Relay device, relay method, and non-transitory computer-

Abstract

To provide a relay device, a relay method and a relay program for reducing the load of arithmetic processing and the restriction of a setting value relating to communication connection management.SOLUTION: A relay device 1 that relays communication between a first communication net WAN4 and a second communication net LAN5 includes a slow path transfer processing unit that performs slow path transfer of the communication, slow path entry information including connection information and a timer value of the communication subjected to the slow path transfer, a first management unit that manages the slow path entry information, a fast path transfer processing unit that performs fast path transfer of the communication at a higher speed than the slow path transfer processing unit, fast path entry information including connection information and a timer value of the communication subjected to the fast path transfer, and a second management unit that manages the fast path entry information. When the timer value of the slow path entry information expires, the first management unit updates the timer value of the slow path entry information by using the timer value of the fast path entry information.SELECTED DRAWING: Figure 1

Description

[Technical Field]

[0001] The present invention relates to a relay device, a relay method, and a relay program for relaying communication between two communication networks. [Background technology]

[0002] Conventionally, a function called SPI (Stateful Packet Inspection) has been known as a filtering function provided in relay devices that relay communications between two communication networks. SPI is a function that dynamically determines whether a packet can pass through, and relay devices equipped with SPI manage and monitor the state of communication connections above the IP (Internet Protocol) layer, and control whether packet forwarding is permitted or not.

[0003] The SPI function will be specifically explained using a relay device that relays communications between a LAN (Local Area Network) and a WAN (Wide Area Network). The relay device opens a port on the WAN side in response to packet communications from a communication device on the LAN side to the WAN side and begins packet forwarding. The relay device then automatically closes the WAN side port when the communication device on the LAN side has finished receiving data from the WAN side, or when the time elapsed since the last communication exceeds the internally set SPI timeout value. As a result, when there is no external access from the communication device on the LAN side, all ports are filtered, preventing unauthorized access to the LAN from the outside.

[0004] In SPI, every time a packet is sent or received, the communication connection is identified, and the status of the corresponding communication connection and the SPI timer value, which indicates the elapsed time since the last communication, are updated to determine whether each packet can be forwarded or not. Therefore, it is necessary to monitor and manage all communication connections.

[0005] Furthermore, relay devices that perform high-speed packet forwarding (fast path forwarding) have been known in the past. For example, a gateway device disclosed in Patent Document 1 registers a new entry in the fast path entry data when registering a new entry in the slow path entry data and if a received packet is subject to fast path forwarding. After that, packets registered in the fast path entry data are forwarded at high speed.

[0006] When implementing SPI in a relay device with a fast-path forwarding function, it is necessary to manage slow-path entry data and fast-path entry data. Specifically, the relay device needs to synchronize the connection state and SPI timer value included in each entry data between the slow-path entry data and the fast-path entry data. If these SPI timer values ​​are not synchronized, there is a risk that packets will not be forwarded even though the SPI timer value has not expired, resulting in packet loss, or that packets will not be filtered even though the SPI timer value has expired, resulting in security being compromised.

[0007] One possible solution to this problem is to synchronize the slow path entry data and the fast path entry data at a fixed cycle. However, synchronizing the slow path entry data and the fast path entry data at a fixed cycle increases the processing load on the CPU of the relay device. This load on the relay device becomes even heavier, especially when there are a large number of communication connections.

[0008] Another possible measure is to subtract the difference between the SPI timeout setting value for fast path transfer and the SPI timer value of the fast path entry data from the SPI timeout setting value for slow path transfer when the SPI timer value of the slow path entry data expires, to obtain an updated value for the SPI timer value of the slow path entry data, and then update the SPI timer value. This reduces the amount of calculation compared to synchronization at a fixed cycle, and can also reduce the load on the CPU's calculation processing. [Prior art documents] [Patent documents]

[0009] [Patent Document 1] Patent No. 6447138 Summary of the Invention [Problem to be solved by the invention]

[0010] However, when the update value of the SPI timer value of the slow path entry data is obtained by subtracting the difference between the SPI timeout setting value for fast path transfer and the SPI timer value of the fast path entry data from the SPI timeout setting value for slow path transfer, there is a restriction that the SPI timeout setting value for fast path transfer must be set to a value equal to or greater than the SPI timeout setting value for slow path transfer.This has caused a problem in that it is not possible to operate independently of the SPI timeout setting value for slow path transfer.

[0011] The present invention has been made to solve the above-mentioned problems, and aims to provide a relay device, a relay method, and a relay program that can reduce the computational processing load and setting value constraints related to communication connection management. [Means for solving the problem]

[0012] The relay device of the present invention is a relay device that relays communications between a first communication network and a second communication network, and includes: a slow path forwarding processing unit that performs slow path forwarding of communications between the first communication network and the second communication network; a first memory unit that stores slow path entry information including connection information and timer values ​​of communications to be slow path forwarded, and a timeout setting value for slow path forwarding; a first management unit that manages the slow path entry information; a fast path forwarding processing unit that performs fast path forwarding of communications between the first communication network and the second communication network at a speed faster than that of the slow path forwarding processing unit; a second memory unit that stores fast path entry information including connection information and timer values ​​of communications to be fast path forwarded, and a timeout setting value for fast path forwarding; and a second management unit that manages the fast path entry information, wherein when the timer value of the slow path entry information expires, the first management unit updates the timer value of the slow path entry information using the timer value of the fast path entry information, and the timer value of the fast path entry information is either the remaining time until expiration or the elapsed time since expiration.

[0013] The relay method of the present invention is a relay method for relaying communications between a first communication network and a second communication network, and includes the steps of: performing slow path forwarding of the communications between the first communication network and the second communication network; storing slow path entry information including connection information and a timer value of the communications to be slow path forwarded, and a timeout setting value for the slow path forwarding in a first memory unit; performing fast path forwarding of the communications between the first communication network and the second communication network at a speed faster than the slow path forwarding; storing fast path entry information including connection information and a timer value of the communications to be fast path forwarded, and the timeout setting value for the fast path forwarding in a second memory unit; and, when the timer value of the slow path entry information expires, updating the timer value of the slow path entry information using the timer value of the fast path entry information, wherein the timer value of the fast path entry information is either the remaining time until expiration or the elapsed time since expiration.

[0014] A relay program according to the present invention causes a processor of a relay device to execute the relay method described above. [Effects of the Invention]

[0015] According to the relay device, relay method, and relay program of the present invention, when the timer value of the slow path entry information expires, the timer value of the slow path entry information is updated, and the timer value of the fast path entry information, which is either the remaining time until expiration or the elapsed time since expiration, is used for the update, thereby reducing the load on calculation processing and the constraints on the setting values. [Brief explanation of the drawings]

[0016] [Figure 1] 1 is a schematic configuration diagram of a relay device according to a first embodiment. [Figure 2] 10 is a diagram illustrating an example of an SPI timeout setting value SPO for slow path transfer stored in a first storage unit according to the first embodiment. FIG. [Figure 3] 10 is a diagram showing an example of an SPI timeout setting value FPO for fast path transfer stored in the second storage unit according to the first embodiment. FIG. [Figure 4] 4 is a diagram showing an example of slow path entry information stored in a first storage unit according to the first embodiment; FIG. [Figure 5] FIG. 4 is a diagram showing an example of fast path entry information stored in a second storage unit according to the first embodiment; [Figure 6] 4 is a flowchart showing a packet forwarding process performed by the relay device according to the first embodiment. [Figure 7] 10 is a flowchart showing a flow of communication management by a second management unit according to the first embodiment. [Figure 8] 10 is a flowchart showing a flow of communication management by a first management unit according to the first embodiment. [Figure 9] 10 is a diagram illustrating updating of an SPI timer value in the relay device according to the first embodiment. FIG. DETAILED DESCRIPTION OF THE INVENTION

[0017] Embodiment 1 FIG. 1 is a schematic configuration diagram of a relay device 1 according to a first embodiment. The relay device 1 of this embodiment is connected between a WAN 4, which is a first communication network, and a LAN 5, which is a second communication network, and relays communications between the WAN 4 and the LAN 5. The WAN 4 is, for example, the Internet. A PC (Personal Computer) 8 used by a user is connected to the LAN 5.

[0018] The relay device 1 of this embodiment has an SPI function that opens the WAN port 9 in response to packet communication from a PC 8 connected to the LAN 5 to the WAN 4, and automatically closes the WAN port 9 when the time elapsed since the last packet communication exceeds an SPI timeout setting value SPO. The relay device 1 of this embodiment also has a slow path transfer unit 2 that performs slow path transfer of communication, and a fast path transfer unit 3 that performs fast path transfer (high speed transfer).

[0019] The slow path forwarding unit 2 has a slow path forwarding processing unit 11, a first management unit 12, and a first memory unit 13. The fast path forwarding unit 3 has a fast path forwarding processing unit 21, a second management unit 22, and a second memory unit 23. The slow path forwarding processing unit 11 and the fast path forwarding processing unit 21 are connected to a WAN host 6 on the WAN 4 side via a WAN port 9. The slow path forwarding processing unit 11 and the fast path forwarding processing unit 21 are connected to a LAN host 7 on the LAN 5 side via a LAN port 10. The WAN host 6 and the LAN host 7 are, for example, communication devices such as routers.

[0020] The slow path forwarding processing unit 11 performs forwarding processing of communication by packets transmitted and received between the WAN 4 and the LAN 5. The fast path forwarding processing unit 21 performs forwarding processing of communication by packets transmitted and received between the WAN 4 and the LAN 5 at a speed faster than that of the slow path forwarding processing unit 11.

[0021] The first storage unit 13 stores information for managing communication connections for slow path forwarding. Specifically, the first storage unit 13 stores an SPI timeout setting value SPO for slow path forwarding and a communication connection table. In the communication connection table, slow path entry information, which is entry information for communications to be forwarded by the slow path forwarding processing unit 11, is registered for each communication connection.

[0022] The second storage unit 23 stores information for managing communication connections for fast path transfer. Specifically, the second storage unit 23 stores an SPI timeout setting value FPO for fast path transfer and a communication connection table. In the communication connection table, fast path entry information, which is entry information for communication to be transferred by the fast path transfer processing unit 21, is registered for each communication connection.

[0023] An example of the hardware configuration of the slow path transfer unit 2 and the fast path transfer unit 3 will be described. The slow path transfer unit 2 has a memory that stores programs and a processor such as a CPU that executes processing in accordance with the programs. The slow path transfer processing unit 11 and the first management unit 12 are functional units that are realized when the processor executes the programs stored in the memory. The second storage unit 23 is composed of a memory such as a flash memory, and stores the SPI timeout setting value FPO for fast path transfer and a communication connection table, as well as the programs to be executed by the processor and parameters such as thresholds used in program execution.

[0024] The fast path transfer unit 3 is configured with a dedicated circuit such as an ASIC (Application Specific Integrated Circuit). For example, the fast path transfer processing unit 21 and the second management unit 22 are each configured with an ASIC, and the second storage unit 23 is configured with a memory such as a flash memory. That is, the fast path transfer unit 3 realizes high-speed transfer through hardware transfer. Note that the fast path transfer unit 3 is not limited to a unit that realizes high-speed transfer through hardware transfer, but may also realize high-speed transfer through software. In this case, like the slow path transfer unit 2, the fast path transfer unit 3 may include a memory that stores a program and a processor such as a CPU that executes processing in accordance with the program, and the fast path transfer processing unit 21 and the second management unit 22 may be functional units realized by the processor executing the program stored in the memory.

[0025] Fig. 2 is a diagram showing an example of an SPI timeout setting value SPO for slow path transfer stored in the first storage unit 13 according to the first embodiment. Fig. 3 is a diagram showing an example of an SPI timeout setting value FPO for fast path transfer stored in the second storage unit 23 according to the first embodiment.

[0026] As shown in Figures 2 and 3, SPI timeout setting values ​​are set for each communication protocol, such as TCP and UDP. Specifically, a UDP UNREPLIED timeout setting value, a UDP ASSURED timeout setting value, and a TCP ESTABLISHED timeout setting value are set for slow path transfer and fast path transfer, respectively. The UDP UNREPLIED timeout setting value is the timeout setting value for basic UDP one-way communication. The UDP ASSURED timeout setting value is the timeout setting value for basic UDP two-way communication. The TCP ESTABLISHED timeout setting value is the timeout setting value for TCP two-way communication.

[0027] In this embodiment, the SPI timeout setting value SPO for slow path transfer is set as shown in Fig. 2, and the SPI timeout setting value FPO for fast path transfer is set as shown in Fig. 3. Specifically, the SPI timeout setting value SPO for slow path transfer is set to 180 seconds regardless of the type of communication protocol, and the SPI timeout setting value FPO for fast path transfer is set to 60 seconds regardless of the type of communication protocol. The SPI timeout setting value SPO for slow path transfer and the SPI timeout setting value FPO for fast path transfer are set arbitrarily by the user within the range (30 to 7200 seconds) shown in Figs. 2 and 3.

[0028] Fig. 4 is a diagram showing an example of slow path entry information stored in the first storage unit 13 according to the first embodiment. Fig. 5 is a diagram showing an example of fast path entry information stored in the second storage unit 23 according to the first embodiment. Each entry information is created for each communication connection and includes connection information and an SPI timer value for the communication connection. The connection information is information for identifying and managing the communication connection, and includes, for example, information such as the protocol for each layer, the source IP address, and the source port number shown in Figs. 4 and 5, and information regarding the state of the communication connection. The SPI timer value is a value indicating the time counted by a timer in response to reception of packet communication.

[0029] The SPI timer value STc of the slow path entry information is the time remaining until the SPI timer value STc expires, in other words, the time remaining until a timeout occurs. When new slow path entry information is created, the first management unit 12 sets the SPI timer value STc to the SPI timeout setting value SPO shown in FIG. 2 and starts counting down. The SPI timer value STc of the slow path entry information is sequentially rewritten by the first management unit 12 over time. When a packet is slow path transferred in the same communication connection, the first management unit 12 resets the SPI timer value STc of the slow path entry information, resets it to the SPI timeout setting value SPO for slow path transfer, and starts counting down. If the time of the SPI timeout setting value SPO has elapsed since the last communication without any packet transfer, the SPI timer value STc becomes 0. When the SPI timer value STc becomes 0 in this way, it is said that the SPI timer value STc expires.

[0030] The SPI timer value FTc in the fast path entry information of this embodiment indicates either the time remaining until the SPI timer value FTc expires, in other words, the time remaining until a timeout occurs, or the time elapsed since the SPI timer value FTc expired. As shown in Fig. 5, if the SPI timer value FTc is positive, it indicates the time remaining until the SPI timer value FTc expires, and if the SPI timer value FTc is negative, it indicates the time elapsed since the SPI timer value FTc expired.

[0031] When new fast path entry information is created, the second management unit 22 sets the SPI timer value FTc to the SPI timeout setting value FPO shown in FIG. 3 and starts counting down. The SPI timer value FTc in the fast path entry information is sequentially rewritten by the second management unit 22 as time passes. When a packet is fast path transferred in the same communication connection, the second management unit 22 resets the SPI timer value FTc in the fast path entry information, resets it to the SPI timeout setting value FPO for fast path transfer, and starts counting down. If the time of the SPI timeout setting value FPO has elapsed since the last communication without any packet transfer, the SPI timer value FTc becomes 0. When the SPI timer value FTc becomes 0 in this way, it is said that the SPI timer value FTc has expired.

[0032] In conventional relay devices, when the SPI timer value FTc expires, the entry information for the corresponding communication connection is deleted and subsequent communications are filtered. In contrast, the second management unit 22 of the relay device 1 of this embodiment does not delete the entry information when the SPI timer value FTc of the fast path entry information expires, but instead counts the elapsed time since expiration as a negative value. As a result, when the SPI timer value FTc is negative, it is possible to calculate the amount of time that has elapsed without communication in the fast path transfer from the sum of the absolute value of the SPI timer value FTc and the SPI timeout setting value FPO for the fast path transfer. That is, when the SPI timeout setting value FPO for the fast path transfer is 60 seconds as shown in FIG. 3 and the SPI timer value FTc is −60 seconds, it is determined that 60 seconds have elapsed since the SPI timer value FTc expired, and the amount of time that has elapsed without communication in the fast path transfer is 120 seconds.

[0033] 5, the fast path entry information of this embodiment also includes a valid / invalid setting indicating whether each communication connection is valid or invalid. If the SPI timer value FTc has not expired, i.e., if the SPI timer value FTc is a positive value, the communication connection is validated, and if the SPI timer value FTc has expired, i.e., if the SPI timer value FTc is 0 or a negative value, the communication connection is invalid. Note that the valid / invalid setting of a communication connection is not an essential item, as it can be determined by the SPI timer value FTc.

[0034] As described above, the first management unit 12 updates the information stored in the first memory unit 13 to manage the communication connection for slow path transfer. As described above, the second management unit 22 updates the information stored in the second memory unit 23 to manage the communication connection for fast path transfer. The first management unit 12 and the second management unit 22 mutually refer to, write, and rewrite the information stored in the first memory unit 13 and the second memory unit 23.

[0035] Next, an operation of the relay device 1 in this embodiment will be described. In the conventional relay device 1, the SPI timer value STc of the slow path entry information is updated by setting the SPI timeout setting value FPO for fast path transfer to be equal to or greater than the SPI timeout setting value SPO for slow path transfer, subtracting the difference between the SPI timeout setting value FPO for fast path transfer and the SPI timer value FTc of the fast path entry data from the SPI timeout setting value SPO for slow path transfer, determining the allowable time for no communication in packet transfer of the communication connection in question, and updating the SPI timer value STc.

[0036] In contrast, in the relay device 1 of this embodiment, the SPI timeout setting value FPO for fast path transfer can be set arbitrarily by the user, regardless of the SPI timeout setting value SPO for slow path transfer. Furthermore, the SPI timer value FTc of the fast path entry data can indicate the remaining time until the SPI timer value FTc expires (a positive value) and the elapsed time since the SPI timer value FTc expires (a negative value). When the SPI timer value STc of the slow path entry information expires, the relay device 1 of this embodiment uses the SPI timeout setting value FPO for fast path transfer, the SPI timer value FTc of the fast path entry information, and the SPI timeout setting value SPO for slow path transfer to determine the allowable time for no communication in packet transfer of the corresponding communication connection, and updates the SPI timer value STc of the slow path entry information.

[0037] A specific description will be given of the operation of the relay device 1. First, a description will be given of the operation of the relay device 1 to register entry information. Fig. 6 is a flowchart showing the operation of the packet forwarding process by the relay device 1 according to the first embodiment.

[0038] When the relay device 1 receives a packet, the first management unit 12 determines whether or not there is a communication connection corresponding to the received packet (S1). The presence or absence of a communication connection is determined by whether or not entry information corresponding to the received packet is stored. If there is no communication connection for the received packet (S1: NO), the first management unit 12 newly registers the information of the received packet as slow path entry information in the communication connection table of the first storage unit 13 (S2).

[0039] Next, the first management unit 12 determines whether the received packet is a target for fast path forwarding (S3). If the received packet is not a target for fast path forwarding (S3: NO), a packet forwarding process is performed (S5).

[0040] On the other hand, if the received packet is subject to fast path forwarding (S3: YES), the second management unit 22 registers information about the received packet as new fast path entry information in the communication connection table of the second storage unit 23 (S4). At this time, the enable / disable setting of the fast path entry information is set to enabled. Then, the packet forwarding process is carried out (S5). In this way, the trigger for registering fast path entry information is when a packet is received in the packet forwarding process of slow path forwarding, there is no communication connection for the corresponding packet, and it is determined that it is a new communication connection.

[0041] Furthermore, if there is a communication connection corresponding to the received packet (S1: YES), the first management unit 12 determines whether there is fast path entry information corresponding to the received packet (S6). If there is no fast path entry information corresponding to the received packet (S6: NO), the first management unit 12 updates the slow path entry information of the communication connection stored in the first storage unit 13 (S7). Here, the connection information of the slow path entry information is updated, and the SPI timer value STc is reset. Thereafter, the packet forwarding process is performed (S5).

[0042] On the other hand, if there is fast path entry information corresponding to the received packet (S6: YES), the second management unit 22 determines whether the valid / invalid setting in the fast path entry information stored in the second storage unit 23 is valid (S8). If the valid / invalid setting in the fast path entry information is valid (S8: YES), the second management unit 22 updates the fast path entry information stored in the second storage unit 23 (S9). Here, the connection information in the fast path entry information is updated, and the SPI timer value FTc is reset. Thereafter, the packet forwarding process is carried out (S5).

[0043] If the enable / disable setting in the fast path entry information is disabled (S8: NO), the first management unit 12 updates the slow path entry information of the communication connection stored in the first storage unit 13 (S10). Here, the connection information in the slow path entry information is updated, and the SPI timer value STc is reset. Thereafter, the second management unit 22 updates the fast path entry information stored in the second storage unit 23 (S9). Here, the connection information in the fast path entry information is updated, and the SPI timer value FTc is reset. Furthermore, when step S9 is performed after step S10, the second management unit 22 changes the enable / disable setting in the fast path entry information to enabled. Thereafter, the packet forwarding process is performed (S5).

[0044] In the conventional packet forwarding process in step S5, if fast path entry information is stored, fast path forwarding is performed, and if fast path entry information is not stored, slow path forwarding is performed. In contrast, in this embodiment, if fast path entry information is stored and the valid / invalid setting is valid (or the SPI timer value FTc is a positive value), fast path forwarding is performed by the fast path forwarding processing unit 21, and if not, slow path forwarding is performed by the slow path forwarding processing unit 11.

[0045] Next, the communication management performed by the relay device 1 will be described. Here, the operation of the relay device 1 when monitoring and synchronizing the SPI timer values ​​of the slow path entry information and the fast path entry information as the communication management will be described. Fig. 7 is a flowchart showing the flow of communication management by the second management unit 22 according to the first embodiment. The second management unit 22 of the relay device 1 executes the process shown in Fig. 7 at predetermined time intervals (for example, every second) for all communication connections stored in the second storage unit 23.

[0046] First, the second management unit 22 refers to the SPI timer value FTc in the fast path entry information for the communication connection to be monitored, and determines whether the SPI timer value FTc has expired (S101). If the SPI timer value FTc in the fast path entry information has not expired (S101: NO), the process ends. After that, the SPI timer value FTc continues to be decremented.

[0047] If the SPI timer value FTc in the fast path entry information has expired (S101: YES), the second management unit 22 invalidates the enable / disable setting in the fast path entry information of the communication connection (S102) and ends the process. After that, the SPI timer value FTc becomes a negative value and the SPI timer value FTc continues to be subtracted. As described above, in the second management unit 22 of this embodiment, even if the SPI timer value FTc in the fast path entry information has expired, the entry information is not deleted, and the elapsed time since expiration is counted as the SPI timer value FTc.

[0048] Fig. 8 is a flowchart showing the flow of communication management by the first manager 12 according to embodiment 1. The first manager 12 of the relay device 1 executes the process shown in Fig. 8 at predetermined time intervals (for example, every second) for all communication connections stored in the first storage unit 13.

[0049] First, the first management unit 12 refers to the SPI timer value STc of the slow path entry information in the communication connection to be monitored, and determines whether the SPI timer value STc has expired (S201). If the SPI timer value STc of the slow path entry information has not expired (S201: NO), the process ends. On the other hand, if the SPI timer value STc of the slow path entry information has expired (S201: YES), the first management unit 12 determines whether or not there is fast path entry information in the communication connection to be monitored (S202). If there is no fast path entry information (S202: NO), the entry information of the communication connection to be monitored is deleted (S203). Here, the slow path entry information stored in the first storage unit 13 is deleted.

[0050] On the other hand, if there is fast path entry information in the communication connection to be monitored (S202: YES), the first management unit 12 acquires the SPI timeout setting value SPO for slow path transfer, the SPI timeout setting value FPO for fast path transfer, and the SPI timer value FTc of the fast path entry information in the communication connection to be monitored from the first memory unit 13 and the second memory unit 23, respectively (S204).

[0051] Next, the first management unit 12 determines whether the SPI timeout setting value SPO for slow path transfer is equal to or less than the SPI timeout setting value FPO for fast path transfer (S205). If the SPI timeout setting value SPO for slow path transfer is equal to or less than the SPI timeout setting value FPO for fast path transfer (S205: YES), the first management unit 12 determines whether the SPI timer value FTc of the fast path entry information is equal to or greater than 0 (S206). If the SPI timer value FTc of the fast path entry information is less than 0 (S206: NO), that is, if the SPI timer value FTc has expired, the first management unit 12 deletes the entry information of the communication connection to be monitored (S203). Here, the slow path entry information stored in the first storage unit 13 and the fast path entry information stored in the second storage unit 23 are deleted.

[0052] If the SPI timer value FTc of the fast path entry information is equal to or greater than 0 (S206: YES), the first management unit 12 calculates an updated value STn of the SPI timer value STc of the slow path entry information (S207). The updated value STn is calculated using the following formula (1). STn = SPO-(FPO-FTc) (1)

[0053] Then, the first management unit 12 determines whether the update value STn is equal to or less than 0 (S208). If the update value STn is equal to or less than 0 (S208: YES), the first management unit 12 deletes the entry information of the communication connection to be monitored (S203). Here, the slow path entry information stored in the first storage unit 13 and the fast path entry information stored in the second storage unit 23 are deleted.

[0054] On the other hand, if the update value STn is greater than 0 (S208: NO), the first management unit 12 determines whether the update value STn is equal to or less than the SPI timeout setting value SPO for slow path transfer (S209). If the update value STn is equal to or less than the SPI timeout setting value SPO (S209: YES), the first management unit 12 updates the SPI timer value STc of the slow path entry information by setting it to the update value STn (S210). On the other hand, if the update value STn is greater than the SPI timeout setting value SPO (S209: NO), the first management unit 12 updates the SPI timer value STc of the slow path entry information by setting it to the SPI timeout setting value SPO (S211).

[0055] Also, if the SPI timeout setting value SPO for slow path transfer is greater than the SPI timeout setting value FPO for fast path transfer (S205: NO), the first management unit 12 calculates the updated value STn of the SPI timer value STc of the slow path entry information using equation (1) (S212).

[0056] Then, the first management unit 12 determines whether the update value STn is equal to or less than 0 (S213). If the update value STn is equal to or less than 0 (S213: YES), the first management unit 12 deletes the entry information of the communication connection to be monitored (S203). Here, the slow path entry information stored in the first storage unit 13 and the fast path entry information stored in the second storage unit 23 are deleted. On the other hand, if the update value STn is greater than 0 (S213: NO), the first management unit 12 updates the SPI timer value STc of the slow path entry information by setting it to the update value STn (S210).

[0057] Next, a specific example of updating the SPI timer value STc of the slow path entry information and the SPI timer value FTc of the fast path entry information in the relay device 1 of this embodiment will be described. FIG. 9 is a diagram illustrating updating of the SPI timer value in the relay device 1 according to the first embodiment. FIG. 9 illustrates a case where one-way communication of UDP packets is performed, and the SPI timeout setting value SPO of the UDP UNREPLIED (one-way) for slow path transfer is set to 180 seconds, and the SPI timeout setting value FPO of the UDP UNREPLIED (one-way) for fast path transfer is set to 60 seconds. Also, in FIG. 9, slow path transfer is indicated by a solid arrow, and the SPI timer value STc of the slow path entry information is indicated by a solid frame. Also, in FIG. 9, fast path transfer is indicated by a dashed arrow, and the SPI timer value FTc of the fast path entry information is indicated by a dashed frame. The unit of the numerical value written in each frame is [seconds].

[0058] The first UDP packet Pk1 is sent from the LAN host 7 to the WAN host 6. When the relay device 1 receives the packet Pk1, it forwards the packet Pk1 via the slow path. When the relay device 1 forwards the packet Pk1 via the slow path, it also creates new slow path entry information and stores it in the first storage unit 13. At this time, the SPI timer value STc is set to 180 seconds, which is the SPI timeout setting value SPO.

[0059] Since UDP packet Pk1 is a packet to be fast-path forwarded, relay device 1 also creates new fast-path entry information and stores it in second storage unit 23. At this time, the SPI timer value FTc is set to 60 seconds, which is the SPI timeout setting value FPO. In addition, the valid / invalid setting of the fast-path entry information is set to valid. For subsequent packets Pk2 to Pk5, fast-path entry information exists and the SPI timer value FTc has not expired, so they are fast-path forwarded. The SPI timer value FTc of the fast-path entry information is reset to 60 seconds every time relay device 1 receives packets Pk2 to Pk5.

[0060] Thereafter, when 180 seconds have elapsed since the relay device 1 received packet Pk1, the SPI timer value STc of the slow path entry information becomes 0 and expires. When the first management unit 12 detects that the SPI timer value STc of the slow path entry information has expired, it checks whether or not there is fast path entry information in the communication connection. In the example of FIG. 9, since there is fast path entry information, the first management unit 12 acquires the SPI timeout setting value SPO for slow path transfer, the SPI timeout setting value FPO for fast path transfer, and the SPI timer value FTc of the fast path entry information.

[0061] In the example of Figure 9, the SPI timeout setting value SPO for slow path transfer is greater than the SPI timeout setting value FPO for fast path transfer, and the SPI timer value FTc of the fast path entry information is greater than 0, so the first management unit 12 calculates the update value STn using equation (1). In the example of Figure 9, the update value STn is 180 seconds - (60 seconds - 20 seconds) = 140 seconds. Because the update value STn is greater than 0, the first management unit 12 sets the SPI timer value STc of the slow path entry information to the update value STn, 140 seconds.

[0062] Subsequently, when 50 seconds have passed since packet Pk5 was transferred, UDP packet Pk6 is sent from LAN host 7 to WAN host 6. Relay device 1 processes packet Pk6 using fast path transfer and resets the SPI timer value FTc in the fast path entry information to 60 seconds. After that, 140 seconds have passed, and when the SPI timer value STc in the slow path entry information reaches 0 and expires, first management unit 12 checks whether fast path entry information exists in the communication connection, as described above. In the example of Figure 9, since fast path entry information exists, first management unit 12 acquires the SPI timeout setting value SPO for slow path transfer, the SPI timeout setting value FPO for fast path transfer, and the SPI timer value FTc in the fast path entry information.

[0063] In the example of Figure 9, the SPI timeout setting value SPO for slow path transfer is greater than the SPI timeout setting value FPO for fast path transfer, so the first management unit 12 calculates the updated value STn using equation (1). In the example of Figure 9, the updated value STn is 180 seconds - (60 seconds - (-70 seconds)) = 50 seconds. Because the updated value STn is greater than 0, the first management unit 12 sets the SPI timer value STc of the slow path entry information to the updated value STn, 50 seconds.

[0064] Thereafter, the relay device 1 repeats the above-described processes of determination and resetting. Then, when packet Pk7 is received in the communication connection, the SPI timer value FTc in the fast path entry information is a negative value, and the valid / invalid setting is invalid. Therefore, the first management unit 12 resets the SPI timer value STc in the slow path entry information. Also, the second management unit 22 resets the SPI timer value FTc in the fast path entry information and validates the valid / invalid setting. At this time, packet Pk7 is transferred via the slow path.

[0065] Then, when 180 seconds have passed since the transfer processing of packet Pk7 without receiving any further packets, the SPI timer value STc of the slow path entry information expires. The first management unit 12 acquires the SPI timeout setting value SPO for slow path transfer, the SPI timeout setting value FPO for fast path transfer, and the SPI timer value FTc of the fast path entry information. In the example of FIG. 9, the SPI timeout setting value SPO for slow path transfer is greater than the SPI timeout setting value FPO for fast path transfer, so the first management unit 12 calculates the updated value STn using equation (1). In the example of FIG. 9, the updated value STn is 180 seconds - (60 seconds - (-120 seconds)) = 0 seconds. Because the updated value STn is equal to or less than 0, the first management unit 12 deletes the slow path entry information and the fast path entry information of the communication connection.

[0066] In this way, the SPI timer value STc of the slow path entry information is updated sequentially, entry information with a long period of no communication is deleted, and the communication connection is removed from the management target. If the relay device 1 receives a UDP packet Pk8 from the WAN host 6 to the LAN host 7 after 180 seconds from the packet forwarding process of packet Pk7 shown in Figure 9, it determines that this is unauthorized access from outside and performs filtering process.

[0067] As described above, in the relay device 1 of this embodiment, when the SPI timer value STc of the slow path entry information expires, the entry information is deleted or the SPI timer value STc of the slow path entry information is updated. This prevents unauthorized access from outside when the SPI timer value has expired, thereby achieving a highly secure SPI. It also prevents packet loss due to packets not being forwarded even when the SPI timer value has not expired. Furthermore, compared to when the SPI timer value STc is synchronized at a fixed interval, the calculation load on the relay device 1 can be reduced. Therefore, even when there are many communication connections in the relay device 1, an increase in the calculation load can be suppressed.

[0068] Furthermore, in the relay device 1 of this embodiment, the SPI timeout setting value FPO for fast path transfer can be set arbitrarily, without depending on the SPI timeout setting value SPO for slow path transfer. This not only reduces the computational processing load on the relay device 1 related to communication connection management, but also reduces the constraints on the setting values, enabling efficient management of communication connections.

[0069] (Explanation of usage) In the present embodiment, the communication management method of the relay device 1 has been described as being applied to SPI, but the application of the communication management method of the present embodiment is not limited to SPI.

[0070] Although this embodiment has been described in the case of UDP UNREPLIED (one-way) communication, it can also be applied to UDP ASSURED (two-way) communication. In the case of UDP ASSURED (two-way) communication, when the SPI timer value STc expires and an updated value STn is calculated, the UDP ASSURED timeout setting value can be referenced as the SPI timeout setting value SPO for slow path transfer, and the UDP ASSURED timeout setting value can be referenced as the SPI timeout setting value FPO for fast path transfer.

[0071] In addition, although the present embodiment has been described using an example in which the communication protocol is UDP, the type of protocol is not limited. The present embodiment may also be applied to protocols other than UDP and TCP, such as TCP. [Explanation of symbols]

[0072] 1 relay device, 2 slow path forwarding unit, 3 fast path forwarding unit, 4 WAN, 5 LAN, 6 WAN host, 7 LAN host, 8 PC, 9 WAN port, 10 LAN port, 11 slow path forwarding processing unit, 12 first management unit, 13 first memory unit, 21 fast path forwarding processing unit, 22 second management unit, 23 second memory unit.

Claims

1. A relay device that relays communication between a first communication network and a second communication network, a slow path forwarding processing unit that performs slow path forwarding of communications between the first communication network and the second communication network; a first storage unit that stores slow path entry information including connection information and a timer value of the communication to be slow path forwarded, and a timeout setting value for slow path forwarding; a first management unit that manages the slow path entry information; a fast path forwarding processor that performs fast path forwarding of communications between the first communications network and the second communications network at a speed faster than that of the slow path forwarding processor; a second storage unit that stores fast path entry information including connection information and a timer value of the communication to be fast path transferred, and a timeout setting value for fast path transfer; a second management unit that manages the fast pass entry information; Equipped with the first management unit updates a timer value of the slow path entry information by using a timer value of the fast path entry information when the timer value of the slow path entry information expires, A relay device in which the timer value of the fast path entry information is either the remaining time until expiration or the elapsed time since expiration.

2. The relay device described in claim 1, wherein when the timer value of the slow path entry information expires, the first management unit updates the timer value of the slow path entry information based on the timer value of the fast path entry information, the timeout setting value for the slow path transfer, and the timeout setting value for the fast path transfer.

3. the fast pass entry information includes a setting for enabling / disabling the communication; 2. The relay device according to claim 1, wherein the second management unit invalidates the valid / invalid setting when a timer value of the fast path entry information expires.

4. The relay device described in claim 1, wherein the first management unit deletes the slow path entry information and the fast path entry information when the timeout setting value for the slow path transfer is less than or equal to the timeout setting value for the fast path transfer and when the timer value of the fast path entry information is less than or equal to 0.

5. When the timer value of the fast path entry information is FTc, the timeout setting value for the slow path transfer is SPO, the timeout setting value for the fast path transfer is FPO, and the updated value of the timer value of the slow path entry information is STn, the first management unit calculates the updated value STn using an equation of STn=SPO-(FPO-FTc); A relay device described in any one of claims 1 to 4, wherein the timer value FTc of the fast path entry information is a positive value when it indicates the remaining time until expiration, and a negative value when it indicates the elapsed time since expiration.

6. The first management unit If the timeout setting value for the slow path transfer is greater than the timeout setting value for the fast path transfer, calculating the updated value; If the update value is equal to or less than 0, delete the slow path entry information and the fast path entry information; The relay device according to claim 5 , wherein when the updated value is greater than 0, the timer value of the slow path entry information is set to the updated value.

7. A relay method for relaying communication between a first communication network and a second communication network, comprising: performing slowpath forwarding of communications between the first communications network and the second communications network; storing, in a first storage unit, slow path entry information including connection information and a timer value of the communication to be slow path forwarded, and a timeout setting value for slow path forwarding; performing a fast-path forwarding of communications between the first communications network and the second communications network at a rate faster than the slow-path forwarding; storing fast path entry information including connection information and a timer value of the communication to be fast path transferred, and a timeout setting value for fast path transfer, in a second storage unit; When the timer value of the slow path entry information expires, the timer value of the slow path entry information is updated using the timer value of the fast path entry information, A relay method in which the timer value of the fast path entry information is either the remaining time until expiration or the elapsed time since expiration.

8. A relay program that causes a processor of a relay device to execute the relay method according to claim 7.

Images