whether the work load of the network administrator is reduced as a whole.

The present invention has been made in view of the above-described problems, and provides a technique that makes it possible to realize highly confidential data communication using a VPN while reducing the workload of a network administrator. With the goal.

In order to solve the above problems, the present invention has a management table in which one or a plurality of domain names assigned to a network device are stored in association with communication addresses assigned to the network device. In a DNS (Domain Name System) server device that provides a domain name service by referring to a network device whose domain name and communication address are stored in the management table, for each higher-order domain included in the domain name of each network device Grouping means for generating a plurality of groups, and among the plurality of groups generated by the grouping means, each of the network devices in the group to which the plurality of network devices belong Providing DNS server, characterized by having a establishing destination notifying means for performing established target notification process for notifying the other communication address of the network devices belonging to flop as communication address of establishment destination virtual channel.

* Various timings can be considered as to when the establishment destination notification process is executed. For example, a mode in which the establishment destination notification process is executed every time a set of a communication address and a domain name is registered in the management table is conceivable. According to such an aspect, each network device that participates in the VPN simply registers the domain name and communication address of its own device in the DNS server device, and the network administrator does not need to perform any other special work. A virtual communication path is established between network devices, and a VPN is constructed. In addition to (or instead of) executing the establishment destination notification process each time a set of a communication address and a domain name is registered in the management table, the network device belongs in response to a request from the network device. The establishment destination notifying unit may execute processing for notifying each network device belonging to the group of the communication address of another network device belonging to the same group as the communication address of the establishment destination of the virtual communication path. As another aspect of the present invention, an aspect of providing a program that causes a computer to function as the DNS server apparatus and each of the above-described means is also conceivable.

Here, in the case of constructing a full mesh VPN, the same group is assigned to each network device belonging to a group consisting of a plurality of network devices having the same upper domain excluding the device unique identifier from the domain name. The communication addresses of all the other network devices belonging to the network may be notified as the establishment destination of the virtual communication path. When a hub-and-spoke VPN is constructed, any of the network devices having the same upper domain Is selected as the center network device, and the communication address of all other network devices is notified as the establishment destination of the virtual communication path to the center network device, while each of these other network devices is notified. For example, the communication address of the center network device may be notified.Various modes can be considered as to how to select the center network device. For example, a mode in which the communication address is the smallest is selected as the center network device, and a mode in which the processing capability is the highest or the processing load is lightest is selected as the center network device.

In order to solve the above problems, the present invention is notified from the DNS server device by device information notifying means for notifying the DNS (Domain Name System) server device of the communication address and domain name assigned to the device itself. There is also provided a network device comprising virtual communication path establishing means for establishing a virtual communication path with the other network device based on a communication address of the other network device. If such network devices are installed at each base and connected to a general public network such as the Internet, and the DNS server device of the present invention is connected to the general public network, these network devices are grouped in a higher domain. Then, the communication address of the other network device belonging to the same group is notified as the communication address of the establishment destination of the virtual communication path to each network device belonging to the group including a plurality of network devices.

It is a figure which shows the structural example of the communication system 1 of embodiment of this invention. 1 is a block diagram illustrating a configuration example of a DNS server device 10 included in a communication system 1. FIG. An example of the management table 144b stored in the nonvolatile storage unit 144 of the DNS server device 10 is shown. The other example of the management table 144b stored in the non-volatile storage part 144 of the DNS server apparatus 10 is shown. An example (mesh-type VPN) of VPN network topology realized under the control of the DNS server device 10 is shown. 2 shows an example of a VPN network topology (hub-and-spoke VPN) realized under the control of the DNS server device 10. 2 is a block diagram illustrating a configuration example of

network devices

20A and 20B included in the communication system 1. FIG. 4 is a flowchart for explaining a communication flow in the communication system 1, and operations of the DNS server device 10, the network device 20A, and the network device 20B. An example of the management table 144b stored in the nonvolatile storage unit 144 of the DNS server device 10 after the above operation will be shown. It is a figure for demonstrating a modification (3). It is a table | surface for demonstrating a modification (3).

Hereinafter, embodiments of the present invention will be described with reference to the drawings.
(A: Configuration)
FIG. 1 is a diagram showing a configuration example of a communication system 1 according to an embodiment of the present invention.
The communication system 1 includes a DNS server device 10, a network device 20A, and a network device 20B. The DNS server device 10, the network device 20A, and the network device 20B are connected to a communication network 30 that is a general public network such as the Internet.

The DNS server device 10 provides DNS (Domain Name System; that is, a service that converts a domain name transmitted from a client device into an IP address of a network device to which the domain name is assigned and sends it back). It is a computer device that is operated and managed by a business operator. A domain name is a character string representing a name assigned to a network device and a character string indicating the name, type, nationality, etc. of an organization (company, school, public institution, etc.) that operates the network device. It is a character string obtained by concatenating via a delimiter (for example, a period). Hereinafter, a part representing the name of the network device in the domain name is referred to as a device unique identifier, and the other part is referred to as an upper domain.

The network device 20A and the network device 20B are routers that are operated and managed by an organization (a company in the present embodiment) that is a DNS user, and are installed at each base such as a head office or a branch of the company. Each of the network device 20A and the network device 20B connects a LAN (Local Area Network: not shown in FIG. 1) installed in the base where the device is installed to the communication network 30, thereby An in-house information system is formed. In this embodiment, by establishing a virtual communication path between the network device 20A and the network device 20B and constructing a VPN, the confidentiality of data communication in the in-house information system is ensured. In the present embodiment, the configurations of the network device 20A and the network device 20B are the same, and therefore, when there is no need to distinguish between the two, they are described as “network device 20”.

A global IP address (hereinafter simply referred to as “IP address”) uniquely indicating the network device in the communication network 30 is dynamically allocated to the communication interface unit on the communication network 30 side of the network device 20 by PPPoE. The network device 20 is given a domain name by a network administrator in the company. As described above, this domain name includes a device unique identifier unique to each network device 20 and an upper domain representing the name of an organization that owns the network device. This domain name and IP address are registered in the DNS server device 10 and are subject to DNS application. The feature of this embodiment is that the DNS server device 10 and the network device 20 execute processing unique to the present invention, so that a virtual communication path can be easily established between the network device 20A and the network device 20B, and VPN can be easily established. This is the point that can be constructed. Hereinafter, the DNS server device 10 and the network device 20 that remarkably show the features of the present embodiment will be mainly described.

FIG. 2 is a block diagram illustrating a configuration example of the DNS server device 10.
As shown in FIG. 2, the DNS server device 10 includes a control unit 110, a communication interface (hereinafter abbreviated as “I / F”) unit 120, a user I / F unit 130, a storage unit 140, and data between these components. A bus 150 that mediates transfer is included. The control unit 110 is, for example, a CPU (Central Processing Unit). The control unit 110 functions as a control center of the DNS server device 10 by executing the server program 144a stored in the storage unit 140 (more precisely, the nonvolatile storage unit 144). Details of processing executed by the control unit 110 in accordance with the server program 144a will be clarified later.

The communication I / F unit 120 is, for example, a NIC (Network Interface Card) and is connected to the communication network 30. The communication I / F unit 120 receives the data block transmitted from the communication network 30 and delivers it to the control unit 110, while sending the data block delivered from the control unit 110 to the communication network 30. An example of the data block is a packet transmitted / received according to IP. The user I / F unit 130 includes a display device such as a liquid crystal display and an input device such as a keyboard and a mouse. On the display device of the user I / F unit 130, an input screen for inputting a domain name or an IP address of a network device to which DNS is applied is displayed. The input device of the user I / F unit 130 is for allowing the operation manager to input various instructions and the domain name and IP address. In the present embodiment, both the display device and the input device are included in the user I / F unit 130, but either one (or both) of the input device and the display device is separately connected to the DNS server device 10. Of course, it is also good as an apparatus.

The storage unit 140 includes a volatile storage unit 142 and a nonvolatile storage unit 144 as shown in FIG. The volatile storage unit 142 is, for example, a RAM (Random Access Memory). The volatile storage unit 142 is used by the control unit 110 as a work area when executing various programs. The non-volatile storage unit 144 is, for example, a hard disk. The non-volatile storage unit 144 stores a server program 144a and a management table 144b.

FIG. 3A shows an example of the management table 144b. As shown in FIG. 3A, the management table 144b includes a device unique identifier and an upper domain included in the domain name of the network device, an IP address of the network device, and authentication of whether or not the DNS device is an application target. The passwords used in are stored in groups for each higher domain. In the present embodiment, the above-described DNS is provided based on the contents stored in the management table 144b. For example, when a packet for inquiring an IP address of a network device whose domain name is “router1.company.example.jp” is received from the client device, the DNS server device 10 receives the upper domain “company.example.jp”. And a packet in which the IP address ("AAAA" in the example shown in FIG. 3A) stored in the management table 144b in association with the device unique identifier "router1" is written in the payload portion is returned. And so on.

Registration of various information (upper domain, device unique identifier, IP address, and password) about one network device in the management table 144b is performed in stages as follows. Upon receiving an application for registration of a higher domain from a DNS user, the DNS operator has already registered a higher domain that is the same as the higher domain for which registration has been applied, or whether the higher domain submitted for registration is in violation of public order and morals. If the registration requirements are met, a password to be distributed to the user is generated. Then, the DNS operator writes the password and the upper domain in association with each other in the management table 144b, writes the password in a document notifying the completion of registration, and returns it to the registration applicant. Thereafter, the DNS server device 10 generates a domain name of the network device from the network device of the registration applicant (that is, a DNS user), the domain name, and the password using a predetermined one-way hash function. Each time a registration request packet in which an encrypted character string (hereinafter referred to as an authentication character string) is written in the payload portion is received, a device information registration process is executed. In this device information registration process, the control unit 110 first reads the domain name and the authentication character string written in the payload portion of the received registration request packet, and uses the domain name and the authentication character string to transmit the domain name. Authenticate. The specific contents of this authentication process will be made clear when the server program 144a is described. Then, when an authentication result indicating that DNS is applicable is obtained, the control unit 110 includes the device unique identifier included in the domain name and the transmission source address of the packet in the domain name. It is written in the management table 144b in association with the upper domain. As a result, all the information (device unique identifier, upper domain, and IP address) necessary for providing the DNS is provided, and the DNS can be provided for the network device having the information.

FIG. 3B shows another specific example of the management table 144b. In the management table 144b shown in FIG. 3B, the IP address and password information of the network device are stored in association with the domain name of the network device to which the DNS is applied, as in the general DNS server device. This is different from the management table 144b shown in FIG. 3A. As the management table 144b, either the configuration shown in FIG. 3A or the configuration shown in FIG. 3B may be used. In the present embodiment, the configuration shown in FIG. 3A is adopted. Further, although detailed illustration is omitted in FIG. 3A, the management table 144b also stores address range information in association with information related to the network device (that is, upper domain, device unique identifier, IP address, and password). . The address range information refers to information indicating a range of IP addresses uniquely assigned by the DNS server device as a range of IP addresses used in a LAN under the control of a network device.

The server program 144a is software for causing the control unit 110 to implement DNS. The control unit 110 reads the server program 144a from the non-volatile storage unit 144 to the volatile storage unit 142 and starts executing it when the power (not shown) of the DNS server device 10 is turned on. The control unit 110 operating according to the server program 144a executes four types of processing: domain registration processing, device information registration processing, address resolution processing, and establishment destination notification processing.

The domain registration process is a process for registering the high-order domain for which a registration application has been made by a DNS user and the password described above with an operation administrator or the like. The control unit 110 operating according to the server program 144a starts the processing when triggered by the instruction to start execution of the domain registration processing via the user I / F unit 130. In this domain registration process, the control unit 110 causes the display device to display an input screen for prompting the input of the upper domain and password information, and associates the upper domain and password information input via the user I / F unit 130 with each other. To the management table 144b. When the management table 144 having the configuration shown in FIG. 3B is used, the domain name including the device unique identifier is not registered with the DNS user, but the domain name and the password information are associated with each other. In this case, the control unit 110 may be caused to execute the process of writing to the management table 144b as the domain registration process.

As described above, the device information registration process is a process that is executed when the registration request packet is received via the communication I / F unit 120. When receiving the registration request packet via the communication I / F unit 120, the control unit 110 reads the domain name and the authentication character string written in the payload portion of the packet, and the network device that is the transmission source of the packet It authenticates whether or not the device is a DNS application target device.

Specifically, the control unit 110 searches the management table 144b using the upper domain included in the domain name read from the payload portion of the received registration request packet as a search key, and obtains a password corresponding to the upper domain. To do. Next, the control unit 110 generates an authentication character string from the domain name and the password using the above-described unidirectional hash function (that is, the same unidirectional hash function as that in the network device). The control unit 110 compares the authentication character string generated in this way with the authentication character string read from the payload part of the received registration request packet, and if they match, the source of the registration request packet is It authenticates that it is applicable to DNS. When the authentication result that the DNS application target is obtained, the control unit 110 is included in the transmission source address and the domain name written in the header part of the received registration request packet. The device unique identifier is written in the management table 144b in association with the corresponding higher domain and password pair. In the present embodiment, the management table 144b has the configuration shown in FIG. 3A. Therefore, by executing the device information registration process, the domain names and communication addresses of the network devices are grouped for each higher domain. Are stored in the management table 144b. That is, the server program 144b according to the present embodiment causes the control unit 110 to function as a grouping unit that performs the above grouping. When the management table 144b having the configuration shown in FIG. 3B is used, only the IP address may be registered in accordance with the authentication result. When the notification process is executed, it may be executed as a pre-process.

In the address resolution process, DNS (that is, a service that converts a domain name transmitted from a client device into an IP address of a network device to which the domain name is assigned and returns it) based on the stored contents of the management table 144b. It is a process to provide. Since this address resolution processing is not particularly different from that in the existing DNS server device, detailed description thereof is omitted.

The establishment destination notification process is a process that is executed every time a combination of a domain name and an IP address is registered in the management table 144b (in the present embodiment, every time device information registration process is executed). In this establishment destination notification process, the control unit 110 processes a group to which a plurality of network devices belong, and includes a group in which the number of network devices to which the change has occurred or a group in which device information has changed. The communication address of another network device belonging to the same group is notified as the communication address of the establishment destination of the virtual communication path to each of the network devices belonging to the processing target group. That is, the server program 144a of the present embodiment causes the control unit 110 to function as an establishment destination notifying unit that executes the establishment destination notifying process that significantly shows the features of the present embodiment. When the management table 144 having the configuration shown in FIG. 3B is used, after the device information registration process is executed, the establishment destination notification process is executed after grouping by the higher domain. It's fine

For example, when the stored contents of the management table 144b are as shown in FIG. 3A as a result of the address registration process being executed, the control unit 110 only allows the network device whose upper domain is “university.example.jp”. The establishment destination of the virtual communication path is notified for. This is because there is only one network device whose upper domain is “company.example.jp” and one network device whose upper domain is “club.example.jp”.

Here, various modes can be considered for the way of notifying the establishment destination of the virtual communication path to the network device whose upper domain is “university.example.jp”. For example, when constructing the mesh VPN shown in FIG. 4A, the IP addresses and address range information of all other network devices belonging to the same group may be notified to each network device. On the other hand, when the hub-and-spoke VPN shown in FIG. 4B is constructed, the network device that is the center of the VPN (in the example shown in FIG. 4B, the network device whose device unique identifier is place1) The IP address and address range information of all other network devices belonging to the same group are notified, and the IP address and address range information of the central network device are notified to each of these other network devices. You can do it.

Various methods can be considered for selecting a network device that is the center of a hub-and-spoke VPN. For example, a mode in which the IP address having the youngest address is selected or a mode in which the device unique identifier having the lowest dictionary order is considered. In addition to the domain name and password information, the network device 20 executes processing for writing information indicating the processing capability of the own device and information indicating the processing load applied to the own device in the payload portion of the registration request packet and transmitting the information to the network device 20 In the device information registration process, information indicating the processing capability (or processing load) is written in the management table 144b, and the one with the highest processing capability (or the one with the lightest processing load) is used as the center of the hub-and-spoke VPN. You may make it select.
The above is the configuration of the DNS server device 10.

Next, the configuration of the network device 20 will be described with reference to FIG.
As shown in FIG. 5, the network device 20 includes a control unit 210, a first communication I / F unit 220, a second communication I / F unit 230, a storage unit 240, and a bus 250 that mediates data exchange between these components. Is included. The control unit 210 is a CPU, like the control unit 110, and functions as a control center of the network device 20. Like the communication I / F unit 120, the first communication I / F unit 220 and the second communication I / F unit 230 are NICs. The first communication I / F unit 220 is connected to the communication network 30, and the second communication I / F unit 230 is connected to the LAN in the base where the network device 20 is installed. Similar to the storage unit 140, the storage unit 240 includes a volatile storage unit 242 and a nonvolatile storage unit 244.

The nonvolatile storage unit 244 stores a client program 244a. The client program 244a performs processing for realizing the original function of the network device 20 (in this embodiment, setting support processing for setting various parameters for performing data communication via the communication network 30 by a network administrator, etc., and packet This is a program for causing the control unit 210 to realize the transfer control processing based on the destination address of Specific examples of various parameters for performing data communication via the communication network 30 include an IP address of the DNS server device 10, a domain name (device unique identifier and higher domain) given to the network device 20, and a password. Can be mentioned. These parameters set in the setting support process are stored in the nonvolatile storage unit 244. The control unit 210 reads the client program 244a from the non-volatile storage unit 244 to the volatile storage unit 242 and starts executing it when the network device 20 is powered on (not shown). The control unit 210 operating according to the client program 244a executes device information transmission processing and virtual communication path establishment processing in addition to the setting support processing and transfer control processing.

The setting support processing is processing that is executed when a parameter setting instruction is given from another computer device (for example, a personal computer) connected to the LAN to which the network device 20 is connected. The process is a process executed when a packet is received via the first communication I / F unit 220 or the second communication I / F unit 230. Since the setting support processing and the transfer control processing are not particularly different from those in a general router, detailed description thereof is omitted.

The device information transmission process is a process that is executed when the transmission instruction for the registration request packet is given. About this transmission instruction | indication, what is necessary is just to give it via the said LAN from the other computer apparatus (for example, personal computer) connected to LAN with which the network apparatus 20 is connected. In this device information transmission process, the control unit 210 generates the registration request packet described above and sends it to the communication network 30 by the first communication I / F unit 220. In the header part of this registration request packet, the IP address of the DNS server device 10 is written as the transmission destination address, and the IP address assigned to the first communication I / F unit 220 by PPPoE or the like is written as the transmission source address. In the payload portion, character string data representing a domain name assigned to the network device 20 and a password are written.

The virtual communication path establishment process presents the IP address notified from the DNS server device 10 to the network administrator as the establishment destination of the virtual communication path, and various types used when establishing the virtual communication path with the establishment destination. This is a process of setting a parameter to a network administrator and establishing a virtual communication path according to the parameter. This virtual communication path establishment process is executed every time the DNS server apparatus 10 is notified of the IP address to which the virtual communication path is established, and is executed for each IP address when a plurality of IP addresses are notified. .
The above is the configuration of the network device 20.

(B: Operation)
Next, the operation of this embodiment will be described. In the operation example described below, the upper domain (company.example.jp) of the company that owns the network device 20A and the network device 20B has already been registered, and the device information of the network device 20A has also been registered. It is assumed that the management table shown in FIG. 3A is stored in the nonvolatile storage unit 144 of the server device 10. Hereinafter, a case where the device information of the network device 20B is registered under such a situation will be described. In the network device 20B, the IP address of the DNS server device 10, the domain name given to the network device 20B (router2.company.example.jp), and the password distributed by the DNS operator (by the setting support process described above) “Password”) is set, and “BBBB” has been set as the IP address of the first communication I / F unit 220 by PPPoE.

As shown in FIG. 6, the control unit 210 of the network device 20B executes a device information transmission process triggered by a registration request packet transmission instruction given by a network administrator or the like (step SA100). In this device information transmission processing, the control unit 210 of the network device 20B reads the domain name, password, IP address of the local device and the DNS server device 10 stored in the nonvolatile storage unit 244, and generates the above-described registration request packet. Then, the first communication I / F unit 220 transmits it to the communication network 30. As described above, the IP address of the DNS server device 10 is written as the transmission destination address and the IP address “BBBB” is written as the transmission source address in the header part of the registration request packet, The payload part includes a character string representing the domain name (router2.company.example.jp) of the network device 20B and an authentication character string generated by a one-way hash function using the domain name and password ("password"). And are written. In this way, the registration request packet transmitted from the network device 20B is routed by another network device included in the communication network 30, and reaches the DNS server device 10.

When the control unit 110 of the DNS server apparatus 10 receives the registration request packet via the communication I / F unit 120, the control unit 110 uses the domain name and password information included in the payload part of the registration request packet. Authentication is performed (step SB100). As described above, in this authentication process, the control unit 110 is stored in the management table 144b in association with the domain name included in the payload portion of the received registration request packet and the upper domain included in the domain name. Authentication of the transmission source of the registration request packet is performed by comparing the authentication character string generated by the one-way hash function with the password and the authentication character string included in the payload portion.

In this operation example, the domain name included in the payload portion of the registration request packet received by the control unit 110 from the network device 20B is “router2.company.example.jp”, and the upper level included in the domain name. The domain is “company.example.jp”. The authentication character string included in the payload portion is generated by a one-way hash function using the domain name and the password “password”. On the other hand, as shown in FIG. 3A, the password stored in the management table 144b in association with the upper domain “company.example.jp” is “password”. In the present embodiment, the same one-way hash function is used in the DNS server device 10 and the network device 20B. Therefore, in this operation example, the authentication character string included in the payload portion of the registration request packet received by the control unit 110 from the network device 20B matches the authentication character string generated in the authentication process. For this reason, the determination result in step SB100 is “Yes” (ie, authentication OK), and the control unit 110 executes device information registration processing (step SB110). As a result, the contents stored in the management table 144b are updated to the contents shown in FIG.

And the control part 110 performs the establishment destination notification process (step SB120) mentioned above. As a result of updating the storage contents of the management table 144b to the contents shown in FIG. 7, a group of network devices whose domain is “university.example.jp” and a network whose upper domain is “company.example.jp”. Each device group is a “group consisting of a plurality of network devices”. However, as apparent from a comparison between FIG. 3A and FIG. 7, the number of network devices belonging to the former group does not increase or decrease, and device information does not change. For this reason, only the latter group becomes the processing target group, and notification of the establishment destination of the virtual communication path is performed. To explain in more detail. As shown in FIG. 6, the network device 20A is notified of the IP address and address range information of the network device 20B, and the network device 20B is notified of the IP address and address range information of the network device 20A. . Then, in each of the

network devices

20A and 20B, a virtual communication path establishment process (Step SA110A and Step SA110B) is executed based on the information notified from the DNS server device 10, and virtual communication is performed between the

network devices

20A and 20B. A road is established.

As a result of the operations described above, a virtual communication path is established between the network device 20A and the network device 20B, and a VPN is constructed. The point to be noted here is that even when a new network device is introduced as in the above operation example, the selection of the network device to be the establishment destination of the virtual communication path and the communication device under each network device There is no need for the network administrator to perform tasks such as investigating the address range assigned to. For this reason, the network administrator can leave the construction of the environment to a user with poor network knowledge (for example, a general user who works at each site) even when the network device 20 is newly installed. In addition, since the setting of the existing base is automatically changed, it is not necessary for the network administrator to go to another base and change the setting when newly installing a network device.

Even when the IP address of the network device 20 changes due to a timeout of the PPPoE session or the like, a registration request packet is transmitted from the network device 20 when the IP address changes, and the management table 144b is updated. Since the establishment destination notification process is executed again, the VPN is automatically reconstructed even if the network administrator does not perform any special work.

(C: deformation)
Although one embodiment of the present invention has been described above, it goes without saying that the following modifications may be added to these embodiments.
(1) In the above embodiment, the communication system 1 includes two network devices (

network devices

20A and 20B), but it is needless to say that three or more network devices may be included. In the above embodiment, a case has been described in which network devices are grouped in a higher domain obtained by removing a device unique identifier from a domain name assigned to each network device. However, a domain that represents the name of an organization that owns these network devices. May be grouped using only The point is that the network device may be grouped by the domain name included in the domain name assigned to the network device.

(2) In the above embodiment, a group to which a plurality of network devices belong, and a group including a network device in which the number of network devices to which the change belongs or a change in device information is included is set as a processing target group. However, a group to which a plurality of network devices belong may be always set as a processing target group regardless of whether or not the number of network devices to which they belong has changed or whether or not device information has changed. In the above embodiment, the establishment destination notification process is executed by the control unit 110 in response to the execution of the device information registration process (that is, the update of the stored contents of the management table 144b), but the establishment destination notification process is executed. When the requested packet is received from the network device 20, the control unit 110 may be caused to execute the establishment destination notification process with the group to which the network device 20 belongs as the processing target group. In this case, the control unit 210 of the network device 20 may be caused to execute transmission of the packet in response to an instruction to transmit the packet by a network administrator or the like. (That is, periodically) the packet may be transmitted.

(3) In the above embodiment, the case where one domain name is assigned to one network device 20 has been described. However, a plurality of domain names are assigned to one network device 20, and one IP address is managed in association with the plurality of domain names (or a combination of a higher domain and a device unique identifier constituting each domain name). You may store in the table 144b. Even when a plurality of domain names are assigned to one network device 20, there is no particular problem in providing DNS (that is, conversion from a domain name to a communication address). In addition, by newly assigning a domain name including an upper domain different from the upper domain included in the already assigned domain name, a virtual communication path is established between VPNs having different upper domains, and a new VPN and The effect that it can be done is produced.

For example, the storage content of the management table 144b is the content shown in FIG. 7, and the domain name “place5.university.example.example.com” is received from the network device 20A under the situation where the hub-and-spoke VPN shown in FIG. jp ”and the registration request packet including the password information corresponding to the upper domain“ university.example.jp ”are received, the storage contents of the management table 144b are updated as shown in FIG. 8B. Based on the stored contents of the management table 144b, the VPN is reconstructed so as to additionally establish a virtual communication path indicated by a dotted line in FIG. 8A. In addition, by permitting such domain name registration for a certain period (for example, by causing the control unit 110 to execute a process of deleting the domain name after a certain period of time has passed since registration), the higher-level domain is set to “university. It is possible to perform data communication that ensures confidentiality between an organization that is “example.jp” and an organization whose upper domain is “company.example.jp”.

(4) In the above-described embodiment, a case has been described in which network devices whose domain names and IP addresses are stored in the management table 144b are grouped by those having a common upper domain, and a VPN is constructed for each group. However, when constructing a hub-and-spoke VPN, the upper domains are further grouped into subdomains. First, a VPN is constructed every time the subdomain is shared, and a virtual communication path is established between these VPNs. It may be established and integrated into one VPN.

(5) In the above-described embodiment, a server program that causes the control unit 110 of the DNS server device 10 to execute processing that significantly shows the features of the present invention is stored in the nonvolatile storage unit 144 in advance. However, the program may be distributed by writing it on a computer-readable recording medium such as a CD-ROM (Compact Disk Read Only), or may be distributed by downloading via a telecommunication line such as the Internet. good. By operating the computer according to the program distributed in this way, a general computer can be made to function as the DNS server device 10 of the above embodiment. Similarly, the client program 244a may be distributed by being written on a computer-readable recording medium, or may be distributed by downloading via a telecommunication line such as the Internet.

This application is based on a Japanese patent application filed on Mar. 18, 2013 (Japanese Patent Application No. 2013-055544), the contents of which are incorporated herein by reference.

According to the present invention, it is possible to realize highly confidential data communication using VPN while reducing the work load of the network administrator.

DESCRIPTION OF SYMBOLS 10 ... DNS server apparatus, 20A, 20B ... Network equipment, 110, 210 ... Control part, 120 ... Communication I / F part, 130 ... User I / F part, 220 ... 1st communication I / F part, 230 ... 2nd Communication I / F unit, 140, 240 ... storage unit, 142, 242, volatile storage unit, 144, 244 ... non-volatile storage unit, 150, 250 ... bus, 30 ... communication network.

Claims

A DNS (with a management table that stores one or a plurality of domain names assigned to the network device in association with a communication address assigned to the network device, and provides a domain name service with reference to the management table (Domain Name System) server device,
Grouping means for grouping network devices whose domain names and communication addresses are stored in the management table for each higher domain included in the domain name of each network device, and generating a plurality of groups;
Among the plurality of groups generated by the grouping means, for each of the network devices in the group to which the plurality of network devices belong, the communication address of the other network device belonging to the group is set as the establishment destination of the virtual communication path A DNS server device, comprising: establishment destination notifying means for executing establishment destination notification processing for notification as a communication address.
The DNS server device according to claim 1,
In response to a request from the network device, the establishment destination notifying unit notifies each network device in the group to which the network device belongs the communication address of the other network device as the communication address of the establishment destination of the virtual communication path. A DNS server device.
The DNS server device according to claim 1 or 2,
In the management table, the higher the processing capability of the network device in association with the communication address and domain name assigned to the network device, or the lower the processing load applied to the network device, the higher the priority. Ranking data is stored,
The establishment destination notifying means has a hub-and-spoke topology among the network devices belonging to the group set to construct a VPN (Virtual Private Network) having the highest priority indicated by the priority data. A DNS server apparatus, wherein a destination of establishment of a virtual communication path of each network device is determined so as to be central.
Device information transmission means for transmitting and storing a communication address and domain name assigned to the device itself to a DNS (Domain Name System) server device;
Virtual communication path establishment means for establishing a virtual communication path with the other network device based on the communication address of the other network device notified from the DNS server device;
A network device characterized by comprising:
The network device according to claim 4,
The device information transmitting means includes the communication address and the domain name in a registration request, and transmits the registration request to the DNS server device.
The network device characterized in that the virtual communication path establishment means receives a communication address of the other network device as a response to the registration request.
The network device according to claim 4 or 5, wherein
The device information transmitting means includes the communication address, the domain name, and the processing capability or processing load of the device itself in a registration request, and transmits the registration request to the DNS server device. machine.
A communication system having the DNS server device according to any one of claims 1 to 3 and having a plurality of network devices according to any one of claims 4 to 6.
A DNS (with a management table that stores one or a plurality of domain names assigned to the network device in association with a communication address assigned to the network device, and provides a domain name service with reference to the management table (Domain Name System) In a communication method in a server device,
Grouping network devices whose domain names and communication addresses are stored in the management table for each higher domain included in the domain name of each network device, generating a plurality of groups,
Among the generated plurality of groups, each of the network devices belonging to the group to which the plurality of network devices belong is notified of the communication address of the other network device belonging to the group as the communication address of the establishment destination of the virtual communication path. A communication method characterized by the above.
In a communication method in a network device,
The communication address and domain name assigned to the network device are transmitted to and stored in a DNS (Domain Name System) server device,
A communication method comprising establishing a virtual communication path with the other network device based on a communication address of the other network device notified from the DNS server device.