Communication adapter and communication system

Abstract

To provide a communication adapter capable of surely preventing the deviation in a transmission order of a packet, and capable of enhancing a communication performance.SOLUTION: A communication adapter 3 is used for connecting a general node to an overlay network, and is interposed between an internet and the general node. The communication adapter 3 comprises: an interface handling part 333 that hooks the packet transmitted from the general node; an order information holding part 334a that holds index information indicating a transmission order of the packet hooked; a packet handling part 334b that can perform a parallel processing of the packet hooked; and a packet transmission control part 334c that performs a transmission processing of the packet to which a processing by the packet handling part 334b is executed so as to be the same order with the transmission order in the index information held by the order information holding part 334a.SELECTED DRAWING: Figure 5

Description

[Technical field]

[0001] The present invention relates to a communications adapter used for connecting a general terminal to an overlay network, and a communications system including the communications adapter. [Background technology]

[0002] In recent years, a method of connecting a plurality of terminal devices (node ​​devices) using an overlay network constructed on a predetermined computer network (for example, a public network such as the Internet) has become known (for example, see Patent Document 1, etc.). Examples of the terminal devices include smartphones, web cameras, and various robots, and a terminal device (for example, a smartphone) can obtain information acquired and stored by other terminal devices (for example, web cameras, etc.) via the overlay network.

[0003] In recent years, security policies are shifting to a zero-trust security model due to changes in work styles. The inventor has developed a technology called CYber PHysical Overlay Network over Internet Communication (CYPHONIC) as a communication framework to easily realize the zero-trust security model. CYPHONIC automatically performs authentication of terminal devices and encryption of packets.

[0004] The inventors of the present invention have also proposed a communication adapter (CYPHONIC adapter) that is installed between a terminal device and a computer network to enable the provision of CYPHONIC services without installing a specific device program on the terminal device. This communication adapter (CYPHONIC adapter) can be suitably used for general terminals, such as IoT devices, embedded devices, and dedicated servers, where it is difficult to install additional device programs due to system and hardware resource constraints and the impact on system reliability. [Prior art documents] [Patent documents]

[0005] [Patent Document 1] JP 2017-204887 A Summary of the Invention [Problem to be solved by the invention]

[0006] Incidentally, the above-mentioned communications adapter hooks (obtains by fishing) packets sent from general terminals, processes the hooked packets such as encapsulating and encrypting them, and then transmits the processed packets to the computer network. From the viewpoint of improving communication performance (throughput), it is conceivable to configure the adapter to process multiple packets in parallel and transmit the packets to the computer network in the order in which they have been processed.

[0007] However, in such a configuration, there is a risk that a mismatch will occur between the packet transmission order from the general terminal and the packet transmission order from the communication adapter, which may actually result in a deterioration in communication performance. In particular, when communication is performed using the Transmission Control Protocol (TCP), the retransmission control mechanism and congestion control algorithm may cause a mismatch in the packet transmission order, which may result in a significant deterioration in communication performance.

[0008] The present invention has been made in consideration of the above-mentioned circumstances, and its object is to provide a communication adapter etc. that can more reliably prevent deviations from occurring in the order in which packets are sent, thereby improving communication performance. [Means for solving the problem]

[0009] The following describes each of the means suitable for achieving the above object. Note that, as necessary, the specific effects of the corresponding means will be added.

[0010] Means 1. A communications adapter used to connect a specific general terminal to an overlay network constructed on a specific computer network, and installed between the computer network and the general terminal, a hook unit for hooking a packet transmitted from the general terminal; a sequence information storage unit that stores index information indicating a transmission sequence of packets hooked by the hook unit; a packet processing unit capable of performing predetermined processes in parallel on the packets hooked by the hook unit; a transmitting unit that performs transmission processing of packets processed by the packet processing unit so that the transmission order is the same as the transmission order in the index information stored by the order information storage unit.

[0011] Incidentally, "performing processes in parallel" means performing multiple processes (handling multiple tasks) within a certain time range. Therefore, within a certain time range, multiple processes may be performed simultaneously in parallel, or multiple processes may be performed one after the other (for example, after process A starts, process A may be temporarily interrupted, process B may be performed during the interruption, and process A may be resumed after process B ends).

[0012] According to the above-mentioned means 1, packets transmitted from general terminals are processed in parallel, so that communication performance (throughput) can be improved.

[0013] On the other hand, the communication adapter holds index information indicating the transmission order of packets from the general terminal, and transmits processed packets in the same order as the transmission order in this index information. This makes it possible to prevent discrepancies between the transmission order of packets from the general terminal and the transmission order of packets from the communication adapter, thereby further improving communication performance (throughput).

[0014] The above-mentioned method 1 is particularly effective when performing communication using TCP, because in TCP, the retransmission control mechanism and congestion control algorithms tend to cause deviations in the packet transmission order.

[0015] Means 2: A physical network interface card is provided which is connected to the general terminal and receives packets transmitted from the general terminal; The communication adapter according to the means 1, wherein a function of combining a plurality of packets is disabled in the physical network interface card.

[0016] In order to reduce the processing load on the CPU, recent operating systems may have a function for combining (recombining) multiple fragmented packets in a physical network interface card (NIC). For example, recent Linux (registered trademark) operating systems have a function called Generic Receive Offload (GRO) as such a function. However, the packet recombination process may cause problems in the configuration of the above-mentioned means 1, which processes received packets individually.

[0017] In this regard, according to the above-mentioned means 2, the packet combining processing function such as GRO is disabled, so that in the configuration of the above-mentioned means 1 that processes received packets individually, it is possible to more reliably prevent the occurrence of problems related to packet processing, and ultimately to more reliably achieve the effects of the above-mentioned means 1.

[0018] Means 3. A method for using a communication adapter according to Means 1 and a general terminal; A communication system configured so that the general terminal and a predetermined counterpart terminal can communicate with each other via the communication adapter and the overlay network, an authentication unit capable of executing an authentication process for the general terminal and transmitting information related to an IP address of the general terminal to the communication adapter through the authentication process; The communication adapter includes: A function of operating the general terminal in a Stateful DHCPv6 mode upon receipt of a predetermined message from the general terminal; a function of allocating a virtual IPv6 address to the general terminal based on information related to the IP address of the general terminal transmitted from the authentication unit in response to a request from the general terminal operating in a Stateful DHCPv6 mode; A communication system, wherein the general terminal uses the assigned virtual IPv6 address in communication with the counterpart terminal.

[0019] According to the above-mentioned means 3, a virtual IPv6 address based on the "information related to the IP address of the general terminal" transmitted from the authentication unit is assigned to the general terminal. Therefore, the virtual IPv6 address assigned to the general terminal can be appropriately managed.

[0020] In addition, when allocating virtual IPv6 addresses to general terminals, the communication adapter functions as a DHCPv6 server and an IPv6 router, which contributes to simplifying and miniaturizing the communication system. [Brief description of the drawings]

[0021] [Figure 1] FIG. 2 is a schematic diagram showing a connection state of a communication system, etc. [Diagram 2] FIG. 2 is a schematic diagram showing the connection state of general nodes, communication clouds, etc. [Diagram 3] FIG. 11 is a process flow diagram showing processing related to a packet received by a communication adapter. [Figure 4] FIG. 2 is a schematic diagram showing the schematic configuration of a communication adapter. [Diagram 5] 2 is a schematic diagram showing a schematic configuration of a packet processing transmission unit, etc. FIG. [Figure 6] FIG. 2 is an explanatory diagram for explaining packet encapsulation performed in a communication adapter or the like. [Figure 7] FIG. 11 is a signaling diagram for explaining authentication processing of a communication adapter, etc. [Figure 8] FIG. 11 is a signaling diagram for explaining the configuration process of a general node. [Figure 9] This is a signaling diagram to explain the construction process of an overlay network, which is triggered by the transmission of a message from a general node. [Figure 10] This is a signaling diagram to explain the process of constructing an overlay network, which is triggered by a message being sent from a partner node. [Figure 11] FIG. 1 is a schematic diagram for explaining a test environment. [Figure 12] FIG. 13 is a table showing test results when a conventional adapter is used. [Figure 13] FIG. 13 is a table showing test results when the present adapter is used. [Figure 14] A signaling diagram to explain the configuration process of a general node in another embodiment. [Figure 15] FIG. 11 is a signaling diagram for explaining gateway proxy processing in another embodiment. [Figure 16]FIG. 11 is a signaling diagram for explaining a configuration process of a general node when EAP is not used in another embodiment. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0022] An embodiment will be described below with reference to the drawings. As shown in FIG. 1, the communication system 1 is a system for connecting a general node 2 to an overlay network ON constructed on the Internet 100 and enabling communication between the general node 2 and a counterpart node 200 via the overlay network ON. The counterpart node 200 is, for example, a smartphone or a personal computer, and has substantially the same functions as a communication adapter 3 described later by installing a specific device program (a daemon program 201 described later). In this embodiment, the Internet 100 constitutes a "specific computer network", and similarly, the general node 2 constitutes a "general terminal", and the counterpart node 200 constitutes a "partner terminal".

[0023] As shown in FIG. 2, the communication system 1 includes a general node 2, a communication adapter 3, and a communication cloud 4.

[0024] The general node 2 is composed of IoT devices such as web cameras and robots, embedded devices, and dedicated servers for specific purposes, and is a device on which it is difficult to install device programs, as is the counterpart node 200, due to system and hardware resource constraints and the impact on system reliability.

[0025] In addition, the general node 2 is a device that can be connected to a network (the Internet 100 or a local network) and is equipped with a general node NIC 21, which is a physical network interface card (NIC). A unique Media Access Control (MAC) address is set to the general node NIC 21.

[0026] Moreover, the general node 2 can operate using an IPv6 address as an IP address (can operate in IPv6 mode), and has a function of automatically acquiring a virtual IPv6 address from the communication adapter 3 that functions similarly to a DHCPv6 server. The process of allocating and acquiring the virtual IPv6 address (the configuration process of the general node 2 described below) will be described later.

[0027] Furthermore, the general node 2 performs standard IP-based communication using a virtual IP address. In this embodiment, the IP header of a packet (data) sent from the general node 2 includes a virtual IP address as a source address or a destination address, and the general node 2 can transmit a packet to which the virtual IP address (Virtual IP Header) of the general node 2 and the other node 200 is attached to the application data (App Data) (see FIG. 6). The packet sent from the general node 2 is hooked (obtained by fishing) by an interface handling unit 333 (to be described later) of the communication adapter 3 via the general node NIC 21 and a first NIC 31 (to be described later).

[0028] Next, the communication adapter 3 will be described. The communication adapter 3 is a device for providing a general node 2, in which it is difficult to install a device program, with the same functions as a remote node 200 in which a device program (daemon program 201) is installed. The daemon program 201 (see FIG. 6) executes almost the same process as the adapter daemon 33 described later.

[0029] The communication adapter 3 executes various processes such as authentication process of itself and the general node 2, construction process of an overlay network ON, and processes for ensuring safe communication between the general node 2 and the other node 200 (encapsulation process, encryption process, etc.). The communication adapter 3 also manages the virtual IP address and fully qualified domain name (FQDN) of the general node 2, and performs communication process between the other node 200 and the communication cloud 4 on behalf of the general node 2. The FQDN is composed of an arbitrary host name (for example, a host name registered in the database 43a and managed by the authentication unit 41) and a predetermined domain name, for example, test-device-01.nms01.local.cyphonic.org.

[0030] The communication adapter 3 has a computer including a Central Processing Unit (CPU) that executes predetermined arithmetic processing, a Read Only Memory (ROM) that stores various programs and fixed value data, etc., a Random Access Memory (RAM) that temporarily stores various data when executing various arithmetic processing, a storage device for storing information, and peripheral circuits for these, etc. Linux (registered trademark) is installed in the communication adapter 3 as the operating system (OS).

[0031] Further, the communication adapter 3 has a first NIC 31 and a second NIC 32, which are physical network interface cards (NICs). The first NIC 31 is connected to a general node NIC 21 of the general node 2, and the second NIC 32 is connected to the Internet 100. In this embodiment, the first NIC 31 constitutes a "physical network interface card."

[0032] 3, when the first NIC 31 receives a packet transmitted from a general node 2 (for example, a packet transmitted to the other node 200), the first NIC 31 stores the packet in its internal memory (step S1). In this embodiment, a function of combining (recombining) multiple packets in a NIC, called GRO by Linux (registered trademark), is disabled. Therefore, the multiple fragmented packets are not combined by the first NIC 31 and are stored as they are in the internal memory.

[0033] Next, the first NIC 31 issues a hardware interrupt to the CPU of the communication adapter 3 to notify that the packet has been received (step S2). When the hardware interrupt is issued, the CPU places the packet that was placed in the internal memory of the first NIC 31 in a ring buffer of the RAM. Note that instead of the packet, a pointer for managing the packet may be placed in the ring buffer of the RAM.

[0034] Then, a predetermined software interrupt is performed, whereby a packet is taken out of the ring buffer, a predetermined protocol processing is performed on the taken out packet, and the packet after the protocol processing is then stacked in the socket queue (steps S3 and S4). Then, a socket function such as read, recv, or recvfrom is called by a raw socket of an interface handling unit 333, which will be described later, and the packet in the socket queue is hooked by the interface handling unit 333 (i.e., the packet data is copied to the adapter daemon 33, which will be described next).

[0035] 4, the communication adapter 3 is set with an adapter daemon 33, which is a device program that runs on Linux (registered trademark) as the OS, and the adapter daemon 33 includes various functional units such as a signaling unit 331, a resolver unit 332, an interface handling unit 333, a packet processing transmission unit 334, a host setting unit 335, and a node information management unit 336. In addition to the adapter daemon 33, the communication adapter 3 also includes a functional unit called a local DNS service unit 34 configured using CoreDNS, for example. The various functions of these functional units are realized by the cooperation of various hardware such as the CPU, ROM, and RAM and pre-stored software (such as the OS, device program, and DNS software). In this embodiment, the interface handling unit 333 configures a "hook unit."

[0036] The signaling unit 331 executes communication signaling with the communication cloud 4. The signaling unit 331 in this embodiment is configured to be able to execute appropriate communication signaling according to the operation mode (IPv4 mode or IPv6 mode) of the general node 2. In order to ensure the reliability and security of communication, the signaling unit 331 uses SSL / TLS communication for communication signaling with the authentication unit 41 described later, and uses encrypted User Datagram Protocol (UDP) communication for communication signaling with the node management unit 42 described later. Furthermore, the signaling unit 331 uses HTTP / TLS communication for communication signaling with the cloud control unit 43 described later.

[0037] The local DNS service unit 34 and the resolver unit 332 perform processing for notifying the general node 2 of information required for communication with the corresponding node 200 (such as the virtual IP address of the corresponding node 200).

[0038] The local DNS service unit 34 transmits a DNS Response message to the general node 2 in response to the DNS Request message transmitted from the general node 2. More specifically, the local DNS service unit 34 hooks a DNS packet including the FQDN of the other node 200 from the DNS Request message, and passes the acquired DNS packet to the resolver unit 332. Then, the local DNS service unit 34 returns a DNS Response message including the virtual IP address of the other node 200 (the DNS Response message is generated by the resolver unit 332) to the general node 2.

[0039] In addition, the local DNS service unit 34 may have a function of sending and receiving messages (Neighbor Solicitation messages and Neighbor Advertise messages) for establishing proximity (neighborhood) between the general node 2 and the communication adapter 3, instead of the host setting unit 335.

[0040] The resolver unit 332 generates a DNS Response message including the virtual IP address of the other node 200 based on a Route Direction to Initiator message sent from the node management unit 42, which will be described later. The Route Direction to Initiator message is sent from the node management unit 42 to the communication adapter 3 in response to the transmission of a DNS Request message from the general node 2.

[0041] The interface handling unit 333 is mainly responsible for transmitting and receiving packets to and from the general node 2 for packets exchanged between the general node 2 and the counterpart node 200. The interface handling unit 333 has a function of hooking packets transmitted from the general node 2. More specifically, the interface handling unit 333 has a function of asynchronously hooking packets transmitted from the general node 2 and stacked in the socket queue from the socket queue. The hooked packets are sent to the packet processing transmission unit 334.

[0042] Moreover, the interface handling unit 333 has a function of transmitting packets processed (decapsulated and decrypted) by the packet processing transmission unit 334 to the general node 2. Note that the interface handling unit 333 implements a raw socket and promiscuous mode in order to hook all packets sent from the general node 2.

[0043] The packet processing transmission unit 334 executes various processes related to packets transmitted and received between the general node 2 and the partner node 200. As shown in Fig. 5, the packet processing transmission unit 334 includes a sequence information holding unit 334a, a packet handling unit 334b, and a packet transmission control unit 334c. In this embodiment, the packet handling unit 334b ​​constitutes a "packet processing unit", and the packet transmission control unit 334c constitutes a "transmission unit".

[0044] The order information holding unit 334a holds index information indicating the order of transmission from the general node 2 for packets hooked by the interface handling unit 333. For example, if packet A, packet B, packet C, packet D, and packet E are transmitted in this order, the order information holding unit 334a stores and holds index information such as "A" → "B" → "C" → "D" → "E" as index information.

[0045] The packet handling unit 334b ​​performs processes such as encapsulation and encryption of packets transmitted from the general node 2, and decryption and decapsulation of packets transmitted from the counterpart node 200. Packet encapsulation refers to a process of adding predetermined header information in each layer (transport layer and network layer) (a top-down process in the processing of the communication adapter 3 in FIG. 6). On the other hand, packet decapsulation refers to a process of removing predetermined header information in each layer (a bottom-up process in the processing of the communication adapter 3 in FIG. 6). Encryption is performed using an End Key, which will be described later, as an encryption key. This End Key is also used for encrypting packets in the counterpart node 200.

[0046] The packet handling unit 334b ​​can perform encapsulation and encryption processing in parallel on packets transmitted from the general node 2 and hooked by the interface handling unit 333. The time required to complete the processing differs depending on the packet size. Therefore, for example, packets B and C may be in process while packets A, D, and E may have already been processed. In other words, the processing of a packet transmitted later may be completed earlier than the processing of a packet transmitted earlier. The packet handling unit 334b ​​in this embodiment is configured to perform the above-mentioned parallel processing in data communication processing after a tunnel establishment processing to be described later. The maximum number of simultaneous processes in parallel processing is set to about the same number as the logical threads of the CPU.

[0047] The packet transmission control unit 334c performs a transmission process on the packets processed by the packet handling unit 334b ​​so that the transmission order is the same as the transmission order in the index information held by the order information holding unit 334a. For example, if the processing of packets A, D, and E has already been completed, but the processing of packets B and C has not been completed, the packet transmission control unit 334c waits for the processing of packets B and C to be completed, and then transmits the processed packets B and C, and then transmits the processed packets D and E.

[0048] 4, the host setting unit 335 performs processes related to allocation of virtual IP addresses to the general nodes 2 and Neighbor Discovery Protocol (NDP). The host setting unit 335 includes an address function unit 335a and a router function unit 335b.

[0049] The address function unit 335a has a function equivalent to a Dynamic Host Configuration Protocol (DHCP) server (DHCPv6 server in this embodiment), and performs processing related to allocation of a virtual IPv6 address to the general node 2. More specifically, the address function unit 335a has a function of allocating a virtual IPv6 address to the general node 2 based on "information related to the IP address of the general terminal" transmitted from the authentication unit 41, which will be described later, in response to a request from the general node 2 operating in the Stateful DHCPv6 mode. The virtual IPv6 address is sent to the general node 2 by a DHCPv6 Advertise message.

[0050] The router function unit 335b is used when the general node 2 operates in IPv6 mode, and has a role of supporting the address function unit 335a. The router function unit 335b has a function equivalent to an IPv6 router, and generates an NDP message (such as a Neighbor Advertise message or a Router Advertise message). In this embodiment, when the router function unit 335b receives a Router Solicitation message from a general node 2 operating in IPv6 mode, it generates a Router Advertise message in a state (1) in which a Managed address configuration flag (hereinafter simply referred to as an "M flag") and an Other configuration flag (hereinafter simply referred to as an "O flag") are set. The generated NDP message is transmitted to the general node 2. In addition, the general node 2 that receives the Router Advertise message operates in a Stateful DHCPv6 mode. In this embodiment, the Router Solicitation message corresponds to a "predetermined message".

[0051] The node information management unit 336 stores and manages various information related to the general node 2 (for example, the virtual IPv6 address, MAC address, FQDN, etc. of the general node 2). The information managed by the node information management unit 336 is passed to each functional unit (for example, the host setting unit 335, etc.) constituting the communication adapter 3 as necessary.

[0052] Next, the communication cloud 4 will be described. As shown in Fig. 2, the communication cloud 4 is a cloud service provided on a predetermined computer network (the Internet 100 in this embodiment), and in this embodiment, is connected to an IPv4 / IPv6 dual stack network to support both IPv4 and IPv6. The communication cloud 4 authenticates the general nodes 2 and communication adapters 3, and manages information on the networks to which the general nodes 2 and communication adapters 3 belong. The communication cloud 4 includes an authentication unit 41, a node management unit 42, and a cloud control unit 43.

[0053] The authentication unit 41 is responsible for authentication processing of the general node 2 and the communication adapter 3. Through the authentication processing, the general node 2 and the communication adapter 3 are notified of their virtual IP addresses and FQDNs. The authentication unit 41 also distributes information necessary for information management, such as a common key for encrypting communication between the node management unit 42 and the communication adapter 3. The authentication unit 41 is compatible with both IPv4 and IPv6.

[0054] The node management unit 42 is responsible for registering location information of the general node 2 and the communication adapter 3, and for selecting a path for communication between the general node 2 and the other node 200. The location information registration process is performed to register the network environment of the general node 2 and the communication adapter 3 in the node management unit 42. The path selection process is performed to establish a communication path between the general node 2 and the other node 200.

[0055] The cloud control unit 43 is responsible for general node information acquisition processing, and is for providing the communication adapter 3 with information on the general node 2 connected to the communication adapter 3. The cloud control unit 43 stores and manages various information on the general node 2 in a database 43a. Examples of the various information on the general node 2 include the name, device ID, device password, authentication method (information indicating the authentication method, such as performing authentication using a device ID and a device password), the MAC address of the general node NIC 21, and the IP version used by the general node 2 (whether or not an IPv6 address is used). When multiple general nodes 2 are provided, the cloud control unit 43 stores and manages information for each general node 2.

[0056] In addition, various information of the general node 2 is registered in advance in the cloud control unit 43 by performing a predetermined advance information registration process. Note that the advance information registration process can be performed, for example, by logging in to the communication cloud 4 using a predetermined web service.

[0057] Next, with reference to Fig. 7 etc., various processes performed to enable communication between the general node 2 and the partner node 200 via the overlay network ON, and data communication processes between both nodes 2, 200 will be described. Note that in Fig. 7 etc., processes that are performed asynchronously regardless of the state are indicated by black circles.

[0058] First, as shown in Fig. 7, authentication processing of the communication adapter 3 is performed. In the authentication processing of the communication adapter 3, when the communication adapter 3 is started (step S11), an Adapter's Login Request message is sent from the communication adapter 3 (signaling unit 331) to the authentication unit 41 (step S12). The Adapter's Login Request message includes information required for authentication of the communication adapter 3 by the authentication unit 41 (for example, the Device ID and Device Password of the communication adapter 3, and certificate information).

[0059] When the authentication unit 41 receives the Adapter's Login Request message, it judges whether the Adapter's Login Request message is appropriate. If the Adapter's Login Request message is appropriate (for example, if the Device ID and Device Password are correct), the authentication unit 41 transmits an Adapter's Login Response message to the communication adapter 3 (step S13). The Adapter's Login Response message includes information necessary for the communication adapter 3 to perform overlay network communication (for example, a common key used by the communication adapter 3 in communication with the node management unit 42, the FQDN of the communication adapter 3, the virtual IP address of the communication adapter 3, and the adapter ID of the communication adapter 3). When the communication adapter 3 receives the Adapter's Login Response message, the authentication process of the communication adapter 3 is completed.

[0060] Next, a location information registration process of the communication adapter 3 is performed to register information on the network environment of the communication adapter 3. The location information registration process of the communication adapter 3 is performed by a process of transmitting an Adapter's Registration Request message from the communication adapter 3 to the node management unit 42 (step S14), and a process of transmitting an Adapter's Registration Response message from the node management unit 42 to the communication adapter 3 (step S15). The location information registration process of the communication adapter 3 registers information on the network environment, such as whether or not a router or the like that executes Network Address Port Translation (NAPT) exists between the communication adapter 3 and the Internet 100. In this embodiment, it is assumed that there is no router or the like that executes NAPT between the communication adapter 3 and the Internet 100, but if such a router or the like exists, the contents of various processes may be changed accordingly.

[0061] Following the location information registration process of the communication adapter 3, a general node information acquisition process is performed so that the communication adapter 3 acquires information on the general node 2. In the general node information acquisition process, first, a General Node's information Request message is sent from the communication adapter 3 to the cloud control unit 43 (step S16). This message includes the adapter ID of the communication adapter 3, which is acquired by the communication adapter 3 receiving the Adapter's Login Response message (step S13).

[0062] When the cloud control unit 43 receives the General Node's information Request message, the cloud control unit 43 transmits a General Node's information Response message to the communication adapter 3 (step S17). The General Node's information Response message includes information on the general node 2 extracted from the database 43a based on the adapter ID included in the General Node's information Request message. The information on the general node 2 includes the name, device ID, device password, authentication method, MAC address of the general node NIC 21, IP version used by the general node (information on whether or not an IPv6 address is used), and the like.

[0063] By receiving the General Node's information Response message, the communication adapter 3 obtains information about the general node 2. This completes provisioning in the communication adapter 3 (step S18). As a result, the communication adapter 3 becomes capable of accepting the general node 2, and the general node 2 can be connected to the communication adapter 3. Note that when an attempt is made to connect a node other than the general node 2 to the communication adapter 3, if the communication adapter 3 does not have information about the node, the connection of the node is rejected.

[0064] After the provisioning of the communication adapter 3 is completed, as shown in Fig. 8, when the general node 2 is connected to the communication adapter 3 (step S21), a configuration process of the general node 2 is performed. In the configuration process of the general node 2, first, an Extensible Authentication Protocol (EAP) Request message is sent from the general node 2 to the communication adapter 3 (step S22). EAP is a network authentication protocol that can be used in IEEE802.1X authentication, and EAP provides a framework for exchanging authentication information between a client and an authentication server. Note that a Supplicant, an Authenticator, and a 1X Authentication Server are required to perform IEEE802.1X authentication, and in the communication system 1, the general node 2 corresponds to the Supplicant, the communication adapter 3 corresponds to the Authenticator, and the authentication unit 41 corresponds to the 1X Authentication Server, respectively.

[0065] Next, since the general node 2 in this embodiment operates in IPv6 mode, a Router Solicitation message is transmitted by multicast by the general node 2 (step S23). The Router Solicitation message is defined in NDP and is transmitted to search for nearby routers (upper nodes).

[0066] Furthermore, the general node 2 and the communication adapter 3 each transmit a Neighbor Solicitation message upon detecting the addition of a new node (general node 2 or communication adapter 3) within the same link (steps S24, S27). The Neighbor Solicitation message is transmitted to search for the MAC address of the newly added node. The Neighbor Solicitation message includes the "link-local address of the terminal (general node 2 or communication adapter 3) that generated the message" as the source IP address, the "requested-node multicast address of the target node (terminal requesting MAC address resolution)" as the destination IP address, and the "link-local address of the target node" as the target IP address.

[0067] Then, when the general node 2 and the communication adapter 3 receive the Neighbor Solicitation message, the general node 2 and the communication adapter 3 return a Neighbor Advertise message to the other party (steps S25 and S28). The Neighbor Advertise message is generated by the router function unit 335b. The Neighbor Advertise message includes the "link local address of the terminal (general node 2 or communication adapter 3) that generated the message" as the source IP address, the "link local address of the response destination terminal (general node 2 or communication adapter 3) acquired from the request node multicast address and the target IP address" as the destination IP address, and the "IP address of the target node (IPv6 address included in the Neighbor Solicitation message)" as the target IP address. By transmitting and receiving the Neighbor Solicitation message and the Neighbor Advertise message, the communication adapter 3 and the general node 2 resolve the MAC address of the other party.

[0068] Furthermore, when the MAC address of the general node 2 is resolved, in response to the communication adapter 3 receiving the Router Solicitation message, a Router Advertise message is transmitted from the communication adapter 3 to the general node 2 (step S26). The Router Advertise message has the M flag and the O flag set, and is generated by the router function unit 335b. The Router Advertise message also includes the "link local address of the communication adapter 3" as the source IP address and the "all-nodes multicast address" as the destination IP address.

[0069] Upon receiving the Router Advertise message, the general node 2 operates in the Stateful DHCPv6 mode and is able to acquire a virtual IPv6 address from the communication adapter 3 (address function unit 335a). Therefore, the general node 2 multicasts a DHCPv6 Solicitation message to start searching for a DHCPv6 server (step S29). The DHCPv6 Solicitation message includes "information indicating that its own IP address is unassigned."

[0070] When the communication adapter 3 receives the DHCPv6 Solicitation message, the communication adapter 3 performs authentication processing for the general node 2 on behalf of the general node 2. In the authentication processing for the general node 2, a General Node's Login Request message is transmitted from the communication adapter 3 to the authentication unit 41 (step S30). The General Node's Login Request message includes information for authenticating the general node 2, such as the Device ID and Device Password of the general node 2.

[0071] When the authentication unit 41 receives the General Node's Login Request message, it judges whether the message is appropriate. If the message is appropriate (for example, if the Device ID and Device Password are correct), the authentication unit 41 transmits a General Node's Login Response message to the communication adapter 3 (step S31). The General Node's Login Response message includes information for the general node 2 to perform overlay network communication, such as a common key used by the general node 2 in communication with the node management unit 42, the FQDN of the general node 2, the virtual IPv6 address of the general node 2, and the node ID of the general node 2. The communication adapter 3 receives the General Node's Login Response message and obtains the information, thereby completing the authentication process of the general node 2. In this embodiment, the virtual IPv6 address of the general node 2 included in the General Node's Login Response message corresponds to "information related to the IP address of the general terminal".

[0072] The communication adapter 3 also transmits an EAP Ack message as a response to the EAP Request message (step S32). Furthermore, upon receiving the General Node's Login Response message, the communication adapter 3 returns a DHCPv6 Advertise message to the general node 2 as a response to the DHCPv6 Solicitation message transmitted from the general node 2 (step S29) (step S33). The DHCPv6 Advertise message includes the virtual IPv6 address obtained by receiving the General Node's Login Response message (step S31) and information on the DNS server.

[0073] When the general node 2 receives the DHCPv6 Advertise message, a DHCPv6 Request message is sent from the general node 2 to the communication adapter 3 to request the final determination of the virtual IPv6 address and the provision of network setting information (step S34). The DHCPv6 Request message includes the virtual IPv6 address included in the DHCPv6 Advertise message and accepted by the general node 2.

[0074] The communication adapter 3 that has received the DHCPv6 Request message checks whether the virtual IPv6 address included in the DHCPv6 Request message is valid. If it is confirmed to be valid, the communication adapter 3 determines the final virtual IPv6 address to be assigned to the general node 2. Then, the communication adapter 3 returns a DHCPv6 Reply message including the determined virtual IPv6 address and network setting information (e.g., a default gateway address and a DNS server address) to the general node 2 (step S35). By receiving the DHCPv6 Reply message, the general node 2 is in a state where the virtual IPv6 address to be used in communication with the remote node 200 has been assigned.

[0075] When the general node 2 receives the DHCPv6 Reply message, it executes a process called Duplicate Address Detection (DAD) by transmitting a Neighbor Solicitation message to the communication adapter 3 (step S36). DAD is a process for checking whether the assigned virtual IPv6 address is duplicated with an IP address in another node by using a Neighbor Solicitation message in ICMPv6 (NDP). The Neighbor Solicitation message transmitted in step S36 includes ":: (zero compressed address)" as a source IP address and "a solicited node multicast address for the virtual IPv6 address assigned to the general node 2" as a destination IP address. Here, if a node having the same IP address as the assigned virtual IPv6 address exists in the same link, a Neighbor Advertise message is returned. However, in the communication system 1, since all virtual IPv6 addresses are managed by the communication adapter 3, the communication cloud 4, and the database 43a, a Neighbor Advertise message is not usually returned. The general node 2 does not start overlay network communication until DAD is completed. Furthermore, the communication adapter 3 does not start overlay network communication until the communication management state is up. The communication management state is one of the pieces of information about the general node 2 managed by the communication adapter 3, and is a flag indicating whether the general node 2 is in a state where overlay network communication is possible.

[0076] Furthermore, when the communication adapter 3 receives a General Node's Login Response message from the authentication unit 41, the communication adapter 3 performs location information registration processing of the general node 2 in parallel with the DHCP processing (processing of steps S33 and S35) on behalf of the general node 2. Note that the communication adapter 3 can perform the location information registration processing of the general node 2 and the DHCP processing performed between the communication adapter 3 and the general node 2 asynchronously.

[0077] The location information registration process of the general node 2 is executed by a process of transmitting a General Node's Registration Request message from the communication adapter 3 to the node management unit 42 (step S37), and a process of transmitting a General Node's Registration Response message from the node management unit 42 to the communication adapter 3 (step S38). The location information registration process of the general node 2 registers information on the network environment indicating the presence of a router or the like that executes NAPT. The General Node's Registration Request message is encrypted using a common key used in communication between the general node 2 and the node management unit 42. This common key is acquired by receiving the General Node's Login Response message (step S31).

[0078] The communication adapter 3 receives the General Node's Registration Response message (step S38) and puts the general node 2 in a state up state, thereby becoming capable of hooking and processing packets sent from the general node 2 (step S39).

[0079] Furthermore, the general node 2 and the communication adapter 3 transmit and receive a Neighbor Solicitation message and a Neighbor Advertise message in order to resolve the MAC address for the virtual IP address (steps S40 to S43). This Neighbor Solicitation message includes the "link-local address of the terminal (general node 2 or communication adapter 3) that generated the message" as the source IP address, the "request-node multicast address of the target node" as the destination IP address, and the "virtual IP address of the target node" as the target IP address. Also, this Neighbor Advertise message includes the "link-local address of the terminal (general node 2 or communication adapter 3) that generated the message" as the source IP address, the "link-local address of the response destination terminal (general node 2 or communication adapter 3) acquired from the request-node multicast address and the target IP address" as the destination IP address, and the "IP address of the target node (the virtual IP address included in the Neighbor Solicitation message)" as the target IP address.

[0080] Then, a Router Advertise message is transmitted from the communication adapter 3 to the general node 2 (step S44), thereby completing the configuration process of the general node 2. As a result, provisioning of the general node 2 is completed (step S45).

[0081] When the provisioning of the communication adapter 3 and the general node 2 is respectively completed, the construction process of the overlay network ON is started in response to a message transmission from the general node 2 or the corresponding node 200. The construction process of the overlay network ON includes a route selection process and a tunnel establishment process. Here, the route selection process and the tunnel establishment process will be explained separately as each process performed in response to a message transmission from the general node 2 and each process performed in response to a message transmission from the corresponding node 200.

[0082] First, with reference to FIG. 9, a route selection process and a tunnel establishment process that are performed in response to a message transmission from a general node 2 will be described.

[0083] In this route selection process, first, a DNS Request message is sent from the general node 2 to the communication adapter 3 (step S51). The DNS Request message includes the FQDN of the remote node 200 acquired in advance. The DNS Request message is sent with the "virtual IPv6 address of the general node 2" assigned by the communication adapter 3 as the source address and the "gateway address" as the destination address.

[0084] When the communication adapter 3 (local DNS service unit 34) receives a DNS Request message (DNS packet), the communication adapter 3 (resolver unit 332) generates a Direction Request message based on the acquired DNS packet. The Direction Request message includes network environment information of the general node 2, information about the general node 2 (such as a node ID), and a Path ID that uniquely defines a communication path. The Path ID is managed in association with information about the general node 2, etc. The generated Direction Request message is transmitted from the communication adapter 3 to the node management unit 42 (step S52).

[0085] When the node management unit 42 receives the Direction Request message, it acquires information about the general node 2 from the cloud control unit 43 (database 43a) based on the node ID included in the message. Then, the node management unit 42 generates a Route Direction to Responder message based on the acquired information, and transmits this message to the counterpart node 200 (step S53).

[0086] When the Route Direction to Responder message is received by the correspondent node 200 and the correspondent node 200 is in a state where communication is possible, a Route Direction Confirmation message is returned from the correspondent node 200 to the node management unit 42 (step S54). In other words, a message indicating that the correspondent node 200 is in a state where communication is possible is returned to the node management unit 42.

[0087] When the node management unit 42 receives the Route Direction Confirmation message, it generates a Route Direction to Initiator message including a Path ID that uniquely defines a communication path in a base header, and transmits this message to the communication adapter 3 (step S55). Note that the Route Direction to Initiator message is encrypted with a common key used in communication with the communication adapter 3.

[0088] After the Route Direction to Initiator message is transmitted (step S55), a tunnel establishment process is performed. In the tunnel establishment process, the communication adapter 3 generates an End Key for the general node 2, and generates a Tunnel Request message including the End Key for the general node 2. Then, the generated Tunnel Request message is transmitted from the communication adapter 3 to the remote node 200 (step S56). Note that the communication path between the communication adapter 3 and the remote node 200 is determined by the processes of steps S52 to S55. The communication path is acquired by a Path ID.

[0089] When the correspondent node 200 receives the Tunnel Request message, it checks the End Key included in the Tunnel Request message. As a result, the correspondent node 200 and the general node 2 share a common End Key. The correspondent node 200 then generates a Tunnel Response message including this End Key, and returns the generated Tunnel Response message to the communication adapter 3 (step S57). The return of the Tunnel Response message completes the tunnel establishment process.

[0090] When the communications adapter 3 receives a Tunnel Response message, it extracts the End Key contained in this message and stores and manages the End Key in the node information management unit 336. During subsequent data communications processing, packets are encrypted and decrypted using this End Key.

[0091] After the tunnel establishment process, a DNS Response message is sent from the communication adapter 3 to the general node 2 as a response to the DNS Request message (step S58). Here, the DNS Response message is generated as follows. That is, the communication adapter 3 that has received the Route Direction to Initiator message (step S55) refers to the information related to the general node 2 managed by the node information management unit 336 based on the Path ID included in the message, and acquires the information of the general node 2 and a common key used in communication between the general node 2 and the node management unit 42. Then, the communication adapter 3 uses the acquired common key to decrypt the Route Direction to Initiator message and acquires the Body part of the message. Note that the route selection process is a process for enabling the general node 2 to start a data communication process described later, so the Route Direction to Initiator message is decrypted by the common key used in communication between the general node 2 and the node management unit 42, not by the common key used in communication between the communication adapter 3 and the node management unit 42.

[0092] Next, the communication adapter 3 (resolver unit 332) generates a DNS Response message using the virtual IPv6 address of the general node 2 included in the acquired body part. The DNS Response message includes the virtual IP address of the remote node 200. Note that a virtual IP address, FQDN, etc. are set in advance in the remote node 200. The setting of the virtual IP address, etc. for the remote node 200 can be performed by the remote node 200 (particularly a device program installed in the remote node 200) executing a process substantially similar to the configuration process of the general node 2 described above.

[0093] A DNS Response message is sent from the communication adapter 3 to the general node 2, and the general node 2 is notified of the virtual IP address of the corresponding node 200, which corresponds to the FQDN of the corresponding node 200. As a result, the route selection process is completed, and the process of establishing the overlay network ON is also completed. The virtual IP address of the corresponding node 200 is a network address in the same band as the virtual IPv6 address of the general node 2. Therefore, the general node 2 understands that the corresponding node 200 is located on the same network as itself. However, the general node 2 and the corresponding node 200 are actually located on different networks.

[0094] Next, a description will be given of the route selection process and tunnel establishment process that are performed in response to a message transmission from the remote node 200. As shown in Fig. 10, in this route selection process, the same processes as those in steps S52 to S55 described above are performed with the targets of transmission and reception swapped (steps S71 to S74). As a result, the communication route between the remote node 200 and the communication adapter 3 is established, and the route selection process is completed.

[0095] Thereafter, in the tunnel establishment process, the same processes as those in steps S56 and S57 described above are performed with the transmission and reception targets swapped (steps S75 and S76), thereby completing the tunnel establishment process.

[0096] When the route selection process and the tunnel establishment process are completed, and the gateway proxy process described later is also completed, data communication processing between the general node 2 and the other node 200 becomes possible. In the data communication process, as shown in Figs. 9 and 10, link layer communication (steps S61, S64, S78, S81) is performed between the general node 2 and the communication adapter 3, and overlay network communication (steps S62, S63, S77, S82) of L3 or higher is performed between the communication adapter 3 and the other node 200. In this embodiment, packet communication is basically performed according to UDP. Note that encapsulated packets (data) are transmitted and received between the communication adapter 3 and the other node 200. In the data communication process, the communication adapter 3 controls communication and processing so that the transmission order of the processed packets to be transmitted to the other node 200 is the same as the transmission order of the packets sent from the general node 2, as described above.

[0097] Furthermore, when the general node 2 receives a DNS Response message (step S58 in FIG. 9) or receives a packet from the corresponding node 200 (step S78 in FIG. 10) and the general node 2 is notified of the virtual IP address of the corresponding node 200, gateway proxy processing is performed. In the gateway proxy processing, a Neighbor Solicitation message is transmitted from the general node 2 to resolve the MAC address for the notified virtual IP address (steps S59, S79). This message is transmitted by multicast to terminals present on the same link, so that the communication adapter 3 receives this message.

[0098] The communication adapter 3 that received the Neighbor Solicitation message transmits a Neighbor Advertise message to the general node 2 in order to establish itself, rather than the remote node 200, as a neighbor (neighboring node) of the general node 2 (step S60 in FIG. 9 and step S80 in FIG. 10). The Neighbor Advertise message includes the MAC address of the communication adapter 3. By transmitting the Neighbor Advertise message, the gateway proxy process is completed, and in the general node 2, the virtual IP address of the remote node 200 is associated with the MAC address of the communication adapter 3.

[0099] Here, the processing performed on the packet in the data communication processing between the general node 2 and the counterpart node 200 will be described in more detail. As shown in FIG. 6, when the general node 2 transmits a packet (data) including the virtual IPv6 address of the general node 2 as the source to the virtual IP address of the counterpart node 200, the virtual IP address of the counterpart node 200 is associated with the MAC address of the communication adapter 3, so the packet is transmitted to the communication adapter 3 by link layer communication (L2 communication). The communication adapter 3 hooks the transmitted packet, encapsulates the packet, and encrypts it using the End Key obtained by the Tunnel Response message. Furthermore, the communication adapter 3 encapsulates the packet into a real IP packet (a packet including the real IP address of the communication adapter 3 as the source) using the real IP address of the communication adapter 3 (by adding a Real IP Header). Therefore, the virtual IPv6 address of the general node 2 is encapsulated with the real IP address of the communication adapter 3. Then, the communication adapter 3 transmits the real IP packet to the counterpart node 200 using the constructed tunnel.

[0100] On the other hand, the correspondent node 200, which has almost the same functions as the communication adapter 3, extracts the virtual IPv6 address of the general node 2 and application data by decoding and decapsulating the received real IP packet.

[0101] Then, when a packet including the virtual IP address of the other node 200 as the source is returned from the virtual NIC 202 in the other node 200 to the virtual IP address of the extracted general node 2, the device program (daemon program 201) installed in the other node 200 hooks the packet and performs the same process as that performed by the communication adapter 3 on the packet. That is, the packet is encapsulated and encrypted using an End Key, and the packet is encapsulated into a real IP packet (a packet including the real IP address of the other node 200 as the source) using the real IP address of the other node 200. Then, the real IP packet is returned to the communication adapter 3 using the constructed tunnel. Therefore, communication is performed between the communication adapter 3 and the other node 200 using real IP addresses.

[0102] The communication adapter 3 that receives the real IP packet from the remote node 200 decrypts and decapsulates the real IP packet and sends it to the general node 2. The general node 2 can extract the virtual IP address of the remote node 200 from the sent packet. Therefore, the general node 2 and the remote node 200 (the application of the remote node 200) behave as if they are directly transmitting and receiving data via the overlay network ON using the virtual IP address. As a result, the real network environment is hidden from the general node 2 and the remote node 200 (the application of the remote node 200).

[0103] As described above in detail, according to this embodiment, packets transmitted from the general nodes 2 are processed in parallel by the packet handling unit 334b, so that communication performance (throughput) can be improved.

[0104] On the other hand, the communication adapter 3 holds index information indicating the transmission order of packets from the general node 2, and transmits processed packets in the same order as the transmission order in this index information. This makes it possible to prevent discrepancies between the transmission order of packets from the general node 2 and the transmission order of packets from the communication adapter 3, thereby further improving communication performance (throughput).

[0105] Furthermore, when the general node 2 and the counterpart node 200 (especially the application of the counterpart node 200) communicate using TCP, the packet transmission order is likely to be shifted due to the influence of the retransmission control mechanism and congestion control algorithm. However, by configuring the communication adapter 3 as described above, good communication performance can be obtained even when communication is performed using TCP.

[0106] Furthermore, in this embodiment, the packet recombination processing function (GRO) in the first NIC 31 is disabled. Therefore, in the communication adapter 3 that processes received packets individually, it is possible to more reliably prevent problems related to packet processing, and thus it is possible to more reliably achieve the above-mentioned advantageous effects.

[0107] In addition, a virtual IPv6 address based on the "information related to the IP address of the general terminal" transmitted from the authentication unit 41 is assigned to the general node 2. Therefore, the virtual IPv6 address assigned to the general node 2 can be appropriately managed.

[0108] Furthermore, when allocating a virtual IPv6 address to the general node 2, the communication adapter 3 functions as a so-called DHCPv6 server and an IPv6 router. Therefore, the communication system 1 can be simplified and made compact.

[0109] Next, in order to confirm the effects of the above embodiment, the following test was performed. That is, as shown in Fig. 11, a closed network 300 with a maximum link speed of 1 Gbps was prepared, and a general node 2, a communication adapter 3, a communication cloud 4 (authentication unit 41 and node management unit 42), and a counterpart node 200 were arranged in the closed network 300. Then, as the communication adapter 3, a communication adapter according to the above embodiment (present adapter) and a communication adapter according to a conventional method (conventional adapter) were prepared, and the average round-trip time, throughput, and jitter between the general node 2 and the counterpart node 200 when each adapter was used were measured.

[0110] The present adapter is a communication adapter configured to process packets in parallel, and to transmit processed packets to the counterpart node 200 in the same order as the packets sent from the general node 2. On the other hand, the conventional adapter is a communication adapter that processes packets in parallel, and transmits processed packets to the counterpart node 200 in the order in which the processing is completed, and the transmission order of the processed packets does not necessarily match the transmission order of the packets sent from the general node 2.

[0111] The average round trip time was measured using Internet Control Message Protocol (ICMP). Furthermore, iperf3 was used to measure the throughput when communication was performed according to TCP (TCP throughput) and when communication was performed according to UDP (UDP throughput). Note that the UDP-related measurements were taken in a 30Mbps bandwidth. As jitter can only be measured when communication was performed according to UDP, the jitter in this case was measured.

[0112] In addition, in the test, macOS (registered trademark) Monterey version 12.2 8GB Dual-core 2.20GHz Core i7-5650U was used as the general node 2. Furthermore, the communication adapter 3 and the other node 200 were configured using Raspberry Pi 4 Model B 4GB Quad-core 1.5GHz Broadcom BCM2711. Figure 12 shows the test results when the conventional adapter was used, and Figure 13 shows the test results when the present adapter was used.

[0113] As shown in Figures 12 and 13, it was confirmed that the present adapter has good communication performance similar to that of the conventional adapter in terms of the average round trip time and throughput when communicating by UDP. Also, as shown by the throughput when communicating by TCP, it was found that the present adapter has extremely high communication performance when communicating by TCP compared to the conventional adapter.

[0114] From the above test results, in order to obtain good communication performance whether UDP or TCP is used, it is preferable to configure the communication adapter so that it processes packets in parallel and sends the processed packets to the remote node 200 in the same order as the packets sent from the general node 2.

[0115] The present invention is not limited to the above-described embodiment, and may be implemented as follows: Of course, other applications and modifications not exemplified below are also possible.

[0116] (a) In the above embodiment, the general node 2 is assumed to operate in IPv6 mode, but it may also operate in IPv4 mode (i.e., be assigned a virtual IPv4 address). In this case, the configuration process of the general node 2, which is performed after the general node 2 and the communication adapter 3 are connected, is performed as follows.

[0117] 14, when the general node 2 and the communication adapter 3 are connected (step S91), an EAP Request message and a DHCP Discover message are transmitted from the general node 2 to the communication adapter 3 (steps S92, S93). The transmission process of the EAP Request message is the same as the process of step S22 in the above embodiment. The DHCP Discover message includes "information indicating that its own IP address is unallocated" and corresponds to the DHCPv6 Solicitation message (step S29) in the above embodiment.

[0118] The communication adapter 3, which has received the DHCP Discover message, uses this message as a trigger to start authentication processing of the general node 2. In the authentication processing of the general node 2, similar to steps S30 and S31 in the above embodiment, the communication adapter 3 transmits a General Node's Login Request message to the authentication unit 41 (step S94), and the authentication unit 41 returns a General Node's Login Response message to the communication adapter 3 (step S95). As a result, the communication adapter 3 obtains information for the general node 2 to perform overlay network communication, such as the virtual IPv4 address of the general node 2, and as a result, the authentication processing of the general node 2 is completed.

[0119] Then, following the transmission of an EAP Ack message from the communications adapter 3 to the general node 2 as a response to the EAP Request message (step S96), a DHCP Offer message is transmitted from the communications adapter 3 to the general node 2 (step S97). This DHCP Offer message includes the virtual IPv4 address of the general node 2, which is included in the General Node's Login Response message.

[0120] Thereafter, by performing the processes of steps S98 to S102, which are the same as the processes of steps S34 to S38 in the above embodiment, a virtual IPv4 address is finally assigned to the general node 2, and the location information registration process of the general node 2 is completed, thereby completing the configuration process of the general node 2. The general node 2 can perform overlay network communication using this virtual IPv4 address.

[0121] Incidentally, the "DHCP Ack message" in step S99 corresponds to the "DHCPv6 Reply message" in step S35.

[0122] Moreover, the "ARP Request message" in step S100 is a special ARP packet called Gratuitous ARP (GARP), which corresponds to the "Neighbor Solicitation message" in step S36, and is sent to check whether the assigned virtual IPv4 address overlaps with an IP address in another node. The source IP address and destination IP address in this ARP Request message include the "virtual IPv4 address assigned to the general node 2." If a node having the same IP address as the assigned virtual IPv4 address exists in the same link, an ARP Response message is returned; however, in the communication system 1, since all virtual IP addresses are managed by the communication adapter 3, the communication cloud 4, and the database 43a, an ARP Response message is not usually returned.

[0123] (b) In the above embodiment, the gateway proxy process is performed by transmitting and receiving a Neighbor Solicitation message and a Neighbor Advertise message. In contrast, in cases such as when a virtual IPv4 address is assigned to the general node 2, the gateway proxy process may be performed using Proxy ARP. That is, as shown in Fig. 15, the gateway proxy process may be performed by transmitting and receiving an ARP Request message and an ARP Response message in parallel with the tunnel establishment process in the general node 2 and the communication adapter 3 (steps S110 and S111).

[0124] (c) In the above embodiment, one general node 2 is provided, but it is also possible to provide multiple general nodes 2. In this case, the multiple general nodes 2 may be connected to one communication adapter 3, and the single communication adapter 3 may be configured to enable processing related to each general node 2 to be executed.

[0125] (d) In the above embodiment, the configuration process of the general node 2 employs an authentication method using EAP, but in order to accommodate a general node 2 that does not support EAP or certificate authentication, an authentication method using MAC address matching that does not use EAP (no EAP Request message (step S92) or EAP Ack message (step S96) is sent or received) may be employed, as shown in Fig. 16. More specifically, the communication adapter 3, which has the MAC address of the general node 2 through the general node information acquisition process, may compare the MAC address acquired from the DHCP Discover message (step S93) with the MAC address possessed by the communication adapter 3, and if both MAC addresses exist, may use the MAC address as a key to acquire a Device ID and Device Password preregistered in the cloud control unit 43, and perform authentication with the authentication unit 41 using the Device ID and the like (steps S94, S95). [Explanation of symbols]

[0126] 1...communication system, 2...general node (general terminal), 3...communication adapter, 31...first NIC (physical network interface card), 41...authentication unit, 100...Internet (computer network), 333...interface handling unit (hook unit), 334a...sequence information holding unit, 334b...packet handling unit (packet processing unit), 334c...packet transmission control unit (transmitting unit), ON...overlay network.

Claims

1. A communications adapter used to connect a specific general terminal to an overlay network constructed on a specific computer network, and installed between the computer network and the general terminal, comprising: a hook unit for hooking a packet transmitted from the general terminal; a sequence information storage unit that stores index information indicating a transmission sequence of packets hooked by the hook unit; a packet processing unit capable of performing predetermined processes in parallel on the packets hooked by the hook unit; a transmitting unit that performs transmission processing of packets processed by the packet processing unit so that the transmission order is the same as the transmission order in the index information stored by the order information storage unit.

2. a physical network interface card connected to the general terminal and configured to receive packets transmitted from the general terminal; 2. The communications adapter according to claim 1, wherein a function of combining a plurality of packets is disabled in said physical network interface card.

3. A communication adapter according to claim 1 and a predetermined general terminal, A communication system configured so that the general terminal and a predetermined counterpart terminal can communicate with each other via the communication adapter and the overlay network, an authentication unit capable of executing an authentication process for the general terminal and transmitting information related to an IP address of the general terminal to the communication adapter through the authentication process; The communication adapter includes: A function of operating the general terminal in a Stateful DHCPv6 mode upon receipt of a predetermined message from the general terminal; a function of allocating a virtual IPv6 address to the general terminal based on information related to the IP address of the general terminal transmitted from the authentication unit in response to a request from the general terminal operating in a Stateful DHCPv6 mode; A communication system, wherein the general terminal uses the assigned virtual IPv6 address in communication with the counterpart terminal.

Images