JP2013038684A - Vpn connection management system - Google Patents

Abstract

PROBLEM TO BE SOLVED: To provide a VPN (Virtual Private Network) connection service suitable for real-time multimedia communication using an inexpensive Internet line.SOLUTION: A user agent 22 is included in a terminal device which is connected directly to a network 14. A server device 12 forms a center VPN connection communication path 32 between the server device 12 and the terminal device including the user agent 22 and maintains it continuously. The terminal device including the user agent 22 transmits/receives information required for starting communication with P2P (Peer to Peer) connection through the center VPN connection communication path 32. Thereby, a P2P-VPN connection communication path 34 is formed between the terminal devices. Not only the terminal device including the user agent 22 but the terminal devices under control of router 16 (1), 16 (2) use the P2P-VPN connection communication path.

Description

  The present invention relates to a VPN connection management system that provides a simple VPN connection service to an arbitrary terminal group using an inexpensive Internet line.

  Although data communication using a telephone line has an advantage of high security, there is a problem that a transmission delay occurs due to a narrow band. If a broadband dedicated line is used, the bandwidth can be secured, but there is a problem that the communication cost increases. On the other hand, a system has been developed that realizes broadband communication by VPN (Virtual Private Network) connection with high security using an inexpensive Internet communication line (Patent Document 1) (Patent Document 2) (Patent Document 2) 3).

JP 2006-203575 A JP 2005-260715 A JP 2005-229436 A

The known prior art has the following problems to be solved.
According to the technique described in the above document, P2P (Peer to Peer) connection between terminal devices can be realized using an Internet communication line and using a highly secure VPN connection. However, a wide variety of terminal devices have appeared due to the spread of internet-compatible devices such as home appliances and crime prevention devices, and the recent spread of smartphones and the like. It is expected that the demand for highly secure VPN connection will increase for all of these terminal devices. In this case, a VPN connection setting that requires a complicated procedure can be a barrier to popularization. The present invention has been made to solve the above problems.
In order to solve the above problems, an object of the present invention is to provide the following VPN connection management system.
(1) To provide a VPN (Virtual Private Network) connection service suitable for real-time multimedia communication using an inexpensive Internet line.
(2) VPN communication between terminal devices is realized by P2P (Peer to Peer) connection, and the load on the server device that controls communication is reduced.
(3) Automate the settings for VPN connection to simplify the use of various terminal devices.
(4) Provide and manage a VPN connection service for any terminal group that can be freely expanded.
(5) Realize the collective management of the current state of any terminal device and settings related to all VPNs.

The following configurations are means for solving the above-described problems.
<Configuration 1>
A server device and a terminal device group connected to the server device via a network, each terminal device includes a user agent that operates in cooperation with the server device. A VPN server, a SIP (Session Initiation Protocol) server, a STUN (Session Traversal Utility for NAT) server, and an operation management server. The VPN server is continuously connected to the terminal device during system operation. A function to form a maintained center VPN connection communication path, the SIP server communicates with the terminal device using the center VPN connection communication path, and the server device among the plurality of terminal devices; The PUNP (Peer to Peer) -VPN connection communication path that does not pass through the communication is controlled to exchange information necessary to form a VPN connection communication path. The STUN server forms the P2P-VPN connection communication path To obtain the global IP address and port number of the communication request source and the communication partner and notify the corresponding terminal device, and the operation management server includes a user agent incorporated in the terminal device. Generate reference data to be referred to during operation, issue a user ID and virtual IP address for distinguishing all the terminal devices under management, and at the same time, user ID, virtual IP address and certificate of the terminal device A group management database including a storage device, and when the VPN server and the STUN server communicate with any of the terminal devices, the terminal device is authenticated with reference to the group management database, The user agent refers to the reference data, communicates with the VPN server to form the center VPN connection communication path, and other terminal devices and the When requesting P2P (Peer to Peer) communication using a VPN connection that does not pass through a server device, communication with the STUN server of the server device is necessary to form the P2P-VPN connection communication path. , Obtain a global IP address and port number, communicate with the SIP server, use the center VPN connection communication path, and obtain the global IP address and port number obtained from the STUN server A VPN connection management system that notifies a terminal device and forms a P2P (Peer to Peer) -VPN connection communication path that does not pass through the server device between the plurality of terminal devices.

<Configuration 2>
A server device for providing a VPN connection service to a group of terminal devices connected via a network, comprising a VPN server, a SIP (Session Initiation Protocol) server, a STUN (Session Traversal Utility for NAT) server, and an operation management server The VPN server has a function of forming a center VPN connection communication path that is continuously maintained during operation of the system with the terminal device, and the SIP server is configured such that the center VPN connection communication path Is used to communicate with the terminal device, and exchange information necessary to form a P2P (Peer to Peer) -VPN connection communication path that does not pass through the server device between the plurality of terminal devices. The communication control is performed, and the STUN server obtains a global IP address and a port number of a communication request source and a communication partner required to form the P2P-VPN connection communication path, and the corresponding terminal device The operation management server generates a reference data to be referred to during operation by the user agent incorporated in the terminal device and distinguishes all the managed terminal devices and virtual IP addresses. At the same time, a group management database including the user ID, virtual IP address, and certificate of the terminal device is stored in a storage device, and the VPN server and the STUN server communicate with any one of the terminal devices. In this case, the terminal device is authenticated by referring to the group management database, the user agent refers to the reference data, communicates with the VPN server to form the center VPN connection communication path, When requesting P2P (Peer to Peer) communication using a VPN connection that does not go through the server device with another terminal device, it communicates with the STUN server of the server device. To obtain the global IP address and port number necessary to form the P2P-VPN connection communication path, communicate with the SIP server, and use the center VPN connection communication path, The global IP address and port number acquired from the STUN server are notified to the other terminal device, and a P2P (Peer to Peer) -VPN connection communication path that does not pass through the server device is connected between the plurality of terminal devices. A server device characterized by being formed.

<Configuration 3>
A server device connected via a network is incorporated in a terminal device to receive a VPN connection service, refers to the reference data, communicates with the VPN server, and communicates with the center VPN connection communication. When a P2P (Peer to Peer) communication using a VPN connection that does not pass through the server device is formed with another terminal device, the P2P-VPN communicates with the STUN server of the server device and requests the P2P-VPN The global IP address and port number necessary for forming the connection communication path are acquired, communicated with the SIP server, and the global VPN acquired from the STUN server using the center VPN connection communication path. The IP address and port number are notified to the other terminal device, and a P2P (Peer to Peer) -VPN connection communication path that does not pass through the server device is formed between the plurality of terminal devices. User agent, wherein the door.

<Configuration 4>
2. The VPN connection management system according to claim 1, wherein the terminal device incorporating the user agent is a router, and the virtual IP address issued from the operation management server is issued to a terminal device not incorporating a subordinate user agent. Any of the terminal devices uses the virtual IP address to perform VPN communication using a P2P-VPN connection communication path formed between the terminal devices incorporating the user agent. VPN connection management system.

<Configuration 5>
A computer program that causes a computer of a server device to function as the VPN server, SIP server, STUN server, and operation management server described in Configuration 2.

<Configuration 6>
A computer-readable recording medium recording a computer program that causes a computer of a server device to function as the VPN server, SIP server, STUN server, and operation management server described in Configuration 2.

<Configuration 7>
A computer program for causing a computer of a terminal device to function as a user agent described in Configuration 3.

<Configuration 8>
A computer-readable recording medium storing a computer program that causes a computer of a terminal device to function as a user agent according to Configuration 3.

(1) When a user agent is incorporated into a terminal device, the user agent automatically sets a center VPN connection communication path with the server device. Further, necessary data is acquired from the server device via the center VPN connection communication path, and a P2P-VPN connection communication path is automatically formed between the terminal devices. Terminal devices and users do not need control and operation with awareness of VPN connection. The terminal device may be a router. Terminal devices under the router can easily receive a VPN connection service.
(2) Since each terminal device can directly perform VPN communication through P2P connection, signal transmission delay is less likely to occur than in a communication method that relays server devices. Therefore, it is suitable for real-time communication of voice and image data.
(3) Since the server device controls the start of the P2P-VPN connection between the terminal devices and uses the P2P-VPN connection communication path for the subsequent communication between the terminal devices, the load on the server device is light.
(3) The server device can manage a plurality of groups separately.
(4) Since the user agent performs the setting of the VPN connection communication path, for example, it does not affect the existing communication in the local area network to which the terminal device is connected. The terminal device application does not need to be switched between a VPN connection and other cases.
(5) Even if both terminal devices that perform P2P VPN communication are installed under the NAT (Network Address translator) device, the user agent automatically controls NAT traversal. There is no need to perform the service and the user is not burdened.

It is a schematic explanatory drawing of the VPN connection management system of this invention. It is a functional block diagram for the initial setting of the terminal device by a server apparatus. It is explanatory drawing of a VPN connection communication path. It is an internal function block diagram of a server apparatus and a terminal device. It is a sequence chart which shows the initial setting operation | movement of a terminal device. It is an operation | movement sequence chart in the case of changing the setting of the system already in operation. It is a sequence chart of the initial setting operation of the router. It is a sequence chart of the center VPN connection communication path 32 setting operation | movement of each terminal device. It is a P2P-VPN connection operation sequence chart. 4 is a management operation sequence chart of a P2P-VPN connection communication path 34.

  Hereinafter, embodiments of the present invention will be described in detail for each example.

FIG. 1 is a schematic explanatory diagram of a VPN connection management system of the present invention.
As shown in FIG. 1A, the VPN connection management system 10 includes a server device 12 and a terminal device group that receives a VPN connection service. The terminal device group includes, for example, a PC (personal computer) 20 (1), a smartphone 18, a router 16 (1), 16 (2) and the like connected to the server device 12 via the network 14 as shown in the figure. is there. The network 14 is a wide area network such as the Internet. Under the routers 16 (1) and 16 (2), a local network indicated by a dashed ellipse is connected. The personal computer 20 (2) under the router 16 (1) is also included in the terminal device that receives the VPN connection service.

  The terminal device group may be divided into a plurality of groups, and each can constitute a separate and independent network (closed network) distinguished by a virtual IP address described later. A user agent 22 is incorporated in a terminal device directly connected to the network 14. The server device 12 registers the terminal device incorporating the user agent 22 in the group management database 36.

  As shown in FIG. 1B, the server device 12 forms a center VPN connection communication path 32 with a terminal device incorporating the user agent 22 and continuously maintains it. The terminal device incorporating the user agent 22 transmits and receives information necessary for starting communication by P2P (Peer to Peer) connection through the center VPN connection communication path 32. Thereby, the P2P-VPN connection communication path 34 is formed between the terminal devices. Not only terminal devices incorporating the user agent 22, but also terminal devices under the routers 16 (1) and 16 (2) use the P2P-VPN connection communication path to securely connect P2P (Peer to Peer). Communication can be performed.

(User agent)
A technology for realizing P2P-VPN communication over NAT is known. However, complicated processing is required for VPN connection channel setting and address management. This places a heavy burden on the user. In the system of the present invention, by causing the user agent 22 to perform certain automatic control, the burden on the user is reduced and a highly scalable system is realized.

  A user agent 22 is incorporated in a terminal device directly connected to the server device 12 via the network 14 shared by unspecified persons such as the Internet. The user agent 22 is operated by a computer program that gives a predetermined function to the computer of the terminal device, and operates as a functional module of the terminal device.

  The user agent 22 operates in cooperation with the server device 12. The user agent 22 has a function of automatically executing an initial registration process for placing the terminal device under the management of the server device 12. At this time, the server device issues a unique virtual IP address to the terminal device. The user agent 22 has a function of automatically executing settings for forming a center VPN connection communication path 32 (solid arrow) between the terminal device and the server device 12.

  Further, the user agent 22 forms a P2P-VPN connection communication path 34 (broken arrow) with another terminal device, and automatically executes a process for starting communication by P2P connection. Have. Further, when the terminal device is a router, it has another terminal device under its control. At this time, the user agent 22 has a function of paying out the virtual IP address for the subnet issued from the server device 12 to the subordinate terminal device.

(Server device)
In order to perform the control as described above, the server device 12 includes functions of a VPN server 24, a SIP server 26, a STUN server 28, and an operation management server 30, as shown in FIG. Each of them operates by a computer program that gives a predetermined function to the computer of the server device 12, and operates as a functional module of the server device 12.

FIG. 2 is a functional block diagram for initial setting of the terminal device by the server device.
A user agent program 21 for downloading to the terminal device 40 is stored in the storage device of the server device 12. The user agent program 21 is downloaded to the terminal device using the browser of the terminal device 40. In this figure, a function block realized by starting the user agent program 21 is displayed as a user agent 22. The storage device of the server device 12 stores a group management database 36 for registering and managing the terminal device 40.

  The group management database 36 is generated by the operation management server 30, and is updated and managed as necessary. The operation management server 30 sets a user ID 44 (identification information), a PW 46, a virtual IP address 48, and authentication data 50 that distinguish each terminal device for the user agent 22. Further, reference data 51 necessary for automatic processing of the user agent 22 is generated, and these data are stored in the storage device as attached data of the user agent program 21.

  The user agent 22 stores the user ID 44, PW 46, virtual IP address 48, authentication data 50, and reference data 51 downloaded from the operation management server 30 in the storage device of the terminal device at the time of initial setting. The operation management server 30 acquires the global IP address 42 and port number 52 of the user agent 22 and adds them to the group management database 36 at the time of initial setting by the user agent 22. In the above example, the operation management server determines the user ID. However, a user agent may be used to input a user ID or PW selected by the user. In any case, the user ID and the PW are stored in the operation management database in association with the virtual IP address.

(Virtual IP address)
The virtual IP address 48 is a unique address that can identify each terminal device for the entire terminal device group for which the server device 12 provides the VPN connection service. The virtual IP address 48 is used to configure a network space (closed network) different from the global IP address 42 on the Internet and the IP address used in the existing local network.

  A user application of a terminal device that uses the VPN connection service can communicate only with the virtual IP address 48 in mind. That is, the user agent forms a communication path that can use the VPN connection service with the other user agent using the virtual IP address 48. When the user application transmits a data packet in which the virtual IP address 48 is set as the transmission destination, the user agent on the transmission side and the reception side transfers the data packet to the user application on the reception side. Therefore, the user application has an effect that programming in consideration of the VPN connection is unnecessary.

  The server device 12 can separate terminal device groups belonging to different groups by the virtual IP address 48. That is, one virtual subaddress space is set for each group. Therefore, the operation management server 30 of the server device 12 can provide independent VPN connection services for any number of groups.

  Each time a new terminal device is registered, the server device 12 assigns one virtual IP address 48 from the virtual IP address pool 38. A group of virtual IP addresses 48 are assigned to a subordinate subnet for a server having a local area network. The server pays out the virtual IP addresses 48 one by one to the subordinate terminal devices. Therefore, each terminal device under the server can use the VPN connection service using this virtual IP address 48. That is, each terminal device in the same group can perform mesh-type P2P-VPN connection with all other terminal devices.

  In FIG. 2, the user agent 22 of the terminal device 40 is generated by starting the user agent program 21 downloaded from the operation management server 30. All data necessary for the operation of the user agent 22 is added by the operation management server 30. As described above, the contents of the group management database 36 and the user ID list 45 are stored in the storage device of the terminal device 40. Subsequent initial setting is automatically performed by the user agent 22, so that the user can complete the initial setting by an operation of checking the setting contents. The initial setting operation will be specifically described later with reference to FIG.

(VPN connection channel)
FIG. 3 is an explanatory diagram of a VPN connection communication path.
The user agent 22 of the terminal device 40 shown in FIG. 2 automatically forms the thick solid-line center VPN connection communication path 32 shown in the drawing. As already explained, this state is maintained continuously.

  Here, when there is a request for P2P-VPN connection from one of the terminal devices or a terminal device under the terminal device, first, a route via the server device 12 using the center VPN connection communication path 32 Thus, information exchange between the user agents 22 is performed. Using the global IP address 42 and the port number 52 acquired at this time, a thick dashed P2P-VPN connection communication path 34 that does not pass through the server device 12 is formed.

  In FIG. 3A, the P2P-VPN connection communication path 34 is formed, for example, between the smartphone 18 and the personal computer 20 (1). Further, for example, it can be formed between the router 16 (1) and the router 16 (2). As shown in FIG. 3B, when a P2P-VPN connection communication path 34 is formed between the smartphone 18 and the router 16 (1), the personal computer 20 (2) under the control of the smartphone 18 and the router 16 (1) Can communicate with each other. The P2P-VPN connection communication path 34 is formed as necessary, and is controlled to automatically disappear when not in use.

(VPN server)
Hereinafter, functions of each unit of the server device 12 will be described in order. The VPN server 24 has a function of forming and maintaining a center VPN connection communication path 32 by making a VPN connection with all terminal devices incorporating the user agent 22. The VPN server 24 has an authentication processing function and a communication data encryption function. For authentication processing, the authentication data 50 stored in the group management database 36 is referred to.

(SIP server)
The SIP server 26 has a function of controlling communication between terminal devices using SIP (Session Initiation Protocol). The SIP server 26 uses the VPN connection communication path 32 formed by the VPN server 24 to perform SIP communication with a terminal device incorporating the user agent 22 to perform authentication processing and to perform P2P connection between the terminal devices. The communication for notifying the global IP address 42 and the port number 52 of each other is controlled.

(STUN server)
A STUN (Session Traversal Utility for NAT) server has a function of notifying a terminal device requesting P2P communication of information for exceeding NAT (Network Address Translation) of the network 14 to which each terminal device is connected. The STUN server 28 acquires a global IP address 42 on the outside (WAN side) of the router 16 to which the terminal device is connected, and a port number 52 (private address) on the inside (LAN side) of the router 16. When the user agent 22 of the terminal device requests P2P communication, the STUN server 28 acquires this information and transmits it to the requesting user agent 22.

(Operation Management Server)
The operation management server 30 performs communication history management in addition to the new registration procedure of the terminal device as already described. Communication history management is a process of storing, in a storage device, an operation history from the start to the end of connection when a P2P connection is made between terminal devices. Further, the center VPN connection communication path 32 formed with the terminal device is maintained and managed. In addition, the P2P-VPN connection communication path 34 formed between the terminal devices is monitored, and control is performed to automatically disappear when it is used.

(Center VPN session management)
The operation management server 30 requests all terminal devices in which the user agent 22 is incorporated to periodically maintain the VPN connection at a predetermined timing. This operation is called a center VPN session, and the VPN connection is always maintained while the terminal device is operating. Thereby, the server apparatus 12 can monitor the state of all the terminal apparatuses in which the user agent 22 is incorporated. Furthermore, when terminal devices make a VPN connection using P2P, call control based on the SIP protocol can be performed securely at any time.

(P2P-VPN session establishment)
FIG. 4 is an internal functional block diagram of the server device and the terminal device.
As shown in the figure, a VPN server 24 and a STUN server 28 are provided in the DMZ segment 54 (DeMilitarized Zone) of the server device. The DMZ segment 54 is surrounded by a firewall. The SIP server 26 and the operation management server 30 are provided on the non-DMZ segment 56 on the back side of the VPN server 24. The SIP server 26 and the operation management server 30 are connected to the network 14 via the VPN server 24.

  In the example of FIG. 4, two terminal devices 40 (1) 40 (2) are shown. The user agent 22 (1) is incorporated in the terminal device 40 (1). A user agent 22 (2) is incorporated in the terminal device 40 (2). Each user agent is provided with a VPN client 62, a VPN P2P server 66, a VPN P2P client 64, and an automatic control module 58. The automatic control module 58 is connected to the input / output interface 60 of the terminal device, and necessary information is input by the user of the terminal device.

  The VPN client 62 of the user agent 22 has a function of communicating with the VPN server 24 of the server device 12, automatically performing initial settings for VPN connection, and forming the center VPN connection communication path 32. The user completes the setting with an operation of inputting a password through the input / output interface 60. The automatic control module 58 outputs information such as setting data to the user through the input / output interface 60 and accepts input of a password or the like. The input / output interface 60 is connected to a keyboard and display of a terminal device (not shown).

  For example, the VPN client 62 accesses the operation management server 30 every few hours, maintains the center VPN connection communication path 32, acquires the latest setting information, and updates the retained data. Thereby, the operation management server 30 can recognize that each terminal device under management is in a communicable state.

  When the initial setting is completed, the center VPN connection communication path 32 is formed between the VPN client 62 of the user agents 22 (1) and 22 (2) and the VPN server 24 of the server device 12. When the terminal device 40 (1) requests communication with the terminal device 40 (2), the VPN P2P client 64 of the terminal device 40 (1) uses the center VPN connection communication path 32 via the SIP server 26. It communicates with the VPN P2P server 66 of the terminal device 40 (2).

  The VPN P2P client 64 of the terminal device 40 (1) inquires of the STUN server 28 about its own global IP address and port number 52. The VPN P2P server 66 of the terminal device 40 (2) also inquires of the STUN server 28 about its own global IP address and port number 52. Subsequently, the VPN P2P client 64 of the terminal device 40 (1) and the VPN P2P server 66 of the terminal device 40 (2) exchange information acquired from the STUN server 28 via the SIP server 26.

  Thereafter, a P2P-VPN connection communication path 34 is formed between the VPN P2P client 64 of the terminal device 40 (1) and the VPN P2P server 66 of the terminal device 40 (2), thereby establishing a P2P-VPN session. The terminal device body simply functions as an input / output device. Therefore, the terminal device main body can use the settings used in the existing local area network as they are, and no changes are required. Hereinafter, each operation will be described in detail using a specific sequence chart.

(Initial setting operation sequence)
FIG. 5 is a sequence chart showing an initial setting operation of the terminal device.
In the following, a specific operation description will be given with reference to a sequence chart, in which the user agent 22 shown in FIG. The operation management server 30 of the server device 12 generates a user agent program 21 and reference data 51 as shown in the figure for a terminal device for new registration. With this reference data 51, the user agent 22 of the terminal device 40 (1) can execute the initial setting and VPN setting almost automatically.

[Create individual settings]
The operation of generating the reference data 51 is performed by, for example, a browser by a dedicated engineer who delivers the system. Actually, the reference data 51 is automatically generated, and a dedicated engineer only has to confirm or select the contents. First, the reference data includes the user ID for which user registration has been added. In addition, the IP address and port number are included for the user agent to connect to the VPN server at the initial setting. At the same time, authentication data 50 (FIG. 2) for VPN connection is included.

  The certificate CN, CA certificate, individual certificate, private key, individual certificate PIN (password), SIP digest authentication password, and the like correspond to the authentication data 50. In addition, information on the IP address and port is included for connection to the SIP server.

  Also, when forming a P2P-VPN connection communication path between routers, a dedicated subnet IP address is used. The P2P-VPN virtual IP address width is information for designating the range. When the terminal device is a server, the number of subnet virtual IP addresses that can be paid out to the subordinate terminal device is set. The setting of the IP subnet address on the LAN side corresponds to this. Further, the user ID list 45 described in FIG. 2 is included. This is the case with the P2P-VPN connection destination user ID list. Also, information on the IP address and port for connecting to the STUN server is included.

  As described above, the user agent program 21 (FIG. 2) and the reference data 51 are prepared on the operation management server 30 side. Then, as shown in FIG. 5, when there is an HTTPS individual setting download request from the terminal device 40 (1), the prepared data is downloaded to the terminal device 40 (1). This data is downloaded via the Internet. Thereafter, the user agent program 21 is activated and the user agent 22 is incorporated in the terminal device 40 (1).

  At the time of initial setting, the user agent 22 requests the user to input, for example, its own user ID 44, PW 46, and operation management server address (IP address or URL). Such information is notified to the user in advance by a letter or the like. When the information input by the user matches the information stored in the storage device, the user agent 22 refers to the reference data 51 and automatically starts connection with the VPN server 24 thereafter.

  When connected to the VPN server 24, a DTLS handshake is started between the terminal device 40 (1) and the VPN server 24, and a session for forming the center VPN connection communication path 32 is established. Thus, the initial setting and the center VPN connection test are completed, and the power of the terminal device 40 (1) is turned off. Thereafter, when the terminal device is activated at an arbitrary timing, the user agent 22 automatically establishes a center VPN session. The processing after the DTLS handshake in the figure will be described later with reference to FIG.

(setting change)
FIG. 6 is an operation sequence chart when changing the settings of a system that is already in operation.
As shown in the figure, a center VPN connection communication path 32 has already been formed between the terminal device 40 (1) and the VPN server 24. This state is displayed in FIG. 6 as the center VPN session is being established. When there is a server address change or other setting change, the operation management server 30 requests the VPN server 24 to notify the other terminal device of the information.

  A center forced notification is sent to the terminal device 40 (1) via the VPN server 24. Upon receiving the notification, the terminal device 40 (1) transmits an HTTPS individual setting download request to the operation management server 30. As a result of the response, the changed setting data is downloaded to the terminal device 40 (1). The terminal device 40 (1) stores the individual settings. When a new terminal device incorporating a user agent is added, only the update of the user ID list is executed in the procedure of FIG.

FIG. 7 is a sequence chart of the initial setting operation of the router.
If 40 (1) is a router, the user agent prepared as described in FIG. 5 is incorporated, and then processing for installation in the existing LAN is executed. Thereafter, a process of paying out the virtual IP address for subnet issued from the operation management server 30 to the terminal device on the local area network side is executed. Following DTLS handshake is the procedure.

  A DTLS handshake is started between the terminal device 40 (1) and the VPN server 24, and a VPN connection request is made. The terminal device 40 (1) notifies the VPN server 24 of the user ID (identifier) and receives a virtual IP address (vIP) 48. This completes the VPN connection. Thus, the center VPN session is being established. For example, virtual IP addresses 192.168.2.0 to 192.168.2.255 when using P2PVPN are automatically set in the user agent of the router. The router uses 192.168.2.1 among the automatically set LAN virtual IP addresses, and issues virtual IP addresses to terminal devices under the LAN in order from 192.168.2.2. Thus, a virtual IP address is assigned to all terminal devices under the LAN.

(Center VPN connection operation)
FIG. 8 is a sequence chart of the operation of setting the center VPN connection communication path 32 of each terminal device.
In the figure, first, the terminal device 40 (1) is activated. After that, the user agent runs automatically and executes the DTLS (Datagram Transport Layer Security) handshake protocol to establish a center VPN session. At this time, the user agent 22 receives a virtual IP address 48 from the VPN server 24 of the server device 12 after exchanging the identifier. The user agent 22 registers this virtual IP address 48 as routing information on the terminal device. Thereby, a virtual network interface is automatically generated in the terminal device, and it seems to the user that one new Ethernet (registered trademark) interface is added.

  As described above, since the user agent 22 holds information for automatically establishing a session by the VPN connection with the VPN server 24 of the server device 12, no information setting can be made in the terminal device itself. There is no need for any setting operation. When the terminal device is activated, the VPN client of the user agent 22 uses the downloaded and stored data to validate the VPN connection with the VPN server 24 of the server device 12.

  Thereafter, the SIP server 26 and the SIP protocol are executed. After the center VPN connection, the SIP server confirms that it is active by sending a SIP REGISTER message. Thereafter, the SIP server 26 and the SIP protocol are executed. After the center VPN connection, the SIP server is notified by sending a SIP REGISTER message that it is active. At the same time, the SIP server acquires the global IP address of the user agent and registers it in the group management database of the operation management server. In this way, the operation management server registers the location of the user agent of the managed terminal device and uses it for monitoring the center VPN connection communication path. When the user agent requests a P2P-VPN connection, the SIP server uses the registered global IP address to relay the connection request.

(P2P-VPN connection operation)
FIG. 9 is a P2P-VPN connection operation sequence chart.
At this previous stage, a session by VPN connection between the server device 12 and the connection request source terminal device is established, and a center VPN connection communication path 32 is formed between them. Next, as shown in the figure, in the part displayed as SIP REGISTER and SIP REGISTER 200 OK, the connection request source user agent 22 activates the VPNP2P client and executes the SIP protocol.

  The connection request source VPNP2P client requests the STUN server 28 to acquire the global IP address 42 and the port number 52 of the connection request source terminal device. Thereafter, the user ID of the connection request source terminal device and the user ID of the connection partner terminal device are designated, and an INVITE message is transmitted to the SIP server 26. At this time, the connection request source user agent 22 adds the global IP address 42 and the port number 52 acquired from the STUN server 28 to the body in the INVITE message.

  The SIP server 26 requests the VPN server 24 of the server device 12 and transfers this INVITE message to the user agent 22 of the terminal device of the connection partner. The user agent 22 that has received the INVITE message activates the VPNP2P server. The VPNP2P server sends back a 200 OK message permitting connection to the SIP server 26. At this time, the VPNP2P server requests the STUN server 28 to obtain the global IP address 42 and the port number 52 of the connection request source terminal device, in the same manner as the connection request source user agent 22, and obtains the information. Append to the body in the 200 OK message.

  The SIP server 26 transfers this 200 OK message to the connection request source. By this series of message exchanges, the P2P-VPN connection communication path 34 using the global IP address 42 and the port number 52 of the connection request source and the connection partner can be formed. After that, the VPNP2P client that is the connection request source and the VPNP2P server that is the connection partner directly communicate with each other through the Internet to establish a session for P2PVPN connection.

  That is, in the figure, after executing DTLS handshake and exchanging identifiers, a virtual IP address is issued to the terminal device of the connection partner. As described above, a subnet IP address dedicated to P2PVPN connection is used between terminal devices that form the P2P-VPN connection communication path 34. Thereafter, secure data transmission / reception can be performed using the VPN connection communication path formed between the two terminal devices. When the session for P2PVPN connection ends, the VPN connection channel for P2PVPN connection disappears.

(Management operation)
FIG. 10 is a management operation sequence chart of the P2P-VPN connection communication path 34.
As shown in the figure, with the P2P-VPN session established, when the SIP protocol ends, when communication stops and a timeout occurs, or forcibly terminates from any device such as a terminal device or server device When a command is issued, end the P2P-VPN session. Since an arbitrary number of P2P-VPN connection channels 34 are formed at an arbitrary timing, unnecessary sessions are automatically deleted and the subnet IP address is used effectively.

  As described above, the terminal device that is directly connected to the server device via a network such as the Internet by automating various processes necessary for VPN connection and communication through the cooperation of the user agent 22 and the server device. The terminal device can also receive the P2P-VPN connection service freely and simply.

DESCRIPTION OF SYMBOLS 10 VPN connection management system 12 Server apparatus 14 Network 16 Router 18 Smartphone 20 Personal computer 21 User agent program 22 User agent 24 VPN server 26 SIP server 28 STUN server 30 Operation management server 32 Center VPN connection communication path 34 P2P-VPN connection communication path 36 Group management database 38 Virtual IP address pool 40 Terminal device 42 Global IP address 44 User ID
45 User ID list 46 PW
48 Virtual IP address 50 Authentication data 51 Reference data 52 Port number 54 DMZ segment 56 Non-DMZ segment 58 Automatic control module 60 Input / output interface 62 VPN client 64 VPN P2P client 66 VPN P2P server

Claims (8)

It is composed of a server device and a group of terminal devices connected to the server device via a network,
Each terminal device incorporates a user agent that operates in cooperation with the server device,
The server device includes a VPN server, a SIP (Session Initiation Protocol) server, a STUN (Session Traversal Utility for NAT) server, and an operation management server,
The VPN server has a function of forming a center VPN connection communication path that is continuously maintained during operation of the system with the terminal device,
The SIP server communicates with the terminal device using the center VPN connection communication path, and establishes a P2P (Peer to Peer) -VPN connection communication path that does not pass through the server apparatus between the plurality of terminal apparatuses. Control the communication to exchange information necessary to form,
The STUN server has a function of acquiring a global IP address and a port number of a communication request source and a communication partner required to form the P2P-VPN connection communication path and notifying a corresponding terminal device,
The operation management server generates reference data to be referred to during operation by a user agent incorporated in the terminal device, and issues a user ID and a virtual IP address for distinguishing all the terminal devices under management, Storing a group management database including a user ID, a virtual IP address, and a certificate of the terminal device in a storage device;
When the VPN server and the STUN server communicate with one of the terminal devices, the terminal device is authenticated with reference to the group management database,
The user agent is
Referring to the reference data, communication with the VPN server is performed to form the center VPN connection communication path, and P2P (Peer to Peer) communication using VPN connection not via the server device with other terminal devices When requesting, it communicates with the STUN server of the server device, acquires a global IP address and a port number necessary for forming the P2P-VPN connection communication path, and communicates with the SIP server. The center VPN connection communication path is used to notify the other terminal device of the global IP address and port number acquired from the STUN server, and pass through the server device between the plurality of terminal devices. A VPN connection management system characterized by forming a P2P (Peer to Peer) -VPN connection communication path. A server device for providing a VPN connection service to a group of terminal devices connected via a network,
Including VPN server, SIP (Session Initiation Protocol) server, STUN (Session Traversal Utility for NAT) server and operation management server,
The VPN server has a function of forming a center VPN connection communication path that is continuously maintained during operation of the system with the terminal device,
The SIP server communicates with the terminal device using the center VPN connection communication path, and establishes a P2P (Peer to Peer) -VPN connection communication path that does not pass through the server apparatus between the plurality of terminal apparatuses. Control the communication to exchange information necessary to form,
The STUN server has a function of acquiring a global IP address and a port number of a communication request source and a communication partner required to form the P2P-VPN connection communication path and notifying a corresponding terminal device,
The operation management server generates reference data to be referred to during operation by a user agent incorporated in the terminal device, and issues a user ID and a virtual IP address for distinguishing all the terminal devices under management, Storing a group management database including a user ID, a virtual IP address, and a certificate of the terminal device in a storage device;
When the VPN server and the STUN server communicate with one of the terminal devices, the terminal device is authenticated with reference to the group management database,
The user agent refers to the reference data, communicates with the VPN server to form the center VPN connection communication path, and uses P2P (Peer) using a VPN connection that does not pass through the server device with other terminal devices to Peer) when requesting communication, it communicates with the STUN server of the server device to obtain the global IP address and port number necessary for forming the P2P-VPN connection communication path, and the SIP Communicating with the server, using the center VPN connection communication path, notifying the other terminal device of the global IP address and port number acquired from the STUN server, between the plurality of terminal devices A server apparatus, which forms a P2P (Peer to Peer) -VPN connection communication path that does not pass through the server apparatus. In order to receive a VPN connection service by a server device connected via a network, it is incorporated into a terminal device,
Obtain the reference data including the IP address, port number, and authentication data of the VPN server, STUN server, and SIP server from the operation management server.
Referring to the reference data, communicating with the VPN server to form the center VPN connection communication path,
When requesting P2P (Peer to Peer) communication using a VPN connection that does not go through the server device with other terminal devices,
Communicate with the STUN server of the server device, obtain the global IP address and port number necessary to form the P2P-VPN connection communication path,
Communicating with the SIP server, using the center VPN connection channel, notifying the global IP address and port number acquired from the STUN server to the other terminal device,
A user agent that forms a P2P (Peer to Peer) -VPN connection communication path that does not pass through the server device between the plurality of terminal devices. In the VPN connection management system according to claim 1,
The terminal device incorporating the user agent is a router, and the virtual IP address issued from the operation management server is issued to a terminal device not incorporating a subordinate user agent, and each terminal device uses the virtual IP address. A VPN connection management system characterized in that VPN communication is performed using a P2P-VPN connection communication path formed between terminal devices incorporating the user agent. The server device computer
The computer program which functions as a VPN server of Claim 2, a SIP server, a STUN server, and an operation management server. The server device computer
A computer-readable recording medium storing a computer program that functions as the VPN server, SIP server, STUN server, and operation management server according to claim 2. The terminal computer,
The computer program which functions as a user agent of Claim 3. The terminal computer,
A computer-readable recording medium having recorded thereon a computer program that functions as a user agent according to claim 3.

Images