Method, system, and program for relay
The relay method and system secure access to IoT devices by varying the connection destination based on terminal identification, enhancing security and reducing costs and delays.
Patent Information
- Application Number
- JP2025175715
- Authority / Receiving Office
- JP · JP
- Patent Type
- Applications
- Current Assignee / Owner
- Filing Date
- 2025-10-17
- Publication Date
- 2025-12-25
AI Technical Summary
Assigning a global IP address to a target terminal allows easy access but poses a security risk as third parties can access the terminal.
A relay method and system that uses a connection management device to acquire terminal identification information, identify a first relay device, associate connection information, and relay communication between a client and target terminal, ensuring secure access by varying the connection destination.
Enables secure access to target terminals by making it difficult for third parties to identify connection information, reducing communication delays and costs, and avoiding the need for additional encryption.
Smart Images
Figure 2025188262000001_ABST
Abstract
Description
[Technical Field]
[0001] The present invention relates to a relay method, a relay system, and a relay program for relaying communication between a client terminal and a target terminal. [Background technology]
[0002] When maintaining, operating, and managing an IoT (Internet of Things) system, it is necessary to make target terminals as IoT devices accessible. As a method for a user to access a target terminal, Patent Document 1 discloses a system that notifies a global IP address assigned to the target terminal in response to a user's request. [Prior art documents] [Patent documents]
[0003] [Patent Document 1] Patent No. 5973049 Summary of the Invention [Problem to be solved by the invention]
[0004] By assigning a global IP address to a target terminal, the user can easily access the target terminal using the global IP address. However, when a global IP address is assigned to a target terminal, third parties other than the user can access the target terminal, which poses a security risk.
[0005] The present invention has been made in consideration of these points, and has as its object to provide a relay method, a relay system, and a relay program that enable secure access to a target terminal. [Means for solving the problem]
[0006] A relay method according to a first aspect of the present invention is a relay method executed by a relay system that relays communication between a client terminal and a target terminal with which the client terminal communicates, and includes: an acquisition step of acquiring terminal identification information that identifies the target terminal from the client terminal; an identification step of, upon acquiring the terminal identification information, identifying a first relay device that will relay the communication from among multiple relay devices provided in the relay system and identifying connection information for the client terminal to connect to the first relay device; a storage control step of associating the connection information with the terminal identification information and storing them in a memory unit; a notification step of notifying the client terminal of the identified connection information; and a relay step of, upon receiving access from the client terminal based on the connection information, relaying the communication between the client terminal and the target terminal based on the terminal identification information associated in the memory unit. [Effects of the Invention]
[0007] According to the present invention, it is possible to obtain an effect that a target terminal can be accessed securely. [Brief explanation of the drawings]
[0008] [Figure 1] 1 is a diagram illustrating an overview of a relay system according to an embodiment of the present invention. [Figure 2] FIG. 2 is a diagram illustrating a configuration of a connection management device according to the present embodiment. [Figure 3] FIG. 2 is a diagram illustrating a configuration of a first relay device according to the present embodiment. [Figure 4] FIG. 2 is a diagram illustrating a configuration of a second relay device according to the present embodiment. [Figure 5] FIG. 10 is a sequence diagram showing a processing flow related to registration of authentication information. [Figure 6] FIG. 10 is a sequence diagram showing a flow of processing related to identification of a first relay device that relays communication. [Figure 7] FIG. 10 is a sequence diagram showing a process flow relating to communication relay. DETAILED DESCRIPTION OF THE INVENTION
[0009] [Relay System S Overview] 1 is a diagram showing an overview of a relay system S according to this embodiment. The relay system S is a system that relays communication between a client terminal 4 and a target terminal 5 as an IoT device.
[0010] The relay system S includes a connection management device 1, a plurality of first relay devices 2 constituting a mobile network such as 4G or 5G, and a plurality of second relay devices 3. The first relay device 2 is a proxy server located in a network external to a core network in the mobile network. The second relay device 3 is a proxy server located in a network internal to the core network in the mobile network. A target terminal 5 is located inside the mobile network and is assigned a private IP address in the mobile network. The target terminal 5 is connected to one of the plurality of second relay devices 3. Note that although only one target terminal 5 is shown in FIG. 1, it is assumed that multiple target terminals 5 actually exist.
[0011] The connection management device 1 of the relay system S acquires a SIM (Subscriber Identity Module) unique number as terminal identification information for identifying the target terminal 5, which is a terminal that is remotely accessed, from the client terminal 4. The SIM unique number is, for example, an IMSI (International Mobile Subscriber Identity).
[0012] When the connectivity management device 1 acquires the SIM unique number from the client terminal 4, it identifies a first relay device 2 among the multiple first relay devices 2 that relays communication between the client terminal 4 and the target terminal 5, and identifies connection information for the client terminal 4 to connect to the first relay device 2. In the example shown in FIG. 1 , the connectivity management device 1 identifies the first relay device 2-1 as the first relay device 2 that relays communication between the client terminal 4 and the target terminal 5, and identifies connection information for the client terminal 4 to connect to the first relay device 2-1.
[0013] The connectivity management device 1 associates the identified connection information with the SIM unique number and stores the associated information in a storage unit, and notifies the client terminal 4 of the connection information. The client terminal 4 accesses one of the multiple first relay devices 2 based on the connection information notified by the connectivity management device 1. The first relay device 2 accessed by the client terminal 4 identifies the second relay device 3 to which the target terminal 5 is connected based on the SIM unique number associated with the connection information in the storage unit, and relays communication between the client terminal 4 and the target terminal 5 via the identified second relay device 3.
[0014] 1, the first relay device 2-1 identifies the second relay device 3-2 as the second relay device 3 to which the target terminal 5 is connected. The first relay device 2-1 relays communication between the client terminal 4 and the target terminal 5 via the second relay device 3-2.
[0015] In this way, the relay system S makes the first relay device 2, which is the connection destination to which the client terminal 4 connects in order to communicate with the target terminal 5, variable, making it difficult for a third party to identify the first relay device 2 that is the connection destination, thereby improving security.
[0016] [Configuration of connection management device 1] Next, the configurations of the connection management device 1, first relay device 2, and second relay device 3 included in the relay system S will be described. First, the configuration of the connection management device 1 will be described. FIG. 2 is a diagram showing the configuration of the connection management device 1 according to this embodiment. As shown in FIG. 2, the connection management device 1 includes a communication unit 11, a storage unit 12, and a control unit 13.
[0017] The communication unit 11 is a communication interface for communicating with the client terminal 4. The storage unit 12 is a storage medium including a ROM (Read Only Memory), a RAM (Random Access Memory), etc. The storage unit 12 stores a program executed by the control unit 13. For example, the storage unit 12 stores a management device program that causes the control unit 13 to function as an authentication information management unit 131, an acquisition unit 132, an identification unit 133, a storage control unit 134, and a notification unit 135. The management device program is part of a relay program that relays communication between the client terminal 4 and the target terminal 5.
[0018] The control unit 13 is, for example, a CPU (Central Processing Unit). The control unit 13 executes a management device program stored in the storage unit 12, thereby functioning as an authentication information management unit 131, an acquisition unit 132, an identification unit 133, a storage control unit 134, and a notification unit 135. Details of these functions will be described later.
[0019] [Configuration of the first relay device 2] Next, a description will be given of the configuration of the first relay device 2. Fig. 3 is a diagram showing the configuration of the first relay device 2 according to this embodiment. As shown in Fig. 3, the first relay device 2 includes a communication unit 21, a storage unit 22, and a control unit 23.
[0020] The communication unit 21 is a communication interface for communicating with the connection management device 1, the second relay device 3, and the client terminal 4. The storage unit 22 is a storage medium including a ROM, a RAM, etc. The storage unit 22 stores a program executed by the control unit 23. For example, the storage unit 22 stores a first relay device program that causes the control unit 23 to function as a first relay unit 231. The first relay device program is part of a relay program that relays communication between the client terminal 4 and the target terminal 5.
[0021] The control unit 23 is, for example, a CPU. The control unit 23 functions as a first relay unit 231 by executing a program for the first relay device stored in the storage unit 22. The function of the first relay unit 231 will be described in detail later.
[0022] [Configuration of the second relay device 3] Next, a description will be given of the configuration of the second relay device 3. Fig. 4 is a diagram showing the configuration of the second relay device 3 according to this embodiment. As shown in Fig. 4, the second relay device 3 includes a communication unit 31, a storage unit 32, and a control unit 33.
[0023] The communication unit 31 is a communication interface for communicating with the first relay device 2 and the target terminal 5. The storage unit 32 is a storage medium including a ROM, a RAM, etc. The storage unit 32 stores a program executed by the control unit 33. For example, the storage unit 32 stores a second relay device program that causes the control unit 33 to function as a second relay unit 331. The second relay device program is part of a relay program that relays communication between the client terminal 4 and the target terminal 5.
[0024] The control unit 33 is, for example, a CPU. The control unit 33 functions as a second relay unit 331 by executing a program for the second relay device stored in the storage unit 32. The function of the second relay unit 331 will be described in detail later.
[0025] Next, a detailed description will be given of the functions of the control unit 13 of the connection management device 1, the control unit 23 of the first relay device 2, and the control unit 33 of the second relay device 3. In the following description, the details of the functions of each control unit will be described with reference to sequence diagrams as appropriate.
[0026] [Register authentication information] First, a description will be given of the details of the function related to the registration of authentication information of the client terminal 4. The function related to the registration of authentication information is realized by the authentication information management unit 131. Fig. 5 is a sequence diagram showing the flow of processing related to the registration of authentication information.
[0027] The authentication information management unit 131 acquires an authentication information registration request from the client terminal 4, which requests registration of authentication information used for client authentication (S1). Here, client authentication is performed by verifying whether the client information (certificate information) generated by the certificate authority is correct, which is client information (certificate information) transmitted by the client terminal 4 when communicating. The authentication information registration request includes, as authentication information, for example, certificate authority information indicating the certificate authority that generated the client information, and a public key for generating a hash value from the client information.
[0028] When the authentication information management unit 131 receives the authentication information registration request, it generates an authentication information ID for identifying the authentication information (S2). Next, the authentication information management unit 131 associates the generated authentication information ID with the authentication information and stores them in the storage unit 12, thereby registering the authentication information (S3). Next, the authentication information management unit 131 transmits the generated authentication information ID to the client terminal 4 (S4).
[0029] [Identification of the first relay device 2 that relays communication] Next, a detailed description will be given of a function related to identifying the first relay device 2 that relays communication when the client terminal 4 communicates with the target terminal 5. The function related to identifying the first relay device 2 is realized by the acquisition unit 132, identification unit 133, memory control unit 134, and notification unit 135 of the connection management device 1. Fig. 6 is a sequence diagram showing the flow of processing related to identifying the first relay device 2 that relays communication. It is assumed that the user of the client terminal 4 knows in advance the SIM-specific number that identifies the target terminal 5.
[0030] The acquisition unit 132 acquires a connection request to the target terminal 5 from the client terminal 4 (S11). Specifically, the acquisition unit 132 acquires the connection request including a SIM-specific number that identifies the target terminal 5 and a port number of the target terminal 5 that is used when the target terminal 5 performs communication.
[0031] The acquisition unit 132 may acquire, together with the connection request, connection condition information indicating the connection conditions when connecting with the target terminal 5 from the client terminal 4. Specifically, the acquisition unit 132 may acquire, as the connection condition information, at least one of a TTL (Time To Live) value as validity period information indicating the period during which communication between the client terminal 4 and the target terminal 5 is possible, and client address information indicating the range of IP addresses of the client terminal 4 when the client terminal 4 communicates with the target terminal 5. The acquisition unit 132 may also acquire from the client terminal 4, together with the connection request, an authentication information ID used for client authentication.
[0032] When the identification unit 133 receives the connection request, it identifies a first relay device 2 that relays communication between the client terminal 4 and the target terminal 5 from among the multiple first relay devices 2 included in the relay system S (S12). For example, the identification unit 133 identifies any one of the multiple first relay devices 2 as the first relay device 2 that relays communication between the client terminal 4 and the target terminal 5.
[0033] The identification unit 133 may identify a first relay device 2 that belongs to the region to which the client terminal 4 belongs as the first relay device 2 that will relay communication between the client terminal 4 and the target terminal 5. In this case, the storage unit 12 stores regional address information that associates the IP addresses of multiple first relay devices 2 with the regions in which the first relay devices 2 are located. The identification unit 133 identifies the address of the client terminal 4 that has made the connection request and identifies the region to which the client terminal 4 belongs based on the address. The identification unit 133 references the regional address information and identifies any one of the multiple first relay devices 2 that belong to the region to which the identified client terminal 4 belongs as the first relay device 2 that will relay communication between the client terminal 4 and the target terminal 5. This allows the client terminal 4 to access first relay devices 2 that are located in the same region, thereby reducing communication delays between the client terminal 4 and the first relay device 2.
[0034] Furthermore, the identifying unit 133 may identify a first relay 2 operated by a telecommunications company with which the client terminal 4 has a contract, as the first relay 2 that will relay communication between the client terminal 4 and the target terminal 5. In this way, it is possible to reduce the cost associated with relaying communication between the client terminal 4 and the target terminal 5. In addition, the identifying unit 133 may identify a first relay 2 with a low load based on the number of terminals accommodated by the first relay 2 or the traffic volume at the first relay 2, as the first relay 2 that will relay communication between the client terminal 4 and the target terminal 5. In this way, it is possible to reduce delays in communication between the client terminal 4 and the first relay 2.
[0035] The identification unit 133 identifies the IP address and port number of the first relay device 2 as connection information for the client terminal 4 to connect to the identified first relay device 2 (S13). For example, the identification unit 133 identifies the port number of the first relay device 2 by selecting any one port number from a plurality of port numbers within a predetermined range. In this way, the connection management device 1 can make it difficult for a third party to identify the port number used by the first relay device 2 for communication.
[0036] The memory control unit 134 stores in the memory unit 12 destination entry information that associates the connection information identified by the identification unit 133, the SIM unique number of the target terminal 5 acquired by the acquisition unit 132, and the port number of the target terminal 5 (S14).
[0037] When the acquisition unit 132 has acquired connection condition information, the storage control unit 134 stores the connection condition information (expiration date corresponding to the TTL, client address information) in association with the connection information. For example, when the storage control unit 134 has acquired a TTL value as the connection condition information, the storage control unit 134 sets the time at which the period during which communication between the client terminal 4 and the target terminal 5 is possible to end as the communication expiration date based on the current time and the TTL value, and stores the communication expiration date in association with the connection information. Furthermore, when the acquisition unit 132 has acquired an authentication information ID, the storage control unit 134 stores the authentication information ID in association with the connection information. Note that the following description will be given assuming that the acquisition unit 132 has acquired the authentication information ID.
[0038] The notifying unit 135 notifies the client terminal 4 that has made the connection request of connection information including the IP address and port number of the first relay device 2 identified by the identifying unit 133 (S15). Here, the notifying unit 135 notifies the client terminal 4 of the connection information, but this is not limiting, and the notifying unit 135 may notify the client terminal 4 of destination entry information including the connection information.
[0039] [Relay of communication by the identified first relay device 2] When the connection information is notified to the client terminal 4, the client terminal 4 becomes able to access the identified first relay device 2 based on the connection information. When the identified first relay device 2 accepts access from the client terminal 4 based on the IP address and port number of the first relay device 2 included in the connection information, it relays communication between the client terminal 4 and the target terminal 5.
[0040] Specifically, when the first relay unit 231 of the first relay device 2 receives access from the client terminal 4 by acquiring a connection request based on the connection information from the client terminal 4, the first relay unit 231 relays communication between the client terminal 4 and the target terminal 5 based on the SIM unique number associated with the connection information in the storage unit 12 of the connection management device 1. The first relay unit 231 identifies the second relay device 3 to which the target terminal 5 is connected based on the SIM unique number, and relays communication between the client terminal 4 and the target terminal 5 via the identified second relay device 3.
[0041] The following describes in detail the functions related to relaying communications. The functions related to relaying communications are realized by the acquisition unit 132, identification unit 133, and notification unit 135 of the connection management device 1, the first relay unit 231 of the first relay device 2, and the second relay unit 331 of the second relay device 3. Fig. 7 is a sequence diagram showing the flow of processing related to relaying communications.
[0042] The first relay unit 231 of the first relay device 2 receives a connection request based on the connection information from the client terminal 4, thereby accepting access from the client terminal 4 (S21). Specifically, the first relay unit 231 receives the connection request from the client terminal 4 at the port number of the first relay device 2 included in the connection information. The connection request includes client information that certifies that the client terminal 4 is eligible. Here, the client information is, for example, certificate information.
[0043] Next, the first relay unit 231 transmits to the connectivity management device 1 a request to acquire relay information used to relay communication (S22). Here, the request to acquire relay information includes the IP address assigned to the first relay device 2 and the port number of the port used for communication with the client terminal 4. The relay information is information including the SIM unique number of the target terminal 5 with which the client terminal 4 communicates, the port number of the target terminal 5, connection condition information, and the IP address of the second relay device 3.
[0044] The acquisition unit 132 of the connectivity management device 1 acquires the request to acquire relay information from the first relay device 2. The identification unit 133 of the connectivity management device 1 refers to the destination entry information stored in the storage unit 12, and identifies the SIM unique number of the target terminal 5, the port number of the target terminal 5, connection condition information, and authentication information ID associated with the IP address and port number of the first relay device 2 included in the request to acquire relay information (S23).
[0045] Next, the identification unit 133 identifies the second relay device 3 to which the target terminal 5 is connected based on the SIM unique number of the identified target terminal 5 (S24). Specifically, the identification unit 133 refers to connection management information that manages one or more target terminals 5 connected to each of multiple second relay devices 3 in the mobile network, and identifies the IP address of the second relay device 3 to which the target terminal 5 with the identified SIM unique number is connected.
[0046] Here, the connection management information is assumed to be provided by, for example, a P-GW (Packet data network Gateway) in the 4G core network or a UPF (User Plane Function) in the 5G core network, but may also be managed by the connection management device 1.
[0047] Next, the notification unit 135 notifies the first relay device 2 of relay information including the SIM unique number of the target terminal 5 identified by the identification unit 133, the port number of the target terminal 5, connection condition information, and the IP address of the second relay device 3 (S25).
[0048] When the first relay unit 231 of the first relay device 2 acquires the relay information, it determines whether or not the connection conditions indicated by the connection condition information included in the relay information are satisfied (S26). If the first relay unit 231 determines that the connection conditions are satisfied, it proceeds to S28 and continues the process of relaying communication between the client terminal 4 and the target terminal 5. If the first relay unit 231 determines that the connection conditions are not satisfied, it notifies the client terminal 4 of connection error information indicating that connection between the client terminal 4 and the target terminal 5 cannot be established (S27).
[0049] Specifically, the first relay unit 231 determines whether the IP address of the client terminal 4 corresponds to the client address information included in the connection condition information. Here, the first relay unit 231 determines that the IP address of the client terminal 4 corresponds to the client address information when the IP address of the client terminal 4 is included in the range of IP addresses indicated by the client address information.
[0050] When the first relay unit 231 determines that the IP address of the client terminal 4 does not correspond to the client address information, that is, that the IP address of the client terminal 4 is not included in the range of IP addresses indicated by the client address information, it notifies the client terminal 4 of connection error information and blocks communication between the client terminal 4 and the target terminal 5. In this way, the first relay unit 2 does not communicate with the target terminal 5 when accessed by a terminal having an IP address that is not included in the range of IP addresses indicated by the client address information, thereby improving security.
[0051] Furthermore, the first relay unit 231 determines whether the client terminal 4 is eligible based on the authentication information ID identified in S23 and the client information included in the connection request. Specifically, the first relay unit 231 transmits an authentication information acquisition request that includes the authentication information ID and requests acquisition of authentication information to the connectivity management device 1. Upon receiving the authentication information acquisition request, the authentication information management unit 131 of the connectivity management device 1 transmits to the first relay unit 2 the certificate authority information and the public key that are stored in association with the authentication information ID in the storage unit 12.
[0052] Upon acquiring the authentication information, the first relay unit 231 determines whether the client terminal 4 is eligible based on the client information. For example, the first relay unit 231 generates a hash value from the client information based on the public key included in the authentication information. The first relay unit 231 then determines whether the client terminal 4 is eligible by determining whether the hash value matches the hash value of the client terminal 4 stored in the certification authority. If the first relay unit 231 determines that the client terminal 4 is not eligible, it notifies the client terminal 4 of connection error information and cuts off communication between the client terminal 4 and the target terminal 5.
[0053] If the first relay unit 231 determines that the IP address of the client terminal 4 corresponds to the client address information and that the client terminal 4 is eligible, the process proceeds to S28. Then, the first relay unit 231 establishes a connection with the target terminal 5 via a TCP connection based on the IP address and port number of the target terminal 5 included in the relay information acquired from the connection management device 1.
[0054] Specifically, the first relay unit 231 establishes a connection with the second relay device 3 based on the IP address of the second relay device 3 included in the relay information acquired from the connection management device 1 in S25 (S28).
[0055] When the connection with the second relay device 3 is established, the first relay unit 231 notifies the second relay device 3 of the IP address of the target terminal 5 and the port number of the target terminal 5 contained in the relay information. The second relay unit 331 of the second relay device 3 establishes a connection with the target terminal 5 based on the IP address of the target terminal 5 and the port number of the target terminal 5 notified by the first relay device 2 (S29).
[0056] When the processes of S28 and S29 are completed, a connection between the client terminal 4 and the target terminal 5 is established (S30). The first relay unit 231 of the first relay device 2 and the second relay unit 331 of the second relay device 3 relay communication between the client terminal 4 and the target terminal 5. This allows the client terminal 4 to send commands to the target terminal 5 and to send and receive data to and from the target terminal 5.
[0057] Here, the first relay unit 231 of the first relay device 2 relays communication between the client terminal 4 and the target terminal 5 by communicating between the first relay device 2 and the target terminal 5 using the telecommunications company's closed network from the first relay device 2 to the target terminal 5 based on the private IP address of the target terminal 5.
[0058] When relaying communication between the client terminal 4 and the target terminal 5, the first relay unit 231 determines whether communication between the client terminal 4 and the target terminal 5 is possible based on the communication expiration date included in the connection condition information. If the first relay unit 231 determines whether communication is possible, it relays the communication between the client terminal 4 and the target terminal 5, and if it determines that communication is not possible, it cuts off communication between the client terminal 4 and the target terminal 5. When cutting off communication between the client terminal 4 and the target terminal 5, the first relay unit 231 notifies the client terminal 4 of connection error information. In this way, the first relay unit 2 cuts off communication between the client terminal 4 and the target terminal 5 in response to the expiration of the communication expiration date, thereby improving security compared to when no communication expiration date is set.
[0059] When communicating with the target terminal 5, the client terminal 4 may transmit data encrypted by SSL (Secure Socket Layer) or TLS (Transport Layer Security) to the first relay device 2. In this case, the first relay unit 231 relays the communication between the client terminal 4 and the target terminal 5 by encrypting the data and communicating between itself and the client terminal 4, and by communicating between itself and the target terminal 5 without encrypting the data.
[0060] As described above, communication between the first relay device 2 and the target terminal 5 can be performed based on the private IP address of the target terminal 5, so secure communication can be performed without encrypting data between the first relay device 2 and the target terminal 5. Furthermore, since the target terminal 5 does not need to perform encryption using SSL or TLS, secure communication can be performed even if the target terminal 5 does not support SSL or TLS.
[0061] [Variation 1] In the above description, the first relay unit 231 of the first relay device 2 acquires a connection request including an authentication information ID from the client terminal 4, but this is not limited to this. Whether or not to include the authentication information ID in the connection request may be optional, and the connection request may not include the authentication information ID. If the connection request does not include the authentication information ID, the first relay unit 231 does not need to determine whether or not to relay the request based on the authentication information ID.
[0062] [Variation 2] Furthermore, the first relay unit 231 of the first relay device 2 may acquire, from the client terminal 4, instruction information indicating that communication based on the connection information between the client terminal 4 and the target terminal 5 should be disabled. In this case, the first relay unit 231 issues an instruction to cut off relay between the client terminal 4 corresponding to the connection information and the target terminal 5.
[0063] [Variation 3] Furthermore, in the above description, an example has been described in which communication between the first relay device 2 and one target terminal 5 is relayed. However, this is not limiting, and communication between the first relay device 2 and multiple target terminals 5 may be relayed. In this case, the connection management device 1 manages connection information, communication expiration dates, and the like for each of the multiple target terminals 5 for one client terminal 4. Then, the process shown in FIG. 7 is performed for each of the multiple target terminals 5, and a connection between the client terminal 4 and each of the multiple target terminals 5 is established. In this case, the first relay unit 231 of the first relay device 2 may obtain one connection request indicating a connection request for each of the multiple target terminals 5, and establish a connection between the first relay device 2 and each of the multiple target terminals 5 based on the connection request. This allows the client terminal 4 to send commands and send and receive data to each of the multiple target terminals 5 with which a connection has been established.
[0064] [Variation 4] In the above description, a network configuration in which the first relay device 2 to the target terminal 5 are part of a closed network of a telecommunications company has been described as an example of a network configuration in which relay between the client terminal 4 and the target terminal 5 is performed, but the present invention is not limited to this. For example, relay between the client terminal 4 and the target terminal 5 may be performed in various network configurations, such as a network configuration in which the first relay device 2 to the second relay device 3 are part of a closed network, a network configuration in which only the first relay device 2 and the second relay device 3 are included in a closed network, or a network configuration in which either the first relay device 2 or the second relay device 3 and the connection management device 1 are included in a closed network.
[0065] [Effects of this embodiment] As described above, in the relay system S according to this embodiment, when the connection management device 1 acquires the SIM number that identifies the target terminal 5 from the client terminal 4, it identifies a first relay device 2 that will relay the communication from among the multiple first relay devices 2 included in the relay system S, associates the connection information for the client terminal 4 with the SIM number, stores the connection information in the storage unit 12, and notifies the client terminal 4 of the connection information. When the identified first relay device 2 accepts access from the client terminal 4 based on the connection information, it relays the communication between the client terminal 4 and the target terminal 5 based on the SIM number associated in the storage unit 12 with the connection information.
[0066] In this way, the connection information notified to the client terminal 4 is not always the same, making it difficult for a third party to guess the connection information used for communication with the target terminal 5. Therefore, the client terminal 4 can access the target terminal 5 securely.
[0067] Furthermore, when the first relay device 2 of the relay system S receives access from the client terminal 4 based on connection information including the IP address and port number of the first relay device 2, it establishes a communication connection between the client terminal 4 and the target terminal 5 via a TCP connection based on the SIM unique number associated with the connection information. In this way, the relay system S can establish communication on a per-TCP connection basis without tunneling all communication over the IP protocol, which allows costs to be kept lower compared to existing communication methods such as VPN, and also makes it possible to avoid the increase in communication overhead and the need to implement additional functions in the accessed device compared to VPN and other communication solutions that use tunneling.
[0068] The present invention has been described above using embodiments, but the technical scope of the present invention is not limited to the scope described in the above embodiments, and various modifications and changes are possible within the scope of the gist of the present invention. For example, all or part of the device can be configured by functionally or physically distributing or integrating any unit. Furthermore, new embodiments resulting from any combination of multiple embodiments are also included in the embodiments of the present invention. The effects of the new embodiments resulting from the combination also have the effects of the original embodiments. [Explanation of symbols]
[0069] 1 connection management device, 11 communication unit, 12 storage unit, 13 control unit, 131 authentication information management unit, 132 acquisition unit, 133 identification unit, 134 storage control unit, 135 notification unit, 2 first relay device, 21 communication unit, 22 storage unit, 23 control unit, 231 first relay unit, 3 second relay device, 31 communication unit, 32 storage unit, 33 control unit, 331 second relay unit, 4 client terminal, 5 target terminal, S relay system
Claims
1. A relay method executed by a relay system that relays communication between a client terminal and a target terminal that is a communication destination of the client terminal, comprising: an acquisition step of acquiring terminal identification information for identifying the target terminal from the client terminal; an identifying step of identifying a first relay device that relays the communication among a plurality of relay devices included in the relay system when the terminal identification information is acquired, and identifying connection information for the client terminal to connect to the first relay device; a storage control step of storing the connection information and the terminal identification information in a storage unit in association with each other; a notification step of notifying the client terminal of the specified connection information; a relay step in which, when the first relay device receives access from the client terminal based on the connection information, the first relay device relays communication between the client terminal and the target terminal based on the terminal identification information associated with the connection information in the storage unit; A relay method comprising:
2. In the relaying step, the first relay device identifies a second relay device to which the target terminal is connected based on the terminal identification information stored in the storage unit, and relays communication between the client terminal and the target terminal via the identified second relay device. The relay method according to claim 1 .
3. the relay system is configured to include a plurality of relay devices that form a mobile network, and the target terminal is connected to the mobile network; the target terminal is assigned a private address accessible within the mobile network; In the relaying step, the first relay device relays communication between the client terminal and the target terminal by communicating with the target terminal based on a private address of the target terminal. The relay method according to claim 2 .
4. In the storage control step, the relay system further associates the connection information with a port number of the target terminal used for communication with the target terminal and stores the information in the storage unit; In the relaying step, the first relay device establishes a connection with the target terminal based on terminal identification information associated with the connection information in the storage unit and a port number of the target terminal. The relay method according to any one of claims 1 to 3.
5. In the acquiring step, the relay system further acquires a port number of the target terminal from the client terminal; In the storage control step, the relay system further associates the acquired port number of the target terminal with the connection information and stores the information in the storage unit. The relay method according to claim 4.
6. In the storage control step, the relay system stores the connection information including the port number of the first relay device in the storage unit; In the notification step, the relay system notifies the client terminal of the connection information including the address and port number of the first relay device; In the relaying step, the first relay device accepts access from the client terminal based on the address and port number of the first relay device included in the connection information. The relay method according to any one of claims 1 to 5.
7. In the storage control step, the relay system further associates validity period information indicating a period during which communication between the client terminal and the target terminal is possible with the connection information and stores the association information in the storage unit; In the relay step, when the first relay device receives access from the client terminal based on the connection information, if it determines that communication is possible based on validity period information associated with the connection information in the storage unit, it relays the communication between the client terminal and the target terminal, and if it determines that communication is not possible, it blocks relaying the communication between the client terminal and the target terminal. The relay method according to any one of claims 1 to 6.
8. In the acquiring step, the relay system further acquires the validity period information from the client terminal; In the storage control step, the relay system further associates the acquired validity period information with the identified connection information and stores the information in the storage unit. The relay method according to claim 7.
9. In the acquiring step, the relay system further acquires, from the client terminal, address information indicating an address of the client terminal when communicating with the target terminal; In the storage control step, the relay system further associates the acquired address information with the specified connection information and stores the association information in the storage unit; In the relay step, when the first relay device corresponding to the connection information receives access from the client terminal based on the connection information, if it determines that the address of the client terminal corresponds to address information associated with the connection information in the storage unit, it relays communication between the client terminal and the target terminal, and if it determines that the address of the client terminal does not correspond to the address information, it blocks relaying communication between the client terminal and the target terminal. The relay method according to any one of claims 1 to 8.
10. In the relay step, when the first relay device receives access from the client terminal based on the connection information, the first relay device further acquires client information indicating that the client terminal is eligible, and when it determines that the client terminal is eligible based on the client information, it relays communication between the client terminal and the target terminal, and when it determines that the client terminal is not eligible, it blocks relaying communication between the client terminal and the target terminal. The relay method according to any one of claims 1 to 9.
11. In the relaying step, the first relay device relays communication between the client terminal and the target terminal by encrypting data between itself and the client terminal and by communicating between itself and the target terminal without encrypting data. The relay method according to any one of claims 1 to 10.
12. A relay system comprising a connection management device and a plurality of relay devices, which relays communication between a client terminal and a target terminal that is a communication destination of the client terminal, The connection management device an acquisition unit that acquires terminal identification information that identifies the target terminal from the client terminal; an identification unit that, upon receiving the terminal identification information, identifies a first relay device that relays the communication among a plurality of relay devices included in the relay system, and identifies connection information for the client terminal to connect to the first relay device; a storage control unit that stores the connection information and the terminal identification information in a storage unit in association with each other; a notification unit that notifies the client terminal of the specified connection information; and The first relay device a relay unit that, upon receiving access from the client terminal based on the connection information, relays communication between the client terminal and the target terminal based on the terminal identification information associated with the connection information in the storage unit; having Relay system.
13. A computer included in a relay system that relays communication between a client terminal and a target terminal that is a communication destination of the client terminal, an acquisition unit that acquires terminal identification information that identifies the target terminal from the client terminal; an identification unit that, upon receiving the terminal identification information, identifies a first relay device that relays the communication among a plurality of relay devices included in the relay system, and identifies connection information for the client terminal to connect to the first relay device; a storage control unit that stores the connection information and the terminal identification information in a storage unit in association with each other; and a notification unit that notifies the client terminal of the specified connection information; A relay program that functions as a relay.
Citation Information
Patent Citations
Catalyst for liquefying coal and method for liquefying coal by using the same
JP1984073049A