Communication control device, communication control method, and communication control program

Abstract

To prevent communication control using a NAPT function from causing various servers to be unable to respond to terminal devices connected to a private network.SOLUTION: One or more processors of a communication control device are configured to associate first information set in a first node connected to a first network, second information set in a second node connected to a second network, and third information of functions provided by a third node connected to the first network and the second network, receive a communication packet including at least one of the first information and the second information, and the third information of functions provided by the third node, and permit access from the first node or the second node to the functions provided by the third node based on a combination of the at least one of the first information and the second information, and the third information included in the received communication packet.SELECTED DRAWING: Figure 5

Description

[Technical Field]

[0001] The present invention relates to a communication control device, a communication control method, and a communication control program. [Background technology]

[0002] As a standard specification for communication control devices, communication specifications for IP packets are defined in Layer 3 (network layer) of the OSI (Open System Interconnection) reference model. NAPT (Network Address Port Translation) is known as an address conversion method in communication control devices that connect a terminal device on a WAN (Wide Area Network) side, which is a global network, with a terminal device on a LAN (Local Area Network) side, which is a private network connected to a private network (Patent Document 1). [Prior art documents] [Patent documents]

[0003] [Patent Document 1] Japanese Patent Application Laid-Open No. 2008-022213 Summary of the Invention [Problem to be solved by the invention]

[0004] The disclosures of the above-mentioned prior art documents are incorporated herein by reference.The following analysis was conducted by the inventors.

[0005] However, communication control using the NAPT function can sometimes cause problems, such as a terminal device connected to a private network not receiving a response when accessing various servers such as an SSH (Secure SHell) server.

[0006] In view of the above-mentioned problems, the object of the present invention is to contribute to preventing communication control using the NAPT function in a network system including a global network and a private network from causing a problem in which a terminal device connected to a private network does not receive a response when accessing various servers such as an SSH server. [Means for solving the problem]

[0007] In a first aspect of the present invention, there is provided a communication control device including one or more processors, wherein the one or more processors are configured to associate first information set in a first node connected to a first network, second information set in a second node connected to a second network, and third information on functions provided by a third node connected to the first network and the second network, receive a communication packet including at least one of the first information and the second information and the third information on functions provided by the third node, and permit access from the first node or the second node to the function provided by the third node based on a combination of at least one of the first information and the second information and the third information included in the received communication packet.

[0008] In a second aspect of the present invention, there is provided a communication control method including an association step, a receiving step, and an authorization step. The association step associates first information set in a first node connected to a first network, second information set in a second node connected to a second network, and third information on functions provided by a third node connected to the first network and the second network. The receiving step receives a communication packet including at least one of the first information and the second information and the third information on functions provided by the third node. The authorization step authorizes access from the first node or the second node to the function provided by the third node based on a combination of at least one of the first information and the second information and the third information included in the received communication packet.

[0009] In a third aspect of the present invention, there is provided a communication control program that causes one or more processors of a communication control device to execute an association process, a reception process, and an authorization process. The association process associates first information set in a first node connected to a first network, second information set in a second node connected to a second network, and third information on functions provided by a third node connected to the first network and the second network. The reception process receives a communication packet including at least one of the first information and the second information and the third information on functions provided by the third node. The authorization process authorizes access from the first node or the second node to the function provided by the third node based on a combination of at least one of the first information and the second information and the third information included in the received communication packet. The program may be recorded on a computer-readable storage medium, which may be a non-transitory storage medium such as a semiconductor memory, a hard disk, a magnetic recording medium, or an optical recording medium. The program may be embodied as a computer program product. [Effects of the Invention]

[0010] According to each aspect of the present invention, in a network system including a global network and a private network, communication control using the NAPT function can contribute to preventing a problem in which a terminal device connected to the private network cannot receive a response when accessing various servers such as an SSH server. [Brief explanation of the drawings]

[0011] [Figure 1A] FIG. 1A is a diagram illustrating an example of the configuration and operation of a network system according to an embodiment of the present disclosure. [Figure 1B] FIG. 1B is a diagram illustrating an example of the configuration and operation of a network system according to an embodiment of the present disclosure. [Figure 2] FIG. 2 is a diagram illustrating an example of the configuration of an information processing device that performs information processing in a communication control device and one or more terminal devices in a network system. [Figure 3] FIG. 3 is a diagram illustrating an example of the configuration and operation of a network system according to an embodiment of the present disclosure. [Figure 4] FIG. 4 is a diagram illustrating an example of an access information list used by a communication processing device in a communication control device of a network system for processing for communication control. [Figure 5] FIG. 5 is a flowchart showing the processing of the communication processing device in the communication control device of the network system shown in FIG. [Figure 6A] FIG. 6A is a diagram illustrating a communication sequence between a terminal device, a WAN-side interface, a LAN-side interface, and communication control, a NAPT function, and an SSH server function realized by a communications processing device. [Figure 6B] FIG. 6B is a diagram illustrating a communication sequence between a terminal device, a WAN-side interface, a LAN-side interface, and communication control, a NAPT function, and an SSH server function realized by a communications processing device. [Figure 6C] FIG. 6C is a diagram illustrating a communication sequence between a terminal device, a WAN-side interface, a LAN-side interface, and communication control, a NAPT function, and an SSH server function realized by a communications processing device. [Figure 7] FIG. 7 is a diagram illustrating an example of the configuration and operation of a network system according to an embodiment of the present disclosure. [Figure 8] FIG. 8 is a flowchart showing the processing of the communication processing device in the communication control device of the network system shown in FIG. DETAILED DESCRIPTION OF THE INVENTION

[0012] Hereinafter, embodiments of the present disclosure will be described with reference to the drawings. However, the present disclosure is not limited to the embodiments described below. Furthermore, in each drawing, the same or corresponding elements are appropriately designated by the same reference numerals, and the same or corresponding processes and communications are appropriately designated by the same reference numerals. Furthermore, the drawings are schematic.

[0013] [First embodiment] First, a first embodiment according to the present disclosure will be described. Figures 1A and 1B are diagrams illustrating an example configuration of a network system 1 according to an embodiment of the present disclosure and its operation. Figure 2 is a diagram illustrating an example configuration of a communication control device 14 of the network system 1, one or more terminal devices 100, and an information processing device 2 that performs information processing in one or more terminal devices 120.

[0014] 1A and 1B, network system 1 includes a global network 10, the scope of which is not limited, such as the Internet, a private network 12, such as a LAN, and a communication control device 14, which connects global network 10 and private network 12 and provides functions such as communication control. Devices and functions that can be the main actors in information processing and communication, such as global network 10, private network 12, communication control device 14, terminal devices 100 and 120, communication processing functions, and SSH server functions, are also generally referred to as nodes.

[0015] Terminal devices 100, such as PCs (Personal Computers) capable of sending and receiving (hereinafter referred to as "sending and receiving") communication packets used for communication via the network, are connected to global network 10. Terminal devices 120, which send and receive communication packets similar to those of terminal device 100 (hereinafter referred to as "communication"), are connected to global network 10. An IP address (first information) W1 used in global network 10 is assigned and set to one or more terminal devices 100. An IP address (second information) L1 used in private network 12 is assigned and set to terminal device 120. In addition, hereinafter, an IP address used in global network 10 will be referred to as an IP address of global network 10, and an IP address used in private network 12 will be referred to as an IP address of private network 12.

[0016] The terminal devices 100 and 120 are installed with application programs that enable access to and use of the SSH server and TELNET server. The SSH server and TELNET server are virtually implemented by the communications processing device 140 and are connected to the communications function so that communication packets can be sent and received (the same applies below). The SSH server function and TELNET server function implemented by the communications processing device 140 are provided to the terminal devices 100 and 120 via the global network 10 and the private network 12 (the same applies below). In other words, workers and administrators of the network system 1 can use the terminal devices 100 and 120 to access the SSH server and TELNET server and use the functions provided by these servers. These components enable the network system 1 to realize communication between one or more terminal devices 100 connected to the global network 10 and one or more terminal devices 120 connected to the private network 12.

[0017] The communication control device 14 comprises a communication processing device 140, a WAN side interface (WAN side IF) 142, and a LAN side interface 144 (LAN side IF). The communication processing device 140 performs processing to realize communication control functions, etc. The WAN side interface 142 realizes an interface function between the communication processing device 140 and the global network 10. The LAN side interface 144 realizes an interface function between the communication processing device 140 and the private network 12.

[0018] The information processing device 2 shown in Fig. 2 will now be described. The communication control function and SSH server function of the communication control device 14 of the network system 1, and information processing such as communication control in the terminal devices 100 and 120, can be performed, for example, by the information processing device 2 illustrated in Fig. 2. As shown in Fig. 2, the information processing device 2 includes one or more CPUs (Central Processing Units; processors) 200, a main storage device 202, an auxiliary storage device 204, and an interface device 206, which are connected via an internal bus, for example, so as to be able to input and output data to and from each other. The CPU 200 executes instructions and commands included in a program executed by the information processing device 2, and required to realize the communication control processing and information processing in the terminal devices 100 and 120, and to realize the communication control function, SSH server function, and other information processing in the communication control device 14, etc.

[0019] The main memory device 202 includes memory elements such as RAM (Random Access Memory) and ROM (Read Only Memory). The main memory device 202 includes instructions to be executed by the CPU 200, and temporarily stores programs and data required for realizing information processing in the communication control device 14 and the terminal devices 100 and 120 in the memory elements.

[0020] The interface device 206 provides functions for interfacing with input devices (not shown) such as a keyboard, mouse, and pen tablet, output devices (not shown) such as a display and printer, and the WAN side interface 142 and LAN side interface 144 (e.g., FIG. 1A) with the CPU 200, as well as input and output data required for interfacing between the WAN side interface 142 and the LAN side interface 144.

[0021] The auxiliary storage device 204 includes a nonvolatile storage device (not shown), such as a hard disk drive (HDD), a solid state drive (SSD), or a flash memory. The auxiliary storage device 204 stores programs executed by the communication control device 14 and the terminal devices 100 and 120, as well as data required for their execution, in a medium- to long-term manner. A nonvolatile storage medium such as a USB memory can be detachably connected to the auxiliary storage device 204. The auxiliary storage device 204 can read and write data from the connected nonvolatile storage device. The programs executed by the communication control device 14 and the terminal devices 100 and 120, as well as data required for their execution, can be provided as a program product recorded on a non-transitory computer-readable storage medium such as a CD-ROM or DVD (neither of which is shown) that can be detachably attached to the auxiliary storage device 204. Alternatively, such programs and data can be provided as a program product downloaded from a server device to a personal computer (PC) or other device (neither of which is shown) via a network.

[0022] Referring again to FIG. 1A , the communication control device 14 implements a communication control function for communication between the terminal devices 100 and 120, as well as an SSH server function for remotely operating and managing the terminal devices 100 and 120, and a NAPT function. However, the SSH server function implemented by the communication processing device 140 is merely an example, and the communication processing device 140 can implement various functions for communication between the terminal devices 100 and 120 in addition to the NAPT function. Note that the IP address W1 and TCP port number (e.g., the SSH server's default value "22"; third information) of the global network 10 for remotely accessing the SSH server (hereinafter referred to as "SSH access") are made public and open to an operator who uses the SSH server function of the communication control device 14. The NAPT function is enabled in the communication control device 14. The communication processing device 140 performs processing for implementing the communication control, NAPT function, and SSH server function of the communication control device 14.

[0023] A console tool is installed in the terminal devices 100, 120, which provides a function that enables an operator to perform SSH access to the communication control device 14 and log in to operate the SSH server function. In response to an operator's operation of the console tool, the terminal device 100 performs SSH access to the communication control device 14, with IP address W1 and TCP port number 22 of the SSH server function of the communication control device 14 as the destination. The WAN-side interface 142 receives this SSH access via the global network 10 and outputs it to the communication processing device 140.

[0024] The NAPT function implemented by the communications processing device 140 converts the TCP port number 22 included as the destination in the SSH access from the terminal device 100 input via the WAN-side interface 142 into the IP address L1 of the LAN-side interface 144. Furthermore, the NAPT function outputs the SSH access including the IP address L1 as the destination IP address to the SSH server function implemented by the communications processing device 140. Furthermore, the NAPT function stores correspondence information indicating the correspondence between the IP addresses and TCP port numbers before and after the conversion in a NAPT table (not shown) stored in the main storage device 202 (FIG. 2) of the information processing device 2. In other words, the NAPT function stores the TCP port number 22 and IP address W1 before the conversion and the IP address L1 after the TCP port number 22 is converted in the NAPT table in association with each other.

[0025] When the SSH server function receives an SSH access addressed to IP address L1 from the NAPT function, due to security requirements, it does not process a response via WAN-side interface 142, but processes a response via LAN-side interface 144. Furthermore, the SSH server function returns a response including IP address L1 as the source address to the NAPT function.

[0026] Upon receiving this response, the NAPT function refers to the NAPT table, converts the source IP address L1 to IP address W1, and transmits a response including the IP address W1 and TCP port number 22 to the terminal device 100 via the WAN-side interface 142. The terminal device 100 receives the response including the IP address W1 as the source IP address from the communication control device 14 via the global network 10. The processing of the communication control device 14 described above realizes communication for the terminal device 100 and the worker using it as if SSH access had been made to TCP port 22 of the SSH server using IP address W1, remote control had been performed on the communication control device 14, and the response had been obtained.

[0027] [Second embodiment] A second embodiment of the present disclosure will be described below. In the communication using the NAPT function described above with reference to Fig. 1A, as will be described with reference to Fig. 1B, the terminal device 120 connected to the LAN-side interface 144 may not be able to respond to access from the terminal device 100 connected to the WAN-side interface 142. For example, in response to an operator's operation on a console tool, the terminal device 120 performs SSH access to the communication control device 14, specifying IP address W1 of the global network 10 and TCP port number 22 of the communication control device 14 as the destination. The LAN-side interface 144 receives this SSH access via the private network 12 and outputs it to the communication processing device 140.

[0028] Because private network 12 is connected to LAN-side interface 144, the IP address W1 and TCP port number 22 included as the destination in the SSH access from terminal device 120 are not subject to address translation by the NAPT function implemented by communications processing device 140. Therefore, this SSH access sent from private network 12 is output to LAN-side interface 144 in accordance with IP address W1, but because, unlike communications processing device 140, LAN-side interface 144 cannot implement an SSH server function, the SSH access from terminal device 120 to the SSH server function of communications control device 14 ends in failure.

[0029] Such a problem can be avoided by setting the destination of an SSH access from terminal device 120 to the SSH server function of communication control device 14 to an IP address of private network 12 on the LAN-side interface 144 side, rather than an IP address of global network 10 on the WAN-side interface 142 side. However, in reality, the SSH server function of communication control device 14 only anticipates SSH access from the administrator of network system 1 and terminal device 100 via global network 10. Therefore, information such as IP address L1 required for SSH access from the private network 12 side may not be provided to the worker.

[0030] This problem can be solved by configuring the NAPT function of the communication control device 14 to virtually handle SSH access from the terminal device 120 to the communication control device 14 as SSH access from the terminal device 100 to the communication control device 14. However, such configuration of the NAPT function must be performed every time the terminal device 120 that performs SSH access to the communication control device 14 is changed, for example, when SSH access is performed from one of multiple terminal devices 120 to the communication control device 14, which is extremely time-consuming and places a heavy burden on the administrator of the network system 1, etc.

[0031] The above-mentioned problem is not resolved even if a worker moves the terminal device 100 connected to the global network 10 and connects it to the private network 12 without changing its configuration information, as described above with reference to FIG. 1A. While the above-mentioned problem can be resolved by devising and changing the connection destination settings of the terminal device 100 connected to the private network 12, changing the settings of the terminal device 100 is still extremely time-consuming and burdensome for the worker. Referring to FIG. 1B, a problem was described when the SSH server function of the communication control device 14 is remotely operated from the terminal device 120. However, the above-mentioned problem can occur not only in the communication protocol for SSH access using the NAPT function, but also in various communication protocols in Layer 3 of the OSI reference model.

[0032] [Third embodiment] A third embodiment of the present disclosure will be described below. To resolve the above-mentioned problems, hairpin NAT (Network Address Translation) Hairpinning) technology defined in RFC4787 and the like can be used. According to the hairpin NAT technology, the NAPT function of the communication control device 14 is extended, and the IP address of the private network 12 is converted so that communication using the IP addresses of the global network 10 is possible among multiple terminal devices 120. In other words, when the NAPT function of the communication control device 14 is extended by hairpin NAT, the IP address L1 of the private network 12 used by the terminal device 120 as the source IP address is converted to the IP address W1 of the global network 10. The converted IP address W1 is used for communication among the multiple terminal devices 120. In this way, converting the source IP address L1 of the private network 12 to the IP address W1 of the global network 10 for communication among the terminal devices 120 may be referred to as "IP address wrapping" or the like.

[0033] When the NAPT function of the communication control device 14, which is extended by the hairpin NAT technology, converts the source IP address L1 of the private network 12 into the IP address W1 of the global network 10, the terminal device 120 becomes able to use the SSH server function for the communication control device 14, as described with reference to FIG. 1A. However, in the private network 12, communication may be mainly performed between multiple terminal devices 120. In such a case, the processing required to convert the IP address L1 of each of the multiple terminal devices 120 into the IP address W1 of the global network 10 is clearly more wasteful than the processing required to simply communicate using the IP address L1 of the private network 12 without conversion. Furthermore, the processing required for such address conversion increases the processing load on the communication processing device 140.

[0034] Therefore, applying hairpin NAT technology to a private network 12 where communication is mainly conducted between multiple terminal devices 120 may cause communication failures and a decrease in security in the private network 12. Furthermore, if both the normal NAPT function and the NAPT function extended by hairpin NAT technology use the NAPT table stored in the main memory device 202, this may cause problems such as the storage area for the NAPT table becoming too large or the storage area of ​​the main memory device 202 becoming depleted.

[0035] [Fourth embodiment] A fourth embodiment according to the present disclosure will now be described. FIG. 3 is a diagram illustrating an example of the configuration and operation of a network system 3 according to an embodiment of the present disclosure. FIG. 4 is a diagram illustrating an example of an access information list used by a communication processing device 160 for communication control processing in a communication control device 16 of the network system 3. As shown in FIG. 3, the network system 3 is configured by replacing the communication control device 14 of the network system 1 shown in FIGS. 1A and 1B with the communication control device 16, and the communication control device 16 is configured by replacing the communication processing device 140 with the communication processing device 160. The network system 3 can eliminate problems that may occur when the terminal device 120 communicates with an SSH server function or the like, and problems related to the NAPT table, without extending the NAPT function using hairpin NAT technology.

[0036] 3 virtually realizes functions such as a communication control function, a NAPT function, and an SSH server function, similar to the communication processing device 140. In addition to these functions, the communication processing device 160 also virtually realizes a TELNET server function. The communication control function realized by the communication processing device 160 uses an access information list (FIG. 4) to perform processing for communication between multiple terminal devices 120, communication between the terminal devices 100 and 120, and SSH access from the terminal devices 100 and 120.

[0037] 4, the access information list stored in the main memory device 202 of the information processing device 2 includes n entries (n is an integer). The ith (i is an integer from 1 to n) entry of the access information list includes, in association with each other, IP address information of the global network 10 of the destination (WAN side IP address information RWi), IP address information of the private network 12 that is used as the IP address of the destination after IP address return (LAN side IP address information; RLi), and port number information RPi that specifies the TCP port number of a server function such as an SSH server function implemented by the communications processing device 160.

[0038] FIG. 4 illustrates an example in which the WAN-side IP address information RW1 and RW2 included in the first entry is W1, the LAN-side IP address information RL1 and RL2 is L1, the port number information RP1 is 22 (RP1=22), and the port number information RP2 is 23 (RP2=23). The TCP port number 22 is generally treated as the initial value of the TCP port number of an SSH server. The TCP port number 23 is generally treated as the initial value of the TCP port number of a TELNET server. The LAN-side IP address information, LAN-side IP address information, and TCP port number information may overlap among multiple entries in the access information list. The access information list is created, for example, by processing the NAPT function or by an input operation by the administrator of the network system 3 to the communication processing device 160.

[0039] First, an overview of communication control by the communication processing device 160 will be explained. Note that this explanation omits communication control by the communication control function realized by the communication processing device 160. When the communication processing device 160 receives a communication packet, it determines whether or not this communication packet has been received via the WAN-side interface 142.

[0040] The communication packets that are the subject of this judgment are any of communication packets sent and received in communication between multiple terminal devices 120, communication between terminal devices 100 and 120, or communication between terminal devices 100 and 120 and the communication control function and SSH server function implemented by communication processing device 160. When a communication packet is received from a location other than LAN-side interface 144, that is, from WAN-side interface 142 or the TCP port of the SSH server function, the communication control function outputs the destination IP address and TCP port number contained in this communication packet to the NAPT function. The NAPT function refers to the access information list using the destination IP address and TCP port number input from the communication control function.

[0041] If the NAPT function determines that the combination of the destination IP address and TCP port number information contained in the communication packet is found in the access information list, it notifies the communication processing function of this. Upon receiving this notification, the communication control function transfers the communication packet to the TCP port of the SSH server function indicated by the TCP port number information. The SSH server function processes the transferred communication packet and, in response to this communication packet, sends a communication packet to the communication control function that includes the TCP port number of the SSH server function and the IP address of the private network 12 as the source IP address.

[0042] The communication control function outputs to the NAPT function the TCP port number of the SSH server function and the IP address of the private network 12 included in the communication packet transmitted from the SSH server function. The NAPT function refers to the access information list, reads from the access information list the IP address of the global network 10 that corresponds to the combination of the TCP port number of the SSH server function and the IP address of the private network 12 input from the communication control function, and outputs this to the communication control function. The communication control function converts the IP address of the private network 12 included as the source IP address of the communication packet received from the SSH server function by replacing it with the IP address of the global network 10 read from the access information list. The communication control function transmits the communication packet with the converted source IP address to the terminal device 100, 120 that requested the SSH server function via the WAN-side interface 142.

[0043] As explained above, the NAPT function using the access information list returns the IP address of the communication packet. As explained above with reference to Fig. 4, the combination of the communication control function and the NAPT function realized by the communication processing device 160 eliminates problems that may occur when an SSH access is made from the terminal device 100 that has made the SSH access.

[0044] The processing of the network system 3 shown in Fig. 3 will be described in further detail below. Fig. 5 is a flowchart showing processing S10 of the communication processing device 160 in the communication control device 16 of the network system 3 shown in Fig. 3. In S100 of S10, the communication control function realized by the communication processing device 160 determines whether or not a communication packet has been received from either of the terminal devices 100, 120. If the communication processing device 160 has received a communication packet (Y in the processing of S100), it proceeds to processing of S102, and if it has not received a communication packet (N in the processing of S100), it remains in processing of S100. Note that the communication packets received by the communication control function from the terminal devices 100, 120 are used, for example, by the terminal devices 100, 120 for SSH access or data communication with other terminal devices 100, 120.

[0045] In S102, the communication control function determines whether the communication packet has been received via the LAN-side interface 144. If the communication packet has been received via the LAN-side interface 144 (Y in the process of S102), the communications processing device 160 proceeds to the process of S104. If the communication packet has not been received via any interface other than the LAN-side interface 144 (N in the same process), the communications processing device 160 proceeds to the process of S12. When the communication packet is not received via the LAN-side interface 144, the communications control function receives the communication packet via the WAN-side interface 142, or from the SSH server function or TELNET server function realized by the communications processing device 160.

[0046] In S104, the communication control function outputs the IP address RLi and port number information RPi of the private network 12 included as the destination IP address in the received communication packet to the NAPT function. The NAPT function references the access information list (FIG. 4) and searches for the combination of IP address and TCP port number information input from the communication control function. If the combination of IP address and TCP port number information input from the communication control function is found, the NAPT function returns the IP address RWi of the global network 10 corresponding to this combination to the communication control function. On the other hand, if the combination of IP address and TCP port number information input from the communication control function is not found, the NAPT function returns information to that effect to the communication control function.

[0047] In S106, the communication control function determines whether the combination of the IP address RLi and port number information RPi of the private network 12 included as the destination IP address in the received communication packet is present in the access information list. In other words, this determination is a determination as to whether the IP address RWi corresponding to this combination has been returned from the NAPT function. If the combination of the IP address RLi and port number information RPi is present in the access information list (Y in S106), the communication control function proceeds to S14; if this combination is not present (N in S106), the communication control function proceeds to S12. After S12 is completed, the communication processing device 160 returns to S100. In other words, only when the terminal device 120 performs an SSH access are the communication packets used for this SSH access subject to the processing of S14, and other communication packets are subject to the processing of S12.

[0048] In S12, the communication control function controls data communication between the terminal devices 100 and 120. Alternatively, the communication control function performs processing to transmit a response from the SSH server function to the terminal device 100 that has made the SSH access.

[0049] In S140 of S14, the communication control function converts the IP address RLi and the IP address RWi corresponding to the port number information RPi used in the processing of S106 into the source IP address, and generates a communication packet including the port number information RPi as the destination. The port number information RPi is the TCP port number 22 of the SSH server function. The communication control function outputs the generated communication packet to the SSH server function as a communication packet for SSH access.

[0050] In S142, the communication control function determines whether or not a response communication packet has been received from the SSH server function in response to the communication packet for SSH access transmitted in the process of S140. If the response communication packet has been received (Y in the process of S142), the communication control function proceeds to the process of S144, and if the response communication packet has not been received (N in the process of S142), the communication control function remains in the process of S142.

[0051] In S142, the communication control function outputs the IP address RWi to the NAPT function. The NAPT function returns the IP address RLi corresponding to the IP address RWi to the communication control function. In S144, the communication control function converts the IP address RWi included as the source IP address in the response communication packet into the IP address RLi. In S146, the communication control function transmits the communication packet whose source IP address has been converted in the processing of S142 to the terminal device 100 that has made the SSH access. After completing the processing of S146, the communication processing device 160 returns to the processing of S100.

[0052] The following describes a communication sequence between the terminal devices 100, 120, the WAN-side interface 142 and LAN-side interface 144, and the communication control, NAPT function, and SSH server function realized by the communication processing device 160. Figures 6A to 6C are diagrams illustrating an example of a communication sequence between the terminal devices 100, 120, the WAN-side interface 142 and LAN-side interface 144, and the communication control, NAPT function, and SSH server function realized by the communication processing device 160.

[0053] 6A is a diagram illustrating a communication sequence from when a communication packet for SSH access is transmitted from the terminal device 120 to the communication control device 16 until the terminal device 120 receives a response communication packet from the SSH server. FIG. 6B is a diagram illustrating a communication sequence from when a communication packet for SSH access is transmitted from the terminal device 100 to the communication control device 16 until the terminal device 120 receives a response communication packet from the SSH server. FIG. 6C is a diagram illustrating a communication sequence from when the terminal device 100 requests the communication control device 16 for data communication with the terminal device 120 until data communication is performed between the terminal devices 100 and 120.

[0054] However, Figures 6A to 6C only illustrate communications for simply sending and receiving communication packets, and do not take into consideration communications for compliance with communication protocols. Also, Figures 6A to 6C do not cover all of the communication sequences that can occur by the processing shown in Figure 5, but it would be obvious to those skilled in the art what communication sequences can occur between nodes included in network system 3 by the processing shown in Figure 5.

[0055] First, with reference to Fig. 6A, a communication sequence will be described in which the terminal device 100 performs SSH access to the SSH server function and receives a communication packet as a response from the SSH server function. In S300, the terminal device 120 transmits a communication packet for SSH access to the communication control function via the LAN-side interface 144. Note that this communication packet includes, for example, the destination TCP port number 22 (the initial setting value of the SSH server function) and the source IP address L1, as shown in Fig. 4. The communication control function performs the processes of S100 and S102 shown in Fig. 5.

[0056] In S302, the communication control function outputs the destination TCP port number 22 and the pre-conversion IP address L1 to the NAPT function. The communication control function and the NAPT function perform the processes of S104 to S106 shown in FIG.

[0057] In S304, the NAPT function outputs the converted IP address W1 to the communication control function. In S306, the communication control function converts the IP address L1 to the IP address W1 and transmits a communication packet for SSH access to the SSH server function. The SSH server function receives the communication packet from the communication control function and performs processing as an SSH server (S140 shown in FIG. 5).

[0058] In S308, the SSH server function outputs a communication packet to the communication control function, which includes the source TCP port number 22 and IP address W1, permitting access and responding as the SSH server. In S310, the communication control function outputs the source TCP port number 22 and IP address W1 included in this communication packet to the NAPT function.

[0059] In S312, the NAPT function outputs the source TCP port number 22 and the IP address L1 corresponding to the IP address W1 to the communication control function (S142 and S144 shown in FIG. 5). Furthermore, in S314, the communication control function performs the process of S144 shown in FIG. 5, and transmits a communication packet for responding to the SSH access, in which the source IP address W1 has been converted to IP address L1, via the LAN-side interface 144 to the terminal device 120 that made the SSH access (S146).

[0060] Next, with reference to Figure 6B, a communication sequence will be described in which terminal device 120 performs SSH access to the SSH server function and receives a response communication packet from the SSH server function. Note that the communications and processes indicated by dotted lines in Figure 6B represent communications and processes that are performed in the communication sequence shown in Figure 6A but are not performed in the communication sequence shown in Figure 6B. Therefore, a description of the communications and processes performed in the communication sequence shown in Figure 6A will be omitted.

[0061] In S320, terminal device 120 transmits a communication packet for SSH access to the communication control function. This communication packet includes, for example, destination TCP port number 22 (the initial setting value of the TCP port number of the SSH server function) and source IP address W1, as shown in Fig. 4. The communication control function performs the processes of S100 and S102 shown in Fig. 5. Depending on the results of these processes, the processes of S302 to S304 shown in Fig. 6A are not performed.

[0062] In S326, the communication control function outputs a communication packet for SSH access to the SSH server function without converting the source IP address W1. In S334, the communication control function does not perform the process of S144 shown in Fig. 5, but transmits a communication packet in response to the SSH access to the terminal device 100 that made the SSH access via the WAN-side interface 142 (S12).

[0063] Next, a communication sequence for data communication between the terminal devices 100 and 120 will be described with reference to Fig. 6C. In S340, the terminal device 100 transmits a communication packet including, for example, a source IP address W1 and a destination IP address Wi to the communication control function in order to set up a communication path between the terminal devices 100 and 120. When the communication control function receives this communication packet via the WAN-side interface 142, it performs the process of S100 shown in Fig. 5.

[0064] At S342, the communication control function outputs the destination IP address Wi contained in the received communication packet to the NAPT function. At S344, the NAPT function returns the converted IP address Li corresponding to the destination IP address Wi before conversion to the communication control function. At S346, the communication control function transmits a communication packet including the source IP address W1 and the destination IP address Li of the terminal device 120 via the LAN-side interface 144 to the terminal device 120 to request the establishment of a communication path between the terminal device 100 and the terminal device 120.

[0065] In S348, the terminal device 120 transmits a communication packet including the source IP address Li and the destination IP address W1 to the communication control function to respond that it is possible to set up a communication path with the terminal device 100. The communication control function receives this communication packet via the LAN-side interface 144.

[0066] In S350, the communication control function outputs the source IP address Li contained in the received communication packet to the NAPT function. In S352, the NAPT function returns the converted IP address Wi corresponding to the destination IP address Li before conversion to the communication control function. In S354, the communication control function indicates that a communication path has been established between the terminal devices 100 and 120, and transmits a communication packet including the source IP address Wi and the destination IP address W1 to the terminal device 100 via the WAN-side interface 142. In S356, a communication path is established between the terminal devices 100 and 120, and data communication is performed between them. It will be obvious to those skilled in the art that the communication control function for data communication between multiple terminal devices 100 can be performed without using the NAPT function.

[0067] In the network system 3, data communication between multiple terminal devices 120 connected to the terminal device 120 is performed using the IP addresses of the terminal devices 120 set in each of the multiple terminal devices 120. Therefore, the communication control function does not use the NAPT function for data communication between multiple terminal devices 120. Furthermore, according to the communication control method shown in FIGS. 5 and 6A, SSH access from the terminal device 120 set in the private network 12 to the SSH server function realized by the communication processing device 160 is performed normally, and no problems occur. Furthermore, even if the administrator of the network system 3 does not apply the SSH server IP address L1 or does not anticipate use of the SSH function of the communication control device 16 from the global network 10, the worker using the terminal device 100 can use the SSH function of the communication control device 16.

[0068] 5 and 6A to 6C, the problems described in the second embodiment can be resolved, the work of operators and system administrators can be significantly reduced, and the cost required for maintaining the network system 3 can be reduced. Furthermore, since it is not necessary to use hairpin NAT for communications between all terminal devices 120, the processing load on the communication control device 16 can be reduced.

[0069] As described above, the network system 3 is configured to process communication packets from the private network 12 for accessing the functions provided by the communication control device 16 as if they were communication packets from the global network 10. Therefore, according to the network system 3, the functions of the communication control device 16 can be accessed and used in the same way whether from the global network 10 or the private network 12.

[0070] 4, an operator using the terminal device 120 can access the SSH server function and remotely control the communication control device 16 without being aware of the IP address L1 of the terminal device 120. Also, by appropriately changing the contents of the access information list, various functions provided by the communication control device 16 can be used by various communication protocols from many application programs executed on the terminal devices 100 and 120.

[0071] [Fifth embodiment] A fifth embodiment according to the present disclosure will now be described. Fig. 7 is a diagram illustrating an example configuration and operation of a network system 4 according to an embodiment of the present disclosure. As shown in Fig. 7, the network system 4 is configured such that a plurality of private networks 12-1 and 12-2 are connected to the LAN-side interface 144 of the communication control device 16 in the network system 3, and terminal devices 120-1 and 120-2 are connected to the private networks 12-1 and 12-2, respectively. In the network system 4, as in the network system 3, the communication processing device 160 of the communication control device 16 realizes a communication control function, a NAPT function, an SSH server function, and a TELNET server function, and the NAPT function uses the access information list shown in Fig. 4.

[0072] 8 is a flowchart showing process S16 of the communication processing device 160 in the communication control device 16 of the network system 4 shown in FIG. 7. Note that, as is clear from a comparison of FIG. 5 and FIG. 8, process S16 is the same as process S10, except that process S102 of process S10 shown in FIG. 5 is replaced by process S162. In S162 of S16, the communication control function determines whether the communication packet has been received via the WAN-side interface 142. If the communication packet has been received via the WAN-side interface 142 (Y in S162), the communication processing device 160 proceeds to process S104. If the communication packet has not been received via an interface other than the WAN-side interface 142 (N in S162), the communication processing device 160 proceeds to process S12. Note that the communication packet may be received via the LAN-side interface 144, not via the WAN-side interface 142, by the communication control function, or may be received from the SSH server function or TELNET server function realized by the communication processing device 160.

[0073] For example, terminal device 120-2 transmits a communication packet including destination IP address W1 and destination TCP port number 22 to communication control device 16 for SSH access. In S162 shown in FIG. 8, this communication packet is received by communication processing device 160 via LAN-side interface 144, so in this case, communication processing device 160 proceeds to processing of S12. The communication processing device 160 performs the processing of S12 as described with reference to FIGS. 5 and 6B, and the SSH server function performs processing as an SSH server in response to the SSH access from terminal device 120-2, and returns a communication packet including TCP port number 22 and source IP address W1 as a response to terminal device 120-2. Terminal device 120-2 receives this communication packet.

[0074] Also, for example, terminal device 120-1 transmits a communication packet including destination IP address W1 and destination TCP port number 23 to communication control device 16 in order to access the TELNET server. In this case, too, communications processing device 160 proceeds to the processing of S12. Communications processing device 160 performs the processing of S12 as described with reference to Figures 5 and 6B, and the TELNET server function performs processing as a TELNET server in response to the access from terminal device 120-1, and returns a communication packet including TCP port number 23 and source IP address W1 in response to terminal device 120-1. Terminal device 120-1 receives this communication packet.

[0075] As described above, by transmitting a communication packet including the appropriate TCP port number for the SSH server function and the TELNET function from either of terminal devices 120-1 and 120-2, these functions can be accessed and used. Furthermore, when accessing and using these functions, the workers using terminal devices 120-1 and 120-2 do not need to know the existence of the NAPT function or the contents of the access information list.

[0076] As described above, by appropriately modifying the conditions for determining the access rights in the processes of S100 and S102 included in the process of S10 shown in FIG. 5 as shown in FIG. 8, for example, only the terminal devices 120-1 and 120-2 defined by the processes of S100 and S102 can be permitted to access and use the functions of the communication control device 16. Therefore, by modifying only a small part of the process without affecting the overall processing of the network system 4, it is possible to provide the functions of the communication control device 16 to workers and the like while improving security. Note that, to use the functions of the communication control device 16, it is also possible to use information (e.g., an ID number) that can uniquely identify a series of communication processes, such as a UTP port number and a protocol number, instead of a TCP port number. In this way, in the network system 4, information other than a TCP port number can be flexibly used to provide functions to workers and the like. [Industrial Applicability]

[0077] The present disclosure can be widely used in communication control devices, networks, and communication control methods thereof. In particular, the present disclosure can be widely used in networks that use the NAPT function in standard communication specifications at Layer 3 (network layer) of the OSI reference model.

[0078] Some or all of the above embodiments can be described as, but are not limited to, the following supplementary notes. [Appendix 1] A communication control device including one or more processors, wherein the one or more processors are configured to associate first information set in a first node connected to a first network, second information set in a second node connected to a second network, and third information on functions provided by a third node connected to the first network and the second network, receive a communication packet including at least one of the first information and the second information and the third information on functions provided by the third node, and permit access from the first node or the second node to the function provided by the third node based on a combination of the first information and at least one of the second information and the third information included in the received communication packet. [Appendix 2] A communication control device as described in Appendix 1, which, when the communication packet received from the second node includes the third information, uses the third information to allow the second node to access the function corresponding to the third information. [Appendix 3] A communication control device as described in Appendix 1 or 2, which, when the communication packet received from the second node includes the first information of the sender, further uses the second information corresponding to a combination of the third information and the first information to permit the second node to access the function corresponding to the third information. [Appendix 4] A communication control device described in any of Appendices 1 to 3, wherein the first information is a first IP address set in the first node, the second information is a second IP address set in the second node, and the third information is a port number of a function provided by the third node. [Appendix 5] 5. The communication control device according to any one of claims 1 to 4, wherein the communication control device receives a response from the function including the second IP address, and converts the second IP address into the first IP address. [Appendix 6] A communication control device as described in any one of appendices 1 to 5, which receives a response from the function including the first IP address and transmits the response from the function to the second node by a communication packet whose destination is the second IP address corresponding to the combination of the port number of the function and the first IP address. [Appendix 7] 7. The communication control device according to any one of claims 1 to 6, wherein the first network is a global network and the second network is a private network. [Appendix 8] A communication control device described in any of Appendices 1 to 6, wherein the first node and the second node are terminal devices that can access the function and receive a response from the function, and the function includes at least one of an SSH server function and a TELNET server function. [Appendix 9] A communication control method including an association step, a receiving step, and an authorization step. The association step associates first information set in a first node connected to a first network, second information set in a second node connected to a second network, and third information on functions provided by a third node connected to the first network and the second network. The receiving step receives a communication packet including at least one of the first information and the second information and the third information on functions provided by the third node. The authorization step authorizes access from the first node or the second node to the function provided by the third node based on a combination of at least one of the first information and the second information and the third information included in the received communication packet. [Appendix 10] A communication control program that causes one or more processors of a communication control device to execute an association process, a reception process, and an authorization process. The association process associates first information set in a first node connected to a first network, second information set in a second node connected to a second network, and third information on functions provided by a third node connected to the first network and the second network. The reception process receives a communication packet including at least one of the first information and the second information and the third information on functions provided by the third node. The authorization process authorizes access from the first node or the second node to the function provided by the third node based on a combination of at least one of the first information and the second information and the third information included in the received communication packet. It goes without saying that combinations of the various forms described in the appendix of this disclosure, or any combination of the elements described in each aspect and embodiment (including the non-selection of some elements), can be made at any time by those skilled in the art in accordance with the basic concept of this disclosure.

[0079] The disclosures of the above-cited patent documents and other documents are incorporated herein by reference. Modifications and adjustments of the embodiments and examples are possible within the scope of the entire disclosure of the present invention (including the claims), and further based on the basic technical concept thereof. Furthermore, various combinations and selections (including partial deletions) of various disclosed elements (including elements of each claim, each element of each embodiment or example, each element of each drawing, etc.) are possible within the scope of the entire disclosure of the present invention. In other words, the present invention naturally embraces various modifications and alterations that would be possible by those skilled in the art in accordance with the entire disclosure and technical concept, including the claims. In particular, the numerical ranges set forth herein should be construed as specifically describing any numerical value or subrange within the range, even if not otherwise specified. Furthermore, the disclosures of the above-cited documents are deemed to be included in the disclosure of this application, in part or in whole, which may be used in combination with the disclosures herein, as necessary, in accordance with the spirit of the present invention. [Explanation of symbols]

[0080] 1,3,4 Network System 10 Global Network 100,120 terminal equipment 12 Private Networks 14,16 Communication control device 140,160 Communication processing device 142 WAN side interface 144 LAN side interface 2. Information processing equipment 200 CPU 202 Main storage 204 Auxiliary storage 206 Interface Device

Claims

1. A communication control device comprising one or more processors, The one or more processors: associates first information set in a first node connected to a first network, second information set in a second node connected to a second network, and third information of a function provided by a third node connected to the first network and the second network; receiving a communication packet including at least one of the first information and the second information and third information of a function provided by the third node; permitting access from the first node or the second node to a function provided by the third node based on a combination of at least one of the first information and the second information included in the received communication packet and the third information; It is configured as follows: Communications control device.

2. When the communication packet received from the second node includes the third information, the third information is used to permit the second node to access the function corresponding to the third information. The communication control device according to claim 1 .

3. When the communication packet received from the second node includes the first information of a sender, the second information corresponding to a combination of the third information and the first information is further used to permit the second node to access the function corresponding to the third information. The communication control device according to claim 2 .

4. the first information is a first IP address set in the first node, the second information is a second IP address set in the second node, The third information is a port number of a function provided by the third node. The communication control device according to claim 3 .

5. receiving a response from the function including the second IP address; Translating the second IP address to the first IP address The communication control device according to claim 4.

6. receiving a response including the first IP address from the function, and transmitting the response from the function to the second node by a communication packet whose destination is the second IP address corresponding to the combination of the port number of the function and the first IP address; The communication control device according to claim 5 .

7. the first network is a global network; The second network is a private network. The communication control device according to claim 6.

8. the first node and the second node are terminal devices that can access the function and receive a response from the function; The functions include at least one of an SSH server function and a TELNET server function. The communication control device according to claim 6.

9. an association step of associating first information set in a first node connected to a first network, second information set in a second node connected to a second network, and third information of functions provided by a third node connected to the first network and the second network; a receiving step of receiving a communication packet including at least one of the first information and the second information and third information of a function provided by the third node; an authorization step of authorizing access from the first node or the second node to a function provided by the third node based on a combination of at least one of the first information and the second information included in the received communication packet and the third information; A communication control method including:

10. an association process for associating first information set in a first node connected to a first network, second information set in a second node connected to a second network, and third information on functions provided by a third node connected to the first network and the second network; a receiving process for receiving a communication packet including at least one of the first information and the second information and third information of a function provided by the third node; an authorization process that authorizes access from the first node or the second node to a function provided by the third node based on a combination of at least one of the first information and the second information included in the received communication packet and the third information; A communication control program that causes one or more processors of a communication control device to execute the above.

Images