JP3668731B2 - Virtual private network (VPN) system and relay node - Google Patents

Description

[0001]
BACKGROUND OF THE INVENTION
The present invention relates to a private network system constructed virtually by performing encrypted (encapsulated) communication in a virtual private network, particularly in a public data communication network such as the Internet.
[0002]
[Prior art]
Currently, there are many private networks built using the Internet Protocol (IP), and there is an increasing need to connect private networks built by multiple companies in multiple regions with the same level of security as a dedicated line. .
[0003]
As a communication technology capable of realizing such security, there is a technology called virtual private network (VPN).
[0004]
According to this technology, a VPN apparatus that encapsulates an IP packet is installed at each site constituting a private network. On the Internet, data is transferred based on the capsule header. By encapsulating data in this way, eavesdropping or the like by a third party can be prevented, and security can be ensured on the Internet. The VPN apparatus installed on the receiving side decapsulates the encapsulated data, and transfers the data to a destination terminal or the like.
[0005]
In this way, a virtual private network constructed using an infrastructure that is less expensive than a dedicated line called the Internet is called a virtual private network (hereinafter referred to as VPN).
[0006]
Here, the flow of the VPN packet will be described in more detail.
[0007]
As shown in FIG. 2, a normal packet has a destination address B and a source address A as headers before data. Based on this header, the packet is sent to a target destination via a router or the like.
[0008]
In the case of VPN communication, as shown in FIG. 3, the packet is encapsulated by the VPN device, and, for example, the address C of the source VPN device and the address D of the transfer destination VPN device are newly added as headers. Sent over.
[0009]
The transmission source VPN apparatus assigns the address D of the transfer destination VPN apparatus based on the path information in which the destination address and the transfer destination VPN apparatus address are associated in advance.
[0010]
[Patent Document 1]
JP 2001-237876 A
[0011]
[Problems to be solved by the invention]
Generally, a mesh type is used as a VPN connection form. In this case, the VPN apparatus at each base must register the route information of all bases that perform communication. Therefore, it is more difficult to manage this route information as the number of bases constituting the VPN increases.
[0012]
As another connection form, there is a hub-and-spoke type configured with one base as a center. In this case, VPN (tunneling) communication is performed between the two bases via the VPN device at the central base.
[0013]
Therefore, since the VPN device at each base only needs to manage the route information to the VPN device at the central base, the management is easy. However, it is necessary to register and manage the route information of all bases in the VPN device at the central base.
[0014]
In addition, when using VPN, clients at each site connect via the VPN device at each site when connecting to the Internet for communication other than VPN communication between sites. Therefore, there is a problem that the security level depends on the VPN device at each base.
[0015]
As a method for solving the above-described problem of management of route information, it is conceivable that all bases constituting the VPN are configured to pass through a VPN device managed by a third party. As a result, the user only needs to manage the route information to the VPN device managed by the third party.
[0016]
In this case, it is conceivable that the third party as a consignee prepares a relay node for each VPN and manages the route information of each VPN. In this case, since each VPN is independent, there is no problem even if private addresses overlap among a plurality of VPNs. However, preparing a relay node for each VPN has problems in terms of management cost and construction cost. Therefore, it is desirable that route information of a plurality of VPNs can be collectively managed by one relay node.
[0017]
However, as described above, the destination information and the transfer destination address are associated with the route information. Normally, a private address that can be used by any user is used as the destination address. Therefore, when a plurality of VPNs are managed by one relay node, private addresses may be duplicated between VPNs. Therefore, a plurality of VPNs can be managed collectively only by the above route information. Can not.
[0018]
The present invention has been made in view of the above problems, and even when addresses overlap between VPNs, by providing a system capable of managing a plurality of VPNs collectively, VPNs of users using VPNs are provided. The purpose is to ease the management of the equipment and to eliminate variations in the security level of each site.
[0019]
[Means for Solving the Problems]
The present invention is a VPN system in which a plurality of private networks (VPNs) virtually built on a public network by tunneling communication exist, and tunneling is performed between base nodes installed at bases belonging to each VPN. communicating, comprising a relay node to independently relayed to each VPN, each site node forwards the packet for the outside all the relay nodes, the relay nodes is defined for each VPN, the VPN For each of the base nodes, there is route information that associates the address of the base node with the address of the terminal that is the final destination of the received packet included in the base node, and the packet received from which base node belongs to which VPN After the determination, the route information of the corresponding VPN and the terminal address of the final destination included in the received packet are displayed. The address of the base node corresponding to the terminal address of the final destination is specified, and the received packet is transferred to the specified transfer destination base node.
[0020]
In the VPN system configured as described above, the base node of each base performs VPN (tunneling) communication via the relay node. Then, after determining which VPN the base node belongs to, the relay node transfers the packet based on the path information of the corresponding VPN.
[0021]
By managing this relay node by a third party, the base node can perform VPN communication with each base only by registering the route information to the relay node. Management becomes easier.
[0022]
Further, since the relay node can manage a plurality of VPNs at once, the management man-hour and cost for each VPN can be greatly reduced.
[0023]
In a preferred aspect of the present invention, the relay node has an Internet connection function, and a transfer destination address for an address other than the address of the terminal at each base is registered in the route information in the route information. When the terminal at each site belonging to each VPN is connected to the Internet, the route information is referred to and the Internet is connected by the Internet connection function via a forwarding address for an address other than the address of the terminal at each site. It is characterized by that.
[0024]
In the VPN system configured in this way, each site always goes through a relay node when connecting to the Internet. Therefore, the conditions such as security at the time of Internet connection at each site are the conditions at the relay node. To decide.
[0025]
Therefore, the management of Internet connection conditions can be collectively managed, and network management at each site becomes easy.
[0026]
In another preferred aspect of the present invention, the relay node has a security check function, and performs security check when the terminal at each site belonging to each VPN is connected to the Internet.
[0027]
In the VPN system configured as described above, the security level of each base can be unified, and the security management can be unified by the relay node performing a security check.
[0028]
This onset Ming, by tunneling communication, private network built virtually on the public network (VPN) there is a plurality, the tons Neringu communication between the installed base node to bases belonging to each VPN a relay node to independently relayed to each VPN, determined for each VPN, per all locations nodes in VPN, the final destination of the received packet included in the address and該拠point node bases node terminals After determining which VPN the base node belongs to, the route information of the relevant VPN and the terminal address of the final destination included in the received packet are referred to. The base node address corresponding to the terminal address of the final destination is specified, and the received packet is specified. It is characterized by transferring to the destination base node.
[0029]
The relay node configured as described above can collectively manage a plurality of VPNs.
[0030]
Therefore, by installing this relay node in a data center or the like and managed by a third party, the base node can perform VPN communication with each base if the route information to the relay node is registered. Therefore, it becomes easy to manage the route information of the VPN device at each base.
[0031]
Further, since the relay node can manage a plurality of VPNs at once, the management man-hour and cost per VPN can be greatly reduced.
[0032]
In a preferred embodiment of the present invention, the relay node has an Internet connection function to connect the Internet, the route information, to the final destination address other than the address of the terminal at each location included in the received packet When the transfer destination address is registered and the terminal of each base belonging to each VPN is connected to the Internet, the route information is referred to and the Internet is transmitted via the transfer destination address for an address other than the address of the terminal of each base. wherein the Internet connection to Rukoto by connection function.
[0033]
In the relay node configured as described above, each base always goes through the relay node when connected to the Internet.
[0034]
Accordingly, conditions such as security at the time of Internet connection at each site are determined by conditions at the relay node.
[0035]
Therefore, it is possible to collectively manage the Internet connection conditions, and network management at each site becomes easy.
[0036]
Another preferred aspect of the present invention is characterized in that the terminal belonging to each base belonging to each VPN has a security check function for performing a security check when connecting to the Internet.
[0037]
In the relay node configured as described above, the security level of each base can be unified, and security management can be unified by the relay node performing a security check.
[0038]
DETAILED DESCRIPTION OF THE INVENTION
Hereinafter, an embodiment of the present invention (hereinafter referred to as an embodiment) will be described with reference to the drawings.
[0039]
FIG. 1 is a network configuration diagram according to an embodiment of the present invention. In FIG. 1, there are VPNs of Company A and Company B, and each site has a VPN device (corresponding to a site node) installed at each site and data managed by a third party via the Internet 1. VPN (tunneling) communication is performed via the center 2 (corresponding to a relay node).
[0040]
Packets from bases belonging to each VPN pass through the router 3 installed in the data center, and are sent by the load balancer 4 to the VPN apparatus 5 installed in the data center with a low load. Then, the packet is transferred from the VPN apparatus 5 to the target site. The function of the VPN device may be realized using either hardware or software.
[0041]
The line 7 from each base to the ISP 6 includes an analog line, ISDN, ADSL, optical fiber, mobile phone, PHS, wireless LAN, satellite, CATV, cable broadcasting, etc., and is selected according to the communication speed and line cost.
[0042]
Here, the packet flow will be described in more detail.
[0043]
First, a case where the first sales office 11 of the A company accesses the intra server 8 of the head office 10 of the A company will be described. Here, the IP address of each device is defined as follows.
[0044]
Company A's first sales office PC: A
Company A head office intra-server: B
Company A's first sales office VPN equipment: C
Router installed in data center: D
Company A headquarters VPN device: E
Proxy server installed at data center: F
WWW server on the Internet: G
[0045]
An IP packet transmitted from the PC of the first sales office 11 of the A company to the intra server of the head office of the A company is as shown in FIG.
[0046]
When the VPN apparatus of the first sales office 11 of Company A receives this packet, it performs processing with reference to the route information in the VPN apparatus. The route information of the VPN device at each base (head office, sales office) is as shown in FIG. That is, the IP packet is set to be encapsulated and transmitted to the router 3 in the data center 2 for all the external IP addresses. The encapsulated packet to be transmitted is as shown in FIG.
[0047]
Thereafter, when it is transmitted to the Internet 1, it is transferred within the Internet based on the capsule header, so that it is transmitted to the router 3 in the data center 2.
[0048]
The packet received by the router 3 passes through the load balancer 4 shown in FIG. 1 and is sent to the VPN device 5 having a light load. The transmission source address in the capsule header received by the VPN apparatus 5 is an address assigned to the VPN apparatus at each site, and is a global IP address that can be uniquely identified in the Internet.
[0049]
From this global IP address, a VPN device belonging to which VPN device belongs is specified. FIG. 5 shows an example of a correspondence table between the global IP address of the VPN apparatus and the VPN.
[0050]
The global IP address of the source VPN apparatus in the capsule header of the received packet is obtained, and it is determined from the correspondence table shown in FIG.
[0051]
Since there is route information for determining the packet transfer destination for each VPN, it is determined from the correspondence table shown in FIG. 5 which VPN information belongs to which VPN information is to be selected. FIG. 6 shows an example of the selected route information.
[0052]
Further, the VPN apparatus 5 removes the capsule header and takes out the original packet. Then, referring to the route information shown in FIG. 6 determined earlier, it is determined that the destination IP address B of the extracted packet is an IP address in the head office, and the destination is determined to be the VPN apparatus at the head office. Further, since the presence or absence of encapsulation is present, the packet is encapsulated and transmitted with the transmission source and destination headers added thereto. The capsule at this time is as shown in FIG.
[0053]
The encapsulated packet is transmitted to the Internet, and transferred to the VPN apparatus at the head office based on the destination of the capsule header. The VPN apparatus at the head office removes the capsule header and takes out the packet. Then, the data is transferred to the intra server 8 having the IP address B in the head office.
[0054]
As described above, since the packet is protected by the capsule in the Internet 1, the communication between the head office and the sales office is kept safe. The above has described an example of accessing the intra-office server at the head office from a personal computer at the sales office. However, VPN communication is performed in exactly the same way from the head office to the sales office and between the sales office and the sales office.
[0055]
Further, in the VPN apparatus installed in the data center, after determining which VPN apparatus belongs to which VPN apparatus based on the correspondence table of FIG. 5, the path information of the corresponding VPN is determined.
[0056]
As described above, based on the address of the VPN apparatus installed at each base, that is, the global IP address uniquely determined in the Internet, it is determined which VPN the packet belongs to.
[0057]
Therefore, even if the address of a personal computer or the like in each base uses a private IP address that may be duplicated for each VPN, a packet can be transferred for each VPN without any problem.
[0058]
Next, the case where the personal computer at each site accesses the WWW server 9 on the Internet will be described.
[0059]
In order to simplify the explanation, consider the case where the WWW server 9 on the Internet is accessed from the same personal computer of the first sales office 11 of Company A as described above. The IP address of the personal computer of Company A's first sales office is A, and the IP address of the WWW server 9 is G.
[0060]
When accessing the WWW server 9 on the Internet via a data center from a personal computer in Company A's first business office, the global IP address C of the VPN device in Company A's first business office and the company A's first business office The IP address A of the personal computer is stored in a proxy server installed in the data center.
[0061]
Then, for the packet returned from the WWW server 9 to the proxy server, the global IP address of the VPN device in the first sales office of Company A and the IP address of the personal computer are restored and transmitted to the VPN device in the data center.
[0062]
The VPN apparatus in the data center determines which VPN belongs to the global IP address of the source VPN apparatus stored in the proxy server, acquires the corresponding route information shown in FIG. 6, encapsulates it according to this, and encapsulates it on the Internet. Send.
[0063]
This capsule reaches the VPN device of Company A's first sales office and is further sent to a personal computer. Note that the PCs in the sales office include PCs in work places, warehouses, temporary storage places, mobile bases, etc., and are effective for those that are temporarily installed or moved.
[0064]
As can be seen from the above description, communication between a personal computer in each site and a WWW server on the Internet passes through a firewall in the data center.
[0065]
When communicating directly with a WWW server on the Internet from each site, the security level depends on the firewall at each site. However, according to the present invention, the security level is unified at a plurality of bases constituting the VPN, and the security level is centrally managed by the firewall in the data center managed by a third party. Therefore, security management can be performed with high quality and efficiency.
[0066]
In the data center of FIG. 1, a proxy server is also mounted on the firewall. Here, the proxy server is set as a transparent proxy. In the transparent proxy, a gateway (here, a VPN device) automatically passes an HTTP packet to a proxy server. As a result, the personal computer in the firewall can access the Internet without being aware of the existence of the proxy server.
[0067]
Since the PCs in each site are in the firewall with respect to the firewall in the data center when accessing the Internet, setting the proxy server in the data center as a transparent proxy allows the PCs in each site to proxy for each computer. You can access the Internet regardless of your settings.
[0068]
Virus propagation can be monitored and removed by a virus check server in the data center.
[0069]
By measuring the amount of traffic that passes through the VPN device at the data center for each global IP address of the VPN device at each site, it becomes possible to grasp the traffic for each VPN and the traffic at each site in detail. It can also be used for billing.
[0070]
According to the present invention, since communication is performed via a data center, the traffic volume of each VPN can be measured at one relay node installed in the data center or the like, so the traffic volume at each site can be measured efficiently. can do.
[0071]
【The invention's effect】
As described above, according to the present invention, bases belonging to each VPN perform VPN communication via a relay node owned by the third party, thereby allowing the third party to manage the VPN. And management man-hours can be reduced.
[0072]
In addition, since a relay node can be used as a waypoint for a plurality of VPNs, when managing a relay node in a data center or the like, it is possible to reduce hardware costs, software costs, and management man-hours per VPN. .
[0073]
Further, since a plurality of VPNs communicate via the relay node, the traffic volume of the plurality of VPNs can be measured at one relay node. Therefore, there is an effect that the traffic volume measurement of a plurality of VPNs can be performed very efficiently. Further, the traffic volume measurement result can be used for billing or the like.
[0074]
In addition, according to the present invention, when accessing the Internet from a personal computer in a base belonging to a VPN, the security level of each base can be unified because it passes through the firewall in the relay node.
[0075]
Further, if a security check is performed by a firewall in the relay node managed by a person having specialized security skills, the security management is unified and the security management can be performed with high quality and efficiency.
[0076]
Further, according to the present invention, by setting the proxy server in the relay node as a transparent proxy, it is possible to access the Internet from a personal computer in the private network without depending on the proxy setting of the personal computer. When the transparent proxy is not used, it is necessary to perform enormous work of setting the proxy to be used for all the PCs at all the bases.
[0077]
Furthermore, it is possible to monitor and remove virus propagation by a virus check server in the relay node.
[Brief description of the drawings]
FIG. 1 is a network configuration diagram according to an embodiment of the present invention.
FIG. 2 is an image diagram showing a packet that is not encapsulated.
FIG. 3 is an image diagram showing an encapsulated packet.
FIG. 4 is an example of route information held by a VPN apparatus at each base in the embodiment of the present invention.
FIG. 5 is an example of a correspondence table held by a VPN apparatus installed in a data center in the embodiment of the present invention.
FIG. 6 is an example of route information held by a VPN apparatus installed in a data center in the embodiment of the present invention.
[Explanation of symbols]
1 Internet, 2 data center (relay node), 3 router, 4 load balancer, 5 VPN device, 6 ISP, 7 lines, 8 intra server, 9 WWW server, 10 A company headquarters, 11 A company first sales office, 20 Company B headquarters, Company B first sales office.

Claims (6)

A VPN system in which a plurality of private networks (VPNs) virtually constructed on a public network by tunneling communication exist,
A relay node that relays tunneling communication between base nodes installed at bases belonging to each VPN independently for each VPN;
Each base node forwards all external packets to the relay node,
The relay node is determined for each VPN, and has routing information that associates the address of the base node with the address of the terminal that is the final destination of the received packet included in the base node for all base nodes in the VPN. Then, after determining from which base node the VPN belongs to which VPN, the route information of the corresponding VPN and the terminal address of the final destination included in the received packet are referred to, and the terminal address of the final destination is corresponded A VPN system characterized by specifying an address of a base node and transferring the received packet to the specified transfer destination base node. The VPN system according to claim 1,
The relay node has an Internet connection function,
In the route information, a transfer destination address for an address other than the address of the terminal of each base is registered as the final destination included in the received packet,
When the terminal belonging to each site belonging to each VPN is connected to the Internet, the route information is referred to, and the Internet connection function is connected via the transfer destination address to an address other than the address of the terminal of each site. VPN system characterized by this. The VPN system according to claim 2, wherein
The VPN system has a security check function, and performs a security check when the terminal belonging to each site belonging to each VPN connects to the Internet. By tunneling communication, private network built virtually on the public network (VPN) there are multiple, independent tons Neringu communication between the installed base node to bases belonging to each VPN to each VPN A relay node that relays
It is determined for each VPN, and has route information that associates the address of the base node with the address of the terminal that is the final destination of the received packet included in the base node for all base nodes in the VPN. After determining whether the packet is received from the base node to which it belongs, the route information of the corresponding VPN and the terminal address of the final destination included in the received packet are referred to, and the address of the base node corresponding to the terminal address of the final destination is determined. relay node, wherein the identified and transferred to the transfer destination base node identified the received packet. In the relay node according to claim 4,
The relay node has an Internet connection function ,
In the route information, a transfer destination address for an address other than the address of the terminal of each base is registered as the final destination included in the received packet,
If the terminal belonging to each location belonging to each VPN is Internet connection, the reference to the route information, via a forwarding address the relative address other than the address of the base terminal, Internet connection by the Internet connection function relay node, wherein to Rukoto. In the relay node according to claim 5,
A relay node having a security check function for performing a security check when the terminal belonging to each site belonging to each VPN connects to the Internet.

Images