WO2015068255A1 - Système de réseau, dispositif de commande de communication et procédé de communication - Google Patents

Système de réseau, dispositif de commande de communication et procédé de communication Download PDF

Info

Publication number
WO2015068255A1
WO2015068255A1 PCT/JP2013/080211 JP2013080211W WO2015068255A1 WO 2015068255 A1 WO2015068255 A1 WO 2015068255A1 JP 2013080211 W JP2013080211 W JP 2013080211W WO 2015068255 A1 WO2015068255 A1 WO 2015068255A1
Authority
WO
WIPO (PCT)
Prior art keywords
user
vpn
network
packet
address
Prior art date
Application number
PCT/JP2013/080211
Other languages
English (en)
Japanese (ja)
Inventor
雅毅 山田
芽衣 高田
雄次 對馬
Original Assignee
株式会社 日立製作所
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 株式会社 日立製作所 filed Critical 株式会社 日立製作所
Priority to PCT/JP2013/080211 priority Critical patent/WO2015068255A1/fr
Priority to JP2015546220A priority patent/JPWO2015068255A1/ja
Publication of WO2015068255A1 publication Critical patent/WO2015068255A1/fr

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L12/00—Data switching networks
    • H04L12/28—Data switching networks characterised by path configuration, e.g. LAN [Local Area Networks] or WAN [Wide Area Networks]
    • H04L12/46—Interconnection of networks
    • H04L12/4633—Interconnection of networks using encapsulation techniques, e.g. tunneling
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L61/00—Network arrangements, protocols or services for addressing or naming
    • H04L61/09—Mapping addresses
    • H04L61/25—Mapping addresses of the same type
    • H04L61/2503—Translation of Internet protocol [IP] addresses
    • H04L61/2514—Translation of Internet protocol [IP] addresses between local and global IP addresses
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L61/00—Network arrangements, protocols or services for addressing or naming
    • H04L61/09—Mapping addresses
    • H04L61/25—Mapping addresses of the same type
    • H04L61/2503—Translation of Internet protocol [IP] addresses
    • H04L61/2592—Translation of Internet protocol [IP] addresses using tunnelling or encapsulation

Definitions

  • the present invention relates to a network system, a communication control device, and a communication method.
  • an apparatus for routing a packet from a gateway to an endpoint communicates with an addressing element that associates a private address with an endpoint having a public IP address, and the endpoint's
  • a receiver that intercepts a packet that is to be sent to a private address, and a policy that communicates with the receiver and receives the packet and transmits the packet to the endpoint in response to a policy applied to the packet Communicating with an engine, the receiver, the policy engine, and the addressing element, performing network address translation on the packet, and sending the packet to the endpoint is described.
  • cloud services The use of cloud computing services (hereinafter referred to as cloud services) is progressing for the purpose of reducing initial introduction costs, realizing cooperation between sites, and realizing fault switching in virtualization.
  • cloud services individual user sites that want to use the cloud services under a common information infrastructure across multiple user sites while ensuring security, and want to use information from a bird's-eye view as a whole user site There is a need to provide services for managers by integrating information between them.
  • a cloud service provider side network (hereinafter referred to as cloud side NW 51) in the cloud site 2 such as a data center, and the user site 3 are used.
  • cloud side NW 51 a cloud service provider side network
  • a user side network (hereinafter referred to as a user side NW52) existing in the network is connected by VPN (VPN: [Virtual: Private] Network).
  • the present invention has been made based on such a background.
  • a network system capable of using a cloud service under a common information infrastructure across a plurality of user sites while ensuring security, and communication. It is an object to provide a control device and a communication method.
  • One of the present invention that solves the above problems is a server device connected to a provider network that is a communication network of a provider site that provides an information processing service, and a communicable connection to the provider network via the Internet
  • a user device that connects to a user side network that is a communication network of a user site that uses the information processing service, accesses the server device and uses the information processing service, and a provider side that connects to the provider network
  • the user-side second address translation device comprises: When receiving a request packet, which is a packet for requesting use of the information processing service, from the user device to the server device via the user-side network, the request packet includes the request packet according to a preset conversion rule.
  • the source address described in the private address of the user side network set in the header used for communication in the user side network is converted into the source address expressed in the private address of the provider side network, and the user
  • the side VPN device transmits a VPN packet encapsulating the converted request packet to the providing side VPN device via the Internet via the VPN communication, and the providing side VPN device transmits the VPN packet.
  • the VPN packet Decapsulates the preparative acquires the request packet, transmitting the request packet acquired, to the server apparatus via the providing-side network.
  • FIG. 1 is a diagram illustrating a schematic configuration of a network system 1.
  • FIG. 6 is a diagram illustrating a flow of a request packet until a request packet transmitted from a user device 30 is received by the server device 20.
  • FIG. FIG. 10 is a diagram for explaining a flow of response packets until a response packet transmitted from the server device 20 is received by the user device 30.
  • 4 is an example of a conversion table 400. It is a figure which shows the main function of the user side GW apparatus 31, and the main information which the user side GW apparatus 31 memorize
  • FIG. 1 shows a schematic configuration of a network system 1 (information processing system) described as an embodiment.
  • the network system 1 is installed in a cloud site 2 (providing site) such as a data center in order to provide a cloud computing service (hereinafter also referred to as “cloud service”) as an information processing service.
  • cloud service a cloud computing service
  • Device groups information processing devices, communication network devices, etc.
  • device groups information processing devices, communication network devices, etc.
  • the cloud service is, for example, an ASP service (Application Service Provider Service), SaaS (Software as a Service), PaaS (Platform as a Service), or the like.
  • the cloud site 2 includes a server device 20 that realizes a cloud service, a cloud side VPN device 21 (providing side VPN device), and a cloud side NAT device 22 (providing side address translation device).
  • the server device 20 is an information processing device (computer) including a central processing unit (CPU, MPU), a storage device (memory (ROM, RAM, etc.), a hard disk drive, an SSD (Solid State Drive), etc.), and a communication device. is there.
  • an operating system software that provides a virtualization platform, and various applications (DBMS (Data Base Management System), various Web services, etc.) operate.
  • DBMS Data Base Management System
  • the cloud site 2 has a network on the provider side of the cloud service (provider network) (hereinafter also referred to as “cloud side NW 51”), to which the server device 20 and the cloud side VPN device 21 are connected.
  • the cloud-side NW 51 is, for example, a LAN (Local Area Network), a WAN (Wide Area Network), or the like, and can perform communication conforming to TCP / IP.
  • the server device 20 sends a packet requesting the use of a cloud service (hereinafter also referred to as “request packet”) sent from the user device 30 via a user-side NW 52, the Internet 5, and the cloud-side NW 51, which will be described later. ) Is executed, the cloud service specified in the request packet is executed, a packet including the execution result and processing completion notification (hereinafter also referred to as “response packet”) is generated, and the request packet is generated. To the user device 30 that is the source of the transmission.
  • a cloud service hereinafter also referred to as “request packet”
  • the cloud side VPN apparatus 21 realizes VPN communication (VPN: “Virtual” Private ”Network) via the Internet 5.
  • the cloud-side VPN apparatus 21 adds authentication information, encrypts, and encapsulates the packet to be transmitted to the Internet 5 (hereinafter, this series of processing is also referred to as “VPN encapsulation”).
  • the cloud-side VPN apparatus 21 performs decapsulation, decryption, and authentication processing (hereinafter, this series of processing is also referred to as “VPN decapsulation”) for the packet received from the Internet 5.
  • the cloud side NAT device 22 (NAT: Network Address Translation) is connected to the Internet 5 and connected to the cloud side VPN device 21 so as to be communicable, and functions as a relay device for connecting the cloud side NW 51 and the Internet 5.
  • the cloud-side NAT device 22 performs mutual conversion between a global IP address in the Internet 5 and a private address (also referred to as “local address”) in the cloud-side NW 51 for packets transmitted and received via the Internet 5. That is, the cloud side NAT device 22 converts the global IP address set in the packet received from the Internet 5 into the private address of the cloud side NW 51. In addition, the cloud side NAT device 22 converts the private address of the cloud side NW 51 set in the packet received from the cloud side VPN device 21 into a global IP address.
  • the cloud-side VPN device 21 and the cloud-side NAT device 22 may be realized as the same hardware. For example, they can be replaced with a gateway device having both functions.
  • a plurality of cloud side VPN devices 21 and cloud side NAT devices 22 may be provided for the purpose of load distribution and ensuring availability.
  • the term “NAT” includes the meaning of so-called “NAPT” (NAPT (Network Address Port Translation)) that converts the port number in addition to the IP address.
  • the user site 3 has a network on the user side of the cloud service (hereinafter also referred to as “user side NW 52”), and the user device 30 and the gateway device (hereinafter referred to as “user side GW device”) using the cloud service. 31 ”) and the user side first NAT device 32 (user side first address translation device) are connected.
  • the user side NW 52 is, for example, a LAN, a WAN, or the like, and can perform communication complying with TCP / IP.
  • the user device 30 is an information processing device (computer) including a central processing unit (CPU, MPU), a storage device (memory (ROM, RAM, etc.), hard disk drive, SSD, etc.), and a communication device.
  • CPU central processing unit
  • ROM read-only memory
  • RAM random access memory
  • SSD solid state drive
  • an operating system and an application operate to provide the user of the user device 30 with a cloud service usage environment.
  • the user device 30 transmits a request packet to the user side GW device 31 and receives a response packet from the user side GW device 31.
  • the user side GW apparatus 31 includes a user side VPN apparatus 311 and a user side second NAT apparatus 312 (user side second address translation apparatus).
  • the user-side VPN device 311 and the user-side second NAT device 312 may be realized as a plurality of independent hardware connected so as to be communicable, or may be realized by common hardware.
  • the user-side VPN device 311 realizes VPN communication via the cloud-side VPN device 21 and the Internet 5.
  • the user-side VPN device 311 performs VPN encapsulation on the request packet transmitted to the Internet 5 and performs VPN encapsulation release on the response packet received from the Internet 5.
  • the user-side second NAT device 312 is set in a header used for communication of the user-side NW 52 of a request packet transmitted from the user device 30 to the server device 20 in accordance with a conversion rule that is set and stored in advance.
  • the transmission source address and the transmission destination address expressed by the private address are converted into the transmission source address and the transmission destination address expressed by the private address in the cloud side NW 51.
  • the second NAT device 312 on the user side sets the source address and the destination address described in the private address in the cloud side NW 51, which are set in the header of the response packet sent from the server device 20, in the user side NW 52. It is converted into a source address and a destination address expressed as private addresses.
  • the user-side second NAT device 312 transmits the source address represented by the private address in the cloud-side NW 51 in the request packet transmitted from the user device 30 to the server device 20. Since the destination address is set, the cloud side NW 51 can make the request packet appear to the server device 20 as if it was sent from the information processing apparatus connected to the cloud side NW 51.
  • the request packet transmitted from the user device 30 connected to each user-side NW 52 is transmitted with a private address in the cloud-side NW 51 so as not to overlap between the user devices 30 Since the original address is set, different user-side NWs 52 can use a common cloud service.
  • the user-side second NAT device 312 is installed at each user site 3 by a cloud service provider, for example, and the conversion rules are set by the cloud service provider. For this reason, the service operated at the user site 3 can be easily and inexpensively transferred to the cloud service without forcing the user device 30 or the user-side first NAT device 32 to introduce new software or change settings. be able to.
  • the user-side first NAT device 32 shown in FIG. 1 functions as a relay device that connects the user-side NW 52 and the Internet 5.
  • the user-side first NAT device 32 performs mutual conversion between a global IP address of the Internet 5 and a private address of the user-side NW 52 for a packet transmitted / received via the Internet 5.
  • the user-side first NAT device 32 may exist on the Internet provider side, for example.
  • the user-side GW device 31 and the user device 30 have an equal relationship. That is, the user-side first NAT device 32 performs the above-described mutual conversion without distinguishing whether the other party that transmits and receives a packet is the user-side GW device 31 or the user device 30. This means that if there is an existing NAT device that relays between the Internet 5 and the user site 3 at the user site 3, that NAT device can be used as the first NAT device 32 on the user side. If it is not necessary for the user site 3 to provide the function of the user-side first NAT device 32 to other than the cloud service user, the user-side first NAT device 32 is not connected to the user-side NW 52. 32 may be directly connected to the user-side GW apparatus 31.
  • the source IP address, the destination IP address, the source port number, and the destination port number set in the header of the packet are referred to as “SIP”, “DIP”, “ Also referred to as “Sport” and “Dport”.
  • the contents of the header of the packet described below can be acquired, for example, by connecting a network analyzer (Network Analyzer) to the key points of the cloud side NW 51, the Internet 5, and the user side NW 52 and performing packet analysis. .
  • Network Analyzer Network Analyzer
  • the network address used in the cloud side NW 51, the Internet 5, and the user side NW 52 is IPv4 (Internet Protocol version 4)
  • IPv4 Internet Protocol version 4
  • the communication method type of communication protocol
  • the network system 1 of the present embodiment is not limited to this, but is an IPv6 (Internet Protocol version 6) -compliant address, MAC address (Media Access Control Address), MPLS (Multi-Protocol Label Labeling) label, etc.
  • IPv6 Internet Protocol version 6
  • MAC address Media Access Control Address
  • MPLS Multi-Protocol Label Labeling
  • the user apparatus 30 requests that “SIP: 192.168.0.10”, “DIP: 192.168.0.129”, “Sport: 10000”, “Dport: 1500” are set in the header. It is assumed that the packet 101 is transmitted to the second NAT device 312 on the user side.
  • “SIP: 192.168.0.10” is a private address assigned to the user device 30 in the user-side NW 52
  • “DIP: 192.168.0.129” is assigned to the user-side second NAT device 312 in the user-side NW 52. Is a private address.
  • the user device 30 transmits a request packet in which the private address of the user-side second NAT device 312 is set as a header (S111).
  • the user device 30 sets the private address “DIP: 192.168.0.1” of the user-side first NAT device 32 in the header of the packet and sends it to the user NW 52. Send.
  • “Sport: 10000” set in the header of the request packet is a value arbitrarily selected by the user device 30 (a value other than the well-known port is selected). It is given by the application for using the operating cloud service.
  • “Dport: 1500” is a port number corresponding to the cloud service that the request packet 101 requests to use.
  • the user device 30 an application operating on the user device 30
  • the user-side second NAT device 312 converts the combination of the private address and port number in the user-side NW 52 specified in the header of the request packet 101 received from the user device 30 to the private address and port in the cloud-side NW 51. Conversion into a combination of numbers (S112).
  • the user-side second NAT device 312 sets “SIP: 192.168.0.10” to “SIP: 10.0.0.20”, which is a private address in the cloud-side NW51, and “DIP: 192.168.0.129” to the cloud.
  • the private address of the server device 20 on the side NW 51 is converted to “DIP: 10.0.0.10”, “Sport: 10000” to “Sport: 20000”, and “Dport: 1500” to “Dport: 1024”, respectively. .
  • “Sport: 20000” set in the header of the request packet 102 is a port number uniquely assigned to the combination of “SIP: 192.168.0.10” and “Sport: 10000” of the packet 101 transmitted by the user device 30. It is.
  • the second NAT device 312 on the user side stores in the conversion table 400 the correspondence between the combination of “SIP: 192.168.0.10” and “Sport: 10000” and “Sport: 20000”.
  • the user side second NAT device 312 receives the response packet to the request packet, based on the port number “Sport: 20000”, the user side second NAT device 312 receives “SIP: 192.168.0.10” and “Sport” of the user device 30 that transmitted the request packet. : 10000 "is specified, and a response packet is transmitted to the corresponding user device 30.
  • “Dport: 1024” is a port number corresponding to the cloud service to be used, and is a port number for the server device 20 to identify the cloud service.
  • “Dport: 1500” designated by the user device 30 is automatically converted into a port number for the server device 20 to identify the cloud service in accordance with the conversion rule. This means that, for example, if the port number system on the server device 20 side is changed, it is only necessary to update the conversion rule, and the cloud service port number system is not affected. Can be changed.
  • the user-side VPN apparatus 311 VPN-encapsulates the request packet 102 converted by the user-side second NAT apparatus 312 and transmits it to the user-side first NAT apparatus 32 via the user-side NW 52 (S113).
  • the user side VPN apparatus 311 includes “SIP: 192.168.0.130”, “DIP: 210.0.”
  • a VPN header In the header of the request packet 103 encapsulated in VPN (hereinafter referred to as a VPN header). “0.100”, “Sport: 25000”, and “Dport: 1194” are set.
  • SIP: 192.168.0.130 is a private address assigned to the user-side VPN apparatus 311 in the user-side NW 52.
  • DIP: 210.0.0.100 is a global IP address on the Internet 5 assigned to the cloud side NAT device 22.
  • Sports: 25000 is a port number arbitrarily given by the user-side VPN apparatus 311. This “Sport: 25000” is used when, for example, a plurality of user-side VPN devices 311 are provided in the same user site 3 for the purpose of load distribution, ensuring availability, and the like. Used as an identifying identifier.
  • Dport: 1194 is a well-known port assigned to the VPN service.
  • the first NAT device 32 on the user side transmits the request packet encapsulated in VPN by the user side VPN device 311 to the cloud side NAT device 22 via the Internet 5 (S114).
  • the first NAT device 32 on the user side includes “SIP: 96.50.0.20”, “DIP: 210.0.0.100”, “Sport: 40000” in the header of the request packet 104 transmitted to the Internet 5.
  • “SIP: 96.50.0.20” is the global IP address assigned to the first NAT device 32 on the user side on the Internet 5 (if the cloud side VPN device 21 is directly connected to the Internet 5, the cloud side VPN It may be the global IP address of the device 21).
  • “Sport: 40000” a value arbitrarily selected by the user-side first NAT device 32 (a value other than the well-known port is selected) is set.
  • the first NAT device 32 on the user side stores the correspondence between the combination of “SIP: 10.0.0.130” and “Sport: 25000” of the request packet 103 and the assigned “Sport: 40000”. For example, the user-side first NAT device 32 uses this correspondence when a response packet to the request packet 104 is received.
  • the cloud side NAT device 22 When the cloud side NAT device 22 receives the request packet 104 via the Internet 5, the cloud side NAT device 22 converts the global IP address set in the request packet 104 into the private address of the cloud side NW 51, and converts the converted request packet 105 into the cloud It transmits to the cloud side VPN apparatus 21 via the side NW 51 (S115).
  • the cloud side NAT device 22 sends the global IP address “SIP: 96.50.0.20” set in the header of the request packet 104 received via the Internet 5 to the cloud side NAT device 22 in the cloud side NW 51. It is converted to "SIP: 10.0.0.15" which is the private address that has been set.
  • “DIP: 210.0.0.100” is converted to “DIP: 10.0.0.130” set in the cloud side VPN device 21 in the cloud side NW 51.
  • the cloud side VPN device 21 When the cloud side VPN device 21 receives the request packet 105 from the cloud side NAT device 22, the cloud side VPN device 21 performs VPN decapsulation on the request packet 105, and transmits the request packet 106 after the VPN encapsulation is released to the server device 20 via the cloud side NW 51. (S116). As shown in the figure, “SIP: 10.0.0.20”, “SIP: 10.0.0.10”, “Sport: 20000” in the header of the request packet 106 transmitted from the cloud side VPN device 21 to the server device 20, and “Dport: 1024” is the same as the header of the request packet 102 generated by the user-side second NAT device 312 previously.
  • the server apparatus 20 executes the cloud service for the request packet 106 shown in FIG. 2, a response packet in which the header transmission / reception relationship of the request packet 106 is inverted as its response packet That is, the response packet 201 in which “SIP: 10.0.0.10”, “DIP: 10.0.0.20”, “Sport: 1024”, and “Dport: 20000” are set in its header is transmitted to the cloud side VPN apparatus 21 (S211). ).
  • the server device 20 uses, for example, the physical address (for example, MAC address) set in the request packet 106 in the L2 layer (the data link layer (second layer) of the OSI (Open Systems Interconnection) reference model) on the cloud side.
  • the user site 3 (user-side NW 52) where the user-side second NAT device 312 serving as the destination of the response packet 201 exists is specified.
  • the server device 20 uses the cloud side VPN in the L3 layer (network layer (third layer) of the OSI reference model).
  • the user site 3 (user side NW 52) where the user side second NAT device 312 serving as the destination of the response packet exists is specified.
  • the cloud side VPN device 21 VPN-encapsulates the response packet 201, and transmits the response packet 202 after the VPN encapsulation to the cloud side NAT device 22 (S212).
  • SIP: 10.0.0.130 “DIP: 10.0.0.15”, “Sport: 1194”, and “Dport: 30000” are set in the VPN header.
  • SIP: 10.0.0.130 is a private address assigned to the cloud side VPN device 21 in the cloud side NW 51
  • “DIP: 10.0.0.15” is assigned to the cloud side NAT device 22 in the cloud side NW 51.
  • “Sport: 1194” is a well-known port assigned to the VPN service.
  • “Dport: 30000” is a port number arbitrarily given by the cloud side VPN apparatus 21. This port number is, for example, an identifier that identifies each cloud-side VPN device 21 when a plurality of cloud-side VPN devices 21 are provided in the same cloud site 2 for the purpose of load distribution, ensuring availability, etc. Used as
  • the cloud side NAT device 22 transmits the response packet 202 encapsulated by the cloud side VPN device 21 to the user side first NAT device 32 via the Internet 5 (S213).
  • the cloud side NAT device 22 includes “SIP: 210.0.0.100”, “DIP: 96.50.0.20”, “Sport: 1194” in the header of the response packet 203 transmitted to the Internet 5.
  • SIP: 210.0.0.100” is a global IP address assigned to the cloud side NAT device 22 on the Internet 5.
  • “DIP: 96.50.0.20” is a global IP address assigned to the first NAT device 32 on the user side on the Internet 5.
  • “Sport: 1194” is a well-known port assigned to the VPN service.
  • “Dport: 40000” is a value set by the first NAT device 32 on the user side when the request packet 104 is transmitted.
  • the user side first NAT device 32 When the user side first NAT device 32 receives the response packet 203 via the Internet 5, the user side first NAT device 32 converts the global IP address set in the response packet 203 into the private address of the user side NW 52, and converts the converted response packet 204 into It transmits to the user side VPN apparatus 311 via the user side NW52 (S214).
  • the first NAT device 32 on the user side sets “SIP: 192.168.0.1”, “DIP: 10.0.0.130”, “Sport: 1194”, “Dport: 25000” in the header of the response packet 204. Yes.
  • “SIP: 192.168.0.1” is a private address assigned to the user-side first NAT device 32 in the user-side NW 52.
  • “DIP: 10.0.0.130” is a private address assigned to the user-side VPN apparatus 311 in the user-side NW 52.
  • “Sport: 1194” is a well-known port assigned to the VPN service.
  • “Dport: 25000” is set based on the content stored in the first NAT device 32 at the time of transmission of the request packet 104.
  • the user-side first NAT device 32 stores the correspondence between the combination of “SIP: 10.0.0.130” and “Sport: 25000” of the request packet 103 and “Sport: 40000” assigned to the request packet 104.
  • the first NAT device 32 on the user side obtains a combination of “SIP: 10.0.0.130” and “Sport: 25000” based on “Dport: 40000” of the response packet 203.
  • the user-side VPN apparatus 311 cancels the VPN encapsulation of the response packet 204 received by the user-side first NAT apparatus 32, and transmits the response packet 205 after the VPN encapsulation cancellation to the user-side second NAT apparatus 312 (S215).
  • the user-side second NAT device 312 Upon receiving the response packet 205, the user-side second NAT device 312 receives the combination of “SIP: 192.168.0.10” and “Sport: 10000” stored when converting the request packet 101 into the request packet 102, and “Sport: 20000”. 2 and the conversion rule, the reverse conversion to S112 in FIG. 2 is performed to convert the header of the response packet 205, and the converted response packet 206 is transmitted to the user apparatus 30 (S216). As shown in the figure, the second NAT device 312 on the user side sends a response packet 206 in which “SIP: 192.168.0.129”, “DIP: 192.168.0.10”, “Dport: 1500”, and “Sport: 10000” are set in the header. This is generated and transmitted to the user device 30.
  • FIG. 4 is an example of the conversion table 400 stored in the user-side GW apparatus 31.
  • the above-described conversion rule includes an algorithm or a table set so as to generate the result of the conversion table 400.
  • the user-side second NAT device 312 (user-side GW device 31) cloud the combination of the private address and port number in the user-side NW 52 specified in the header of the new request packet received from the user device 30 according to the conversion rule.
  • the result is stored in the conversion table 400.
  • Each record of the conversion table 400 includes a user-side IP address 411 that is a private address in the user-side NW 52 of the user device 30 that has transmitted the received request packet, and a cloud-side IP address that is a private address used by the cloud-side NW 51 for the request packet.
  • 412 includes a user-side port number 413 that is a port number set in the received request packet, and a cloud-side port number 414 that is a port number used by the cloud-side NW 51 for the request packet.
  • the cloud-side port number 414 corresponds to the type of cloud service, and different user-side port numbers 413 are associated with different cloud-side port numbers 414.
  • the conversion rule is set to give a unique cloud-side IP address 412 for each user device 30. Thereby, the uniqueness (uniqueness) of the request packet is ensured in the cloud side NW 51, and the user devices 30 belonging to different user side NWs 52 can simultaneously access the same cloud service.
  • the conversion rule may be set so that the same cloud-side IP address 412 is associated with different user-side IP addresses 411 (in the conversion table 400 of FIG. 4, a plurality of user-side IP addresses 411 “192.168. 0.10 ”and“ 192.168.0.11 ”are converted to the same cloud-side IP address 412“ 10.0.0.20 ”).
  • FIG. 5 shows main functions of the user-side GW apparatus 31 and main information (data, table) stored in the user-side GW apparatus 31.
  • the two devices of the user-side VPN device 311 and the user-side second NAT device 312 provided in the user-side GW device 31 are not distinguished.
  • at least one of the user-side second NAT devices 312 is stored.
  • the user side GW apparatus 31 provides an interface for maintaining packet control information.
  • the packet control information can be set, for example, via a user interface (for example, an input device (keyboard, mouse, etc.), a display device (liquid crystal monitor, etc.)) provided in the user side GW device 31.
  • the packet control information is transmitted to the user-side NW 52 by sending an update instruction (for example, an information update packet described later) from the information processing device (maintenance terminal or the like) connected to the cloud-side NW 51 to the user-side GW device 31, for example.
  • This can be set by transmitting an update instruction (for example, an information update packet to be described later) from the information processing apparatus (management terminal or the like) to be connected to the user side GW apparatus 31.
  • the information processing apparatus (such as a maintenance terminal) connected to the user side GW apparatus 31, the cloud side NW 51, and the information processing apparatus (such as a management terminal) connected to the user side NW 52 have, for example, a screen for accepting setting of packet control information. While displaying on a display device (liquid crystal display or the like), the setting contents of packet control information and an update instruction are accepted.
  • a display device liquid crystal display or the like
  • the user-side GW apparatus 31 includes an input / output port A351 and an input / output port B352. These are all communication ports provided in the user-side GW device 31 (for example, communication ports provided in a NIC (Network Interface Card)).
  • a packet transmitted from the user device 30 arrives at the input / output port A351, and a packet addressed to the user device 30 is transmitted.
  • a packet transmitted from the server device 20 arrives at the input / output port B352, and a packet addressed to the server device 20 is transmitted.
  • the private address (for example, “192.168.0.129” in FIG. 2 or FIG. 3) of the user-side second NAT device 312 is given to the input / output port A351.
  • the private address (for example, “192.168.0.130” in FIG. 2 or FIG. 3) of the user-side VPN device 311 is given to the input / output port B352.
  • the user-side GW apparatus 312 is connected to the user-side NW 52 through two communication ports.
  • the user-side GW apparatus 312 is connected to the user-side NW 52 and only one communication port. Even when connected with 3 or more communication ports, it is equivalent to the function described in the present embodiment in the user side GW device 31 by appropriately converting the network address and port number. It can have the function of.
  • the packet determination unit 353 shown in the figure is whether the packet arriving at the input / output port A351 is a request packet or a packet for updating packet control information (hereinafter referred to as an information update packet). Determine.
  • the packet determination unit 353 transmits the request packet to the NAT conversion unit 354.
  • the packet determination unit 353 sends the request packet to the information update processing unit 356 shown in FIG.
  • the information update packet is transmitted.
  • the packet determination unit 353 determines whether the packet received at the input / output port B 352 is a response packet or an information update packet.
  • the packet determination unit 353 transmits the response packet to the NAT conversion unit 354 shown in the figure. If it is an information update packet, the packet determination unit 353 transmits the information update packet to the information update processing unit 356.
  • the transmission of the information update packet from the cloud site 2 to the user side GW apparatus 31 may be performed by the above-described VPN communication or may be performed using another authentication method. Alternatively, a dedicated physical line connecting the cloud site 2 and the user site 3 may be prepared so that the information update packet may be transmitted from the cloud site 2 to the user side GW device 31.
  • the information update processing unit 356 Upon receiving the information update packet from the packet determination unit 353, the information update processing unit 356 updates the packet control information (at least one of the conversion rule 361, the VPN control information 362, and the VPN destination information 363) according to the content. .
  • the information update packet received at the input / output port A351 is, for example, transmitted from an information processing apparatus (maintenance terminal or the like) connected to the user side NW52, and the information update packet received at the input / output port B352 is The information is transmitted from the information processing apparatus (management terminal or the like) of the cloud site 2 via the Internet 5.
  • the NAT conversion unit 354 sets the combination of the private address and port number in the user-side NW 52 that is set in the request packet sent from the packet determination unit 353 according to the conversion rule 361, and the private address and port number in the cloud-side NW 51. Convert to a combination of In addition, the NAT conversion unit 354 converts the combination of the private address and port number in the cloud side NW 51 set in the response packet sent from the server device 20 according to the conversion rule 361 into the private address and port number in the user side NW 52. Convert to a combination. As described above, the NAT conversion unit 354 records the conversion content (result) in the conversion table 400. The NAT conversion unit 354 transmits the converted request packet to the VPN processing unit 355, and transmits the converted response packet to the input / output port A351.
  • the VPN processing unit 355 searches the VPN control information 362 using “SIP” before conversion by the NAT conversion unit 354, which is set in the header of the request packet received from the NAT conversion unit 354, as a key.
  • the control method (priority 612, VPN method 613) is acquired. Note that the “SIP” of the request packet before conversion is notified from the NAT conversion unit 354 to the VPN processing unit 355 at any time, for example.
  • the VPN processing unit 355 searches for the cloud site side port number 711 of the VPN destination information 363 using “Sport” set in the header of the request packet converted by the NAT conversion unit 354 as a key, and thereby the cloud site side
  • the global IP address 712 is acquired.
  • the VPN processing unit 355 encapsulates the request packet in accordance with the acquired control method, sets the acquired global IP address in the header “DIP” of the VPN-encapsulated request packet, and sets it from the input / output port B352. Send. On the other hand, the VPN processing unit 355 cancels the VPN encapsulation of the response packet received at the input / output port B 352 and transmits the response packet after the VPN encapsulation cancellation to the packet determination unit 353.
  • FIG. 6 shows an example of the VPN control information 362 stored in the user side GW apparatus 31.
  • the VPN control information 362 is composed of a plurality of records including items of the user side IP address 611, the priority 612, and the VPN method 613.
  • the priority 612 and the VPN method 613 are merely examples of parameters for controlling QoS (Quality of Service) at the time of VPN encapsulation, and the types of parameters for determining the control method of VPN encapsulation are limited to this. Absent.
  • QoS Quality of Service
  • FIG. 7 shows an example of the VPN destination information 363 stored in the user-side GW apparatus 31.
  • the VPN destination information 363 includes a plurality of records including items of a cloud site side port number 711 and a cloud site side global IP address 712.
  • a port number used by the server device 20 to identify the cloud service is set.
  • the global IP address of the cloud-side NAT device 22 (when the cloud-side VPN device 21 is connected to the Internet 5, the global IP address of the cloud-side VPN device 21) is set in the cloud site-side global IP address 712.
  • the plurality of cloud site-side global IP addresses 712 exist because, for example, a plurality of cloud sites 2 and cloud-side NAT devices 22 are provided for the purpose of load distribution and ensuring availability. Further, there may be a case where a plurality of global IP addresses are virtually assigned to the cloud side VPN apparatus 21 or a case where a plurality of VLANs are constructed.
  • the cloud site-side global IP address 712 may change dynamically.
  • FIG. 8 is a flowchart for explaining processing performed by the user side GW apparatus 31 when a packet arrives at the input / output port A351 of the user side GW apparatus 31.
  • the packet determination unit 353 determines whether the received packet is an information update packet or a request packet (S812). When the incoming packet is an information update packet (S812: information update packet), the packet determination unit 353 transmits the information update packet to the information update processing unit 356 (S813). When the incoming packet is a request packet (S812: request packet), the packet determination unit 353 transmits the request packet to the NAT conversion unit 354 (S821).
  • the information update processing unit 356 receives the information update packet from the packet determination unit 353, the packet update information (at least one of the conversion rule 361, the VPN control information 362, and the VPN destination information 363) according to the content of the information update packet. Is updated (S814). Thereafter, the process returns to S811.
  • the NAT conversion unit 354 uses “SIP” and “Sport” set in the request packet in the cloud side NW 51 in accordance with the conversion rule 361.
  • the request packet after conversion is transmitted to the VPN processing unit 355 (S822).
  • the VPN processing unit 355 When the VPN processing unit 355 receives the request packet from the NAT conversion unit 354, the VPN processing unit 355 searches the VPN control information 362 using “SIP” of the request packet before conversion in S823 as a key, and performs control for the request packet at the time of VPN encapsulation. A method is acquired (S823).
  • the VPN processing unit 355 searches the VPN destination information 363 using the “Sport” of the converted request packet in S823 as a key, and the global IP address on the cloud site 2 side that is the destination of the request packet, that is, the cloud side NAT device 22 (if the cloud side VPN device 21 is directly connected to the Internet 5, the global IP address of the cloud side VPN device 21) is acquired (S824).
  • the VPN processing unit 355 VPN-encapsulates the request packet based on the control method acquired in S823, and transmits the request packet after VPN encapsulation from the input / output port B352 to the global IP address acquired in S824. (S825). Thereafter, the process returns to S811.
  • the user side GW apparatus 31 When the packet arrives at the input / output port A351 of the user side GW apparatus 31, the user side GW apparatus 31 operates as described above.
  • FIG. 9 is a flowchart for explaining processing performed by the user-side GW apparatus 31 when a packet arrives at the input / output port B352 of the user-side GW apparatus 31.
  • the VPN processing unit 355 When a packet arrives at the input / output port B 352 (S911), the VPN processing unit 355 first decapsulates the received packet, and transmits the packet after the decapsulation of the VPN to the packet determination unit 353 (S912).
  • the packet determination unit 353 determines whether the packet is an information update packet or a response packet (S913). When the incoming packet is an information update packet (S913: information update packet), the packet determination unit 353 transmits the information update packet to the information update processing unit 356 (S914). If the incoming packet is a response packet (S913: response packet), the packet determination unit 353 transmits the response packet to the NAT conversion unit 354 (S921).
  • the information update processing unit 356 receives the information update packet from the packet determination unit 353, the packet update information (at least one of the conversion rule 361, the VPN control information 362, and the VPN destination information 363) according to the content of the information update packet. Is updated (S915). Thereafter, the process returns to S911.
  • the NAT conversion unit 354 When the NAT conversion unit 354 receives the response packet from the packet determination unit 353, the NAT conversion unit 354 searches the conversion table 400 using “DIP” and “Dport” set therein as a key, and the cloud side NW 51 set in the response packet. "DIP” and “Dport” are converted into “DIP” and “Dport” of the user-side NW 52 (S922). Then, the NAT conversion unit 354 transmits the converted response packet to the corresponding user device 30 from the input / output port A351 (S923). Thereafter, the process returns to S911.
  • the user side GW apparatus 31 When the packet arrives at the input / output port B352 of the user side GW apparatus 31, the user side GW apparatus 31 operates as described above.
  • the present invention is not limited to the embodiments described above, and includes various modifications.
  • the above-described embodiments have been described in detail for easy understanding of the present invention, and are not necessarily limited to those having all the configurations described.
  • a part of the configuration of one embodiment can be replaced with the configuration of another embodiment, and the configuration of another embodiment can be added to the configuration of one embodiment.
  • each of the above-described configurations, functions, processing units, processing means, and the like may be realized by hardware by designing a part or all of them with, for example, an integrated circuit.
  • each of the above-described configurations, functions, and the like may be realized by software by interpreting and executing a program that realizes each function by a central processing unit (processor).
  • Information such as programs, tables, and files for realizing each function can be stored in a recording device such as a memory, a hard disk, and an SSD, or a recording medium such as an IC card, an SD card, and a DVD.
  • control lines and information lines indicate what is considered necessary for the explanation, and do not necessarily indicate all the control lines and information lines of the product to which the present invention is applied.
  • NAT device names of network devices such as “NAT device”, “gateway device (GW device)”, and “VPN device” in the above description are merely for convenience, and these devices are devices specialized for each function. It can also be configured, or can be configured as a device having a plurality of functions. In addition, an equivalent function may be incorporated in a router device, a switch device, an information processing device, or the like.

Abstract

Le problème décrit par l'invention est de permettre l'utilisation d'un service collectif sous une plate-forme d'informations commune encadrant plusieurs sites d'utilisateur tout en sécurisant la sécurité. La solution selon l'invention porte sur, lorsqu'un second dispositif NAT côté utilisateur (312) d'un NW (52) côté utilisateur reçoit, d'un dispositif d'utilisateur (30), un paquet de requête de service de traitement d'informations par le biais d'un NW (52) côté utilisateur, l'adresse de source de transmission notée en tant qu'adresse privée du NW (52) côté utilisateur de l'en-tête du paquet de requête est convertie en une adresse de source de transmission notée en tant qu'adresse privée d'un NW (51) côté collectif conformément à des règles de conversion prédéfinies. Un dispositif de VPN (311) côté utilisateur transmet le paquet de requête de post-conversion à un dispositif de VPN (21) côté collectif au moyen d'une communication VPN par le biais de l'Internet (5). Le dispositif de VPN (21) côté collectif désencapsule les paquets de VPN reçus pour faire l'acquisition de paquets de requête et les transmet à un dispositif d'utilisateur (20) par le biais d'un NW (51) côté collectif.
PCT/JP2013/080211 2013-11-08 2013-11-08 Système de réseau, dispositif de commande de communication et procédé de communication WO2015068255A1 (fr)

Priority Applications (2)

Application Number Priority Date Filing Date Title
PCT/JP2013/080211 WO2015068255A1 (fr) 2013-11-08 2013-11-08 Système de réseau, dispositif de commande de communication et procédé de communication
JP2015546220A JPWO2015068255A1 (ja) 2013-11-08 2013-11-08 ネットワークシステム、通信制御装置、及び通信方法

Applications Claiming Priority (1)

Application Number Priority Date Filing Date Title
PCT/JP2013/080211 WO2015068255A1 (fr) 2013-11-08 2013-11-08 Système de réseau, dispositif de commande de communication et procédé de communication

Publications (1)

Publication Number Publication Date
WO2015068255A1 true WO2015068255A1 (fr) 2015-05-14

Family

ID=53041057

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/JP2013/080211 WO2015068255A1 (fr) 2013-11-08 2013-11-08 Système de réseau, dispositif de commande de communication et procédé de communication

Country Status (2)

Country Link
JP (1) JPWO2015068255A1 (fr)
WO (1) WO2015068255A1 (fr)

Cited By (7)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
JP2016086232A (ja) * 2014-10-23 2016-05-19 西日本電信電話株式会社 クラウド交換機システム及びゲートウェイ装置とゲートウェイプログラム
JP2020205590A (ja) * 2016-08-27 2020-12-24 ニシラ， インコーポレイテッド ネットワーク制御システムのパブリッククラウドへの拡張
US11343229B2 (en) 2018-06-28 2022-05-24 Vmware, Inc. Managed forwarding element detecting invalid packet addresses
US11374794B2 (en) 2018-08-24 2022-06-28 Vmware, Inc. Transitive routing in public cloud
KR102512037B1 (ko) * 2022-12-27 2023-03-20 주식회사엔투솔루션 게이트 서버를 이용한 양방향 통신 시스템
US11695697B2 (en) 2017-08-27 2023-07-04 Nicira, Inc. Performing in-line service in public cloud
US11792138B2 (en) 2016-08-27 2023-10-17 Nicira, Inc. Centralized processing of north-south traffic for logical network in public cloud

Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
JP2001016255A (ja) * 1999-06-29 2001-01-19 Nippon Telegr & Teleph Corp <Ntt> ネットワーク間通信方法及びその装置
JP2006279771A (ja) * 2005-03-30 2006-10-12 Sanyo Electric Co Ltd パケット伝送方式およびパケット伝送プログラム
JP2009017429A (ja) * 2007-07-09 2009-01-22 Fujitsu Ltd ネットワーク中継制御プログラム、ネットワーク中継制御装置、ネットワーク中継制御方法
JP2010157857A (ja) * 2008-12-26 2010-07-15 Ntt Communications Kk Ｖｐｎ接続装置、パケット制御方法、及びプログラム

Patent Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
JP2001016255A (ja) * 1999-06-29 2001-01-19 Nippon Telegr & Teleph Corp <Ntt> ネットワーク間通信方法及びその装置
JP2006279771A (ja) * 2005-03-30 2006-10-12 Sanyo Electric Co Ltd パケット伝送方式およびパケット伝送プログラム
JP2009017429A (ja) * 2007-07-09 2009-01-22 Fujitsu Ltd ネットワーク中継制御プログラム、ネットワーク中継制御装置、ネットワーク中継制御方法
JP2010157857A (ja) * 2008-12-26 2010-07-15 Ntt Communications Kk Ｖｐｎ接続装置、パケット制御方法、及びプログラム

Cited By (10)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
JP2016086232A (ja) * 2014-10-23 2016-05-19 西日本電信電話株式会社 クラウド交換機システム及びゲートウェイ装置とゲートウェイプログラム
JP2020205590A (ja) * 2016-08-27 2020-12-24 ニシラ， インコーポレイテッド ネットワーク制御システムのパブリッククラウドへの拡張
JP7009014B2 (ja) 2016-08-27 2022-01-25 ニシラ， インコーポレイテッド ネットワーク制御システムのパブリッククラウドへの拡張
JP2022058523A (ja) * 2016-08-27 2022-04-12 ニシラ， インコーポレイテッド ネットワーク制御システムのパブリッククラウドへの拡張
JP7190595B2 (ja) 2016-08-27 2022-12-15 ニシラ， インコーポレイテッド ネットワーク制御システムのパブリッククラウドへの拡張
US11792138B2 (en) 2016-08-27 2023-10-17 Nicira, Inc. Centralized processing of north-south traffic for logical network in public cloud
US11695697B2 (en) 2017-08-27 2023-07-04 Nicira, Inc. Performing in-line service in public cloud
US11343229B2 (en) 2018-06-28 2022-05-24 Vmware, Inc. Managed forwarding element detecting invalid packet addresses
US11374794B2 (en) 2018-08-24 2022-06-28 Vmware, Inc. Transitive routing in public cloud
KR102512037B1 (ko) * 2022-12-27 2023-03-20 주식회사엔투솔루션 게이트 서버를 이용한 양방향 통신 시스템

Also Published As

Publication number Publication date
JPWO2015068255A1 (ja) 2017-03-09

Similar Documents

Publication Publication Date Title
US10469442B2 (en) Adaptive resolution of domain name requests in virtual private cloud network environments
JP6306640B2 (ja) 管理されたコンピュータネットワークのための論理ネットワーキング機能の提供
WO2015068255A1 (fr) Système de réseau, dispositif de commande de communication et procédé de communication
US10623505B2 (en) Integrating service appliances without source network address translation in networks with logical overlays
US8396954B2 (en) Routing and service performance management in an application acceleration environment
ES2663410T3 (es) Un controlador de red y un método informático implementado para definir automáticamente reglas de reenvío para configurar un dispositivo de interconexión de red informático
US9491002B1 (en) Managing communications involving external nodes of provided computer networks
Nordström et al. Serval: An {End-Host} stack for {Service-Centric} networking
JP4146886B2 (ja) 通信モジュール及びこの通信モジュールを備えたアプリケーションプログラム
JP5679343B2 (ja) クラウドシステム、ゲートウェイ装置、通信制御方法、及び通信制御プログラム
JP2013105308A (ja) 負荷分散システム、負荷分散装置、負荷分散方法および負荷分散プログラム
WO2023020606A1 (fr) Procédé, système et appareil pour masquer une station source, et dispositif et support de stockage
WO2023114184A1 (fr) Acheminement de paquets de données chiffrés
Ranjbar et al. Domain isolation in a multi-tenant software-defined network
US10382330B2 (en) System for the routing of data to computer networks
US10924397B2 (en) Multi-VRF and multi-service insertion on edge gateway virtual machines
US10931565B2 (en) Multi-VRF and multi-service insertion on edge gateway virtual machines
JP2017208718A (ja) 通信装置および通信方法
KR20170006950A (ko) Sdn 기반의 네트워크 플랫트닝 시스템 및 그 방법
US20170005985A1 (en) Scalable access to firewall-protected resources
CN113824808B (zh) 用于使用中间相遇代理的网络地址转换穿透的方法和系统
Köstler et al. Network Federation for Inter-cloud Operations
Langenskiöld Network Slicing using Switch Virtualization
Fowler Cloud Network Engineering
KR20120000171A (ko) 동일 가입자 주소의 처리 기능을 갖는 가상 사설 통신 시스템 및 그 방법

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 13897174

Country of ref document: EP

Kind code of ref document: A1

ENP Entry into the national phase

Ref document number: 2015546220

Country of ref document: JP

Kind code of ref document: A

NENP Non-entry into the national phase

Ref country code: DE

122 Ep: pct application non-entry in european phase

Ref document number: 13897174

Country of ref document: EP

Kind code of ref document: A1