Communication equipment and communication device

Abstract

To provide communication equipment and a communication device capable of achieving favorable communication control.SOLUTION: Communication equipment has: a first port group 21 that can establish connections using a first communication standard; a second port group 22 that can establish connections using a second communication standard that is more secure than the first communication standard; and a controller 210 that, after the connections using the first communication standard and the connections using the second communication standard are established, performs control of receiving from the first port group 21 first data sent by using the first communication standard and transmitting the first data from the second port group 22 by using the second communication standard, and of receiving from the second port group 22 second data sent by using the second communication standard and transmitting the second data from the first port group 21 by using the first communication standard.SELECTED DRAWING: Figure 1

Description

[Technical field]

[0001] The present invention relates to a communication device and a communication apparatus. [Background technology]

[0002] Patent document 1 describes a broker for use in a secure communication network such as the Internet that is configured to mediate client transactions received over a secure network link such as a secure socket layer (SSL) link. [Prior art documents] [Patent documents]

[0003] [Patent Document 1] Special table 2003-504714 Summary of the Invention [Problem to be solved by the invention]

[0004] The problem to be solved is to provide a communication device and a communication apparatus that can realize suitable communication control. [Means for solving the problem]

[0005] According to the first aspect of the present invention The communication device has a first port group capable of establishing a connection using a first communication standard, and a second port group capable of establishing a connection using a second communication standard that is more secure than the first communication standard, and a control unit that performs control to receive first data transmitted using the first communication standard from the first port group and transmit the first data from the second port group using the second communication standard, and to receive second data transmitted using the second communication standard from the second port group and transmit the second data from the first port group using the first communication standard, after a connection using the first communication standard and a connection using the second communication standard have been established, the control unit is capable of control operation in a first mode when a client is provided on the first port group side, and is capable of control operation in a second mode when a server is provided on the first port group side, and when the control unit performs control operation in the first mode, receives a connection request from the client from the first port group and transmits the connection request from the second port group, and when the control unit performs control operation in the second mode, receives the connection request from the second port group and transmits the connection request from the first port group. Effect of the Invention

[0006] According to the present invention, it is possible to provide a communication device and a communication apparatus capable of realizing suitable communication control. [Brief description of the drawings]

[0007] [Figure 1] FIG. 1 is a diagram for explaining a communication device according to the first embodiment. [Diagram 2] FIG. 2 is a diagram for explaining the communication device of the first embodiment. [Diagram 3] FIG. 3 is another diagram for explaining the communication device of the first embodiment. [Figure 4] FIG. 4 is a diagram for explaining the operation of the communication device of the first embodiment. [Diagram 5] FIG. 5 is another diagram for explaining the operation of the communication device of the first embodiment. [Figure 6] FIG. 6 is a diagram for explaining the operation of the communication device of the second embodiment. [Figure 7] FIG. 7 is a diagram for explaining a communication device according to the third embodiment. [Figure 8] FIG. 8 is another diagram for explaining the communication device of the third embodiment. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0008] (First embodiment (standard mode))

[0009] FIG. 1 is a diagram for explaining a communication apparatus according to a first embodiment, FIG. 2 is a diagram for explaining a communication device according to the first embodiment, and FIG. 3 is another diagram for explaining the communication device according to the first embodiment.

[0010] 1, a communication device 1 is, for example, a device that transfers information across multiple networks. Here, a network is, for example, a device that forms a connection (logical communication path) using a communication line to enable data exchange between multiple computers.

[0011] In FIG. 1, the communication device 1 includes a client device 10, a first communication device 20, a first router 30, a second router 50, a second communication device 60, and a server device 70.

[0012] In this embodiment, the client device 10, the first communication device 20, and the first router 30 are provided in a first network 41.

[0013] In the first network 41, a connection (logical communication path) using a first communication standard can be established between the client device 10 and the first communication device 20. The first communication standard can be, for example, an industrial protocol used in an in-house LAN environment in which a local IP address is set for each terminal in a LAN environment based on TCP / IP (Transmission Control Protocol / Internet Protocol).

[0014] Examples of the first communication standard include TCP, Modbus / TCP, Modbus / RTU (remote terminal unit), SLMP (Seamless Message Protocol), HTTP (Hyper Text Transfer Protocol), etc. The first network 41 may include a device other than the client device 10 and the first communication device 20 that can establish a connection using the first communication standard.

[0015] The first communication device 20 and the first router 30 can establish a connection using a second communication standard that is more secure than the first communication standard. The second communication standard can be, for example, a communication standard in which electronic certificates held by the devices that communicate with each other are exchanged, or a communication standard that is more secure than login / password authentication. It is also preferable that the second communication standard is encrypted.

[0016] Examples of the second communication standard include TLS (Transport Layer Security), SSL (Secure Sockets Layer), etc. The first network 41 may include devices other than the first communication device 20 and the first router 30 that are capable of connection using the second communication standard.

[0017] The second router 50, the second communication device 60, and the server device 70 shown in FIG.

[0018] In the second network 42, a connection can be established using the first communication standard between the second communication device 60 and the server device 70. The second network 42 may include devices other than the second communication device 60 and the server device 70 that can establish a connection using the first communication standard.

[0019] A connection using the second communication standard can be established between the second router 50 and the second communication device 60. The second network 42 may include devices other than the second router 50 and the second communication device 60 that can establish a connection using the second communication standard.

[0020] The first network 41 (first router 30) and the second network 42 (second router 50) are adjacent to each other via the Internet 40. A connection can be established between the first router 30 and the Internet 40, and between the second router 50 and the Internet 40, using a second communication standard.

[0021] The client device 10 is, for example, a client PC (personal computer).

[0022] The number of client devices may be one, or may include a plurality of client devices such as client device 11 (not shown), client device 12 (not shown), and client device 13 (not shown) provided in first network 41. Each of the plurality of client devices 11 to 13 is capable of communicating with server device 70 in the same manner as client device 10. The communication device 1 may include a client device (not shown) that is provided in a network different from the first network 41 and is capable of communicating with the server device 70. Each of the multiple client devices may be provided in the same network or in different networks.

[0023] The first communication device 20 is a communication device capable of connecting to the client device 10. The first communication device 20 operates in a client mode for connecting to the client device 10.

[0024] The first router 30 is a router capable of connection with the first communication device 20 and the second router 50. A router is, for example, a device capable of connection (connection or relay) between a plurality of different networks.

[0025] The server device 70 is, for example, a field device that controls devices installed in a factory, a server computer, etc. There may be one server device, or there may be a plurality of server devices such as a server device 71 (not shown), a server device 72 (not shown), and a server device 73 (not shown) installed in the second network 42. Each of the plurality of server devices 71 to 73 is capable of communicating with the client devices 10 to 13 in the same manner as the server device 70. The communication device 1 may have a server device (not shown) that is provided in a network different from the second network 42 and is capable of communicating with the client device 10. Each of the multiple server devices may be provided in the same network or in different networks.

[0026] The second communication device 60 is a communication device capable of connecting to the server device 70. The second communication device 60 operates in a server mode for connecting to the server device 70. The first communication device 20 and the second communication device 60 may be devices having different circuit components and electric circuits, or may be devices having the same circuit components and electric circuits. In this embodiment, the first communication device 20 and the second communication device 60 are devices having identical circuit components and electrical circuits, and by making the settings described below, the first communication device 20 is made to operate in a client mode and the second communication device 60 is made to operate in a server device mode.

[0027] The second router 50 is capable of connection to the second communication device 60 and the first router 30 .

[0028] The first communication device 20 of the present embodiment will be described with reference to FIG.

[0029] The first communication device 20 has a control unit 210, a memory 220, a first port group P21, and a second port group P22.

[0030] The first port group P21 is a port group capable of establishing a connection (logical communication path) using a first communication standard. The first port group P21 has a first communication first port P21a, a first communication second port P21b, and first communication third and fourth ports P21c to P21d.

[0031] The second port group P22 is a port group capable of establishing a connection using a second communication standard that is more secure than the first communication standard. The second port group P22 has a first port for second communication P22a, a second port for second communication P22b, and third and fourth ports for second communication P22c to P22d.

[0032] The control unit 210 performs control for establishing connections with ports of client devices 10 to 13, control for establishing connections with the first router 30 and other routers (not shown), data transfer control after the connections are established, connection cutoff control, encryption, decryption, and the like.

[0033] The memory 220 stores information necessary for the control of the control unit 210. For example, the memory 220 stores information necessary for control to establish a connection, data transfer control after the connection is established, connection cutoff control, encryption, decryption, and the like.

[0034] The control unit 210 controls the transmission of data etc. received from the second communication first port P22a from the first communication first port P21a. The control unit 210 also controls the transmission of data etc. received by the first communication first port P21a from the second communication first port P22a.

[0035] Similarly, the control unit 210 controls the transmission of data etc. received from the second port for second communication P22b from the second port for first communication P21b, and the transmission of data etc. received from the second port for first communication P21b from the second port for second communication P22b.

[0036] Similarly, the control unit 210 controls the transmission of data etc. received from the third and fourth ports P22c to 22d for the second communication from the third and fourth ports P21c to 21d for the first communication, and the transmission of data etc. received from the third and fourth ports P21c to 21d for the first communication from the third and fourth ports P22c to 22d for the second communication.

[0037] The client device 10 has a control unit 110 that performs various controls, and a first port P11a that can be connected to a first communication first port P21a of a first communication device 20 using a first communication standard. The control unit 110 can control the reception of data, etc. supplied from the first port P21a for first communication of the first communication device 20 at the first port P11a, and the transmission of data, etc. from the first port P11a to the first port P21a for first communication.

[0038] The first router 30 has a control unit 310 that performs various controls, a first port P31a that is connectable to the second communication first port P22a of the first communication device 20 using the second communication standard, and a second port P32a.

[0039] The control unit 310 can perform control to receive data, etc. supplied from the second communication first port P22a of the first communication device 20 at the first port P31a, and transmit it from the second port P32a to the Internet 40. The control unit 310 can also perform control to receive data, etc. supplied from the Internet 40 at the second port P32a, and transmit it from the first port P31a to the second communication first port P22a.

[0040] The second communication device 60 of the present embodiment will be described with reference to FIG.

[0041] The second communication device 60 has a control unit 610, a memory 620, a first port group P61, and a second port group P62.

[0042] The first port group P61 is a port group capable of establishing a connection using a first communication standard. The first port group P61 has a first communication first port P61a, a first communication second port P61b, and first communication third and fourth ports P61c to P61d.

[0043] The second port group P62 is a port group capable of establishing a connection using a second communication standard that is more secure than the first communication standard. The second port group P62 has a first port for second communication P62a, a second port for second communication P62b, and third and fourth ports for second communication P62c to P62d.

[0044] The control unit 610 performs control for establishing connections with ports of server devices 70 to 73, control for establishing connections with the second router 50 and other routers (not shown), data transfer control after the connections are established, connection disconnection control, encryption, decryption, and the like.

[0045] The memory 620 stores information necessary for the control of the control unit 610. For example, the memory 620 stores information necessary for control to establish a connection, data transfer control after the connection is established, connection cutoff control, encryption, decryption, and the like. The control unit 610 controls the transmission of data etc. received from the second communication first port P62a from the first communication first port P61a. The control unit 610 also controls the transmission of data etc. received from the first communication first port P61a from the second communication first port P62a.

[0046] Similarly, the control unit 610 controls the transmission of data etc. received from the second to fourth ports P62b to 62d for second communication from the second to fourth ports P61b to 61d for first communication. Also, the control unit 610 controls the transmission of data etc. received from the second to fourth ports P61b to 61d for first communication from the second to fourth ports P62b to 62d for second communication.

[0047] In FIG. 3, the second router 50 has a control unit 510 that performs various controls, a first port P51a that is connectable to the second port P32a of the first router 30 using the second communication standard, and a second port P52a that is connectable to the second communication first port P62a of the second communication device 60 using the second communication standard.

[0048] The control unit 510 performs control to receive data, etc. supplied from the second port P32a of the first router 30 to the Internet 40 at the first port P51a, and transmit the data from the second port P52a to the second communication first port P62a of the second communication device 60. The control unit 510 also performs control to receive data, etc. supplied from the second communication first port P62a of the second communication device 60 at the second port P52a, and transmit the data from the first port P51a (via the Internet 40) to the second port P32a of the first router 30.

[0049] The server device 70 has a control unit 710 that performs various controls, and a first port P71a that can be connected to the first communication first port P61a of the second communication device 60 using a first communication standard. The control unit 710 can perform control to receive data, etc. supplied from the first communication first port P61a of the second communication device 60 at the first port P71a, and to transmit data, etc. from the first port P71a to the first communication first port P61a.

[0050] FIG. 4 is a diagram for explaining the operation of the communication device of the first embodiment, and FIG. 5 is another diagram for explaining the operation of the communication device of the first embodiment.

[0051] Hereinafter, the operation of the communication device 1 of this embodiment will be described with reference to Figures 4 and 5. In Figures 4 to 5, the same components as those shown in Figures 1 to 3 are given the same reference numerals, and duplicated descriptions will be omitted.

[0052] (STEP 1) Setting In step 1, the first communication device 20, the second communication device 60, and the second router 50 perform the following setting operations. (1) Setting of the first communication device 20 The first communication device 20 can perform a setting operation in a first mode (hereinafter referred to as a standard mode) or a second mode (hereinafter referred to as a reverse connection mode) to establish a connection. When performing a setting operation in the standard mode, the user transmits information to the first communication device 20 indicating that the mode is the standard mode.

[0053] When control unit 210 receives information indicating that the mode is the standard mode, it stores the information indicating that the mode is the standard mode in memory 220, and starts the setting operation by referring to the information indicating that the mode is the standard mode stored in memory 220.

[0054] Next, the user transmits information on the number of listening ports for TCP connections (for example, 1, 2, 4, 8) to first communication device 20. When control unit 210 receives the information on the number of listening ports for TCP connections, it stores the information on the number of listening ports for TCP connections in memory 220 and performs an operation of setting the number of listening ports for TCP connections.

[0055] Next, the user supplies client information for the number of waiting ports for TCP connection to the first communication device 20. The control unit 210 performs client setting based on the supplied information. Specifically, for example, as shown in FIG. 5, the control unit 210 (a) stores the waiting port number 502 (P21a) for the TCP connection in the memory 220, (b) stores the destination port number 802 (P62a) for the TLS connection in the memory 220, and (c) stores the IP address or domain name (server1.jp) of the destination of the TLS connection in the memory 220, and performs client setting based on the information stored in the memory 220.

[0056] (2) Setting of the second communication device 60 The second communication device 60 can also perform a setting operation in a first mode (hereinafter referred to as a standard mode) or a second mode (hereinafter referred to as a reverse connection mode) to establish a connection, similar to the first communication device 20. When performing a setting operation in the standard mode, the user transmits information to the second communication device 60 indicating that the mode is the standard mode.

[0057] When control unit 610 receives information indicating that the mode is the standard mode, it stores the information indicating that the mode is the standard mode in memory 620, and starts the setting operation by referring to the information indicating that the mode is the standard mode stored in memory 620.

[0058] Next, the user transmits information on the number of listening ports for TLS connections (e.g., 1, 2, 4, 8) to the second communication device 60. When the control unit 610 receives the information on the number of listening ports for TLS connections, it stores the information on the number of listening ports for TLS connections in the memory 620 and performs an operation of setting the number of listening ports for TLS connections.

[0059] Next, the user supplies the second communication device 60 with server information for the number of waiting ports for TLS connection. The control unit 610 performs server setting based on the supplied information. Specifically, for example, as shown in FIG. 5, the control unit 610 (a) stores in the memory 620 that the client authentication is valid, (b) stores in the memory 620 the waiting port number 802 (P62a) for the TLS connection, (c) stores in the memory 620 the destination port number 502 (P71a) for the TCP connection, and (d) stores in the memory 620 the IP address or domain name (192.168.1.200) of the server device 70, and performs server setting based on the information stored in the memory 620.

[0060] (3) Setting the second router 50 The user transmits information required for the setting to the second router 50. As a result, the control unit 510 of the second router 50 (a) opens the port set in the TLS reception port 802 (P62a) of the server function of the second communication device 60, and passes it to the second communication device 60, and (b) makes it possible to specify the destination from outside using a fixed IP address or DDNS.

[0061] (STEP 2) Connection In step 2, the client device 10, the first communication device 20, the second communication device 60 and the second router 50 perform the following connection operations. The client device 10 makes a TCP connection to the first communication device 20. Next, the first communication device 20 makes a TLS connection to the second communication device 60 (via the first router 30 and the second router 50). Next, the second communication device 60 makes a TCP connection to the server device 70. This allows the client device 10 to connect to the server device 70.

[0062] While the client device 10 is connected to the server device 70, it is preferable for the client device 10 to perform the following operations, for example. (A) The first communication device 20 requests a server certificate from the second communication device 60 and verifies whether the signature on the certificate is from a trusted certificate authority (server authentication). (a) The second communication device 60 requests a client certificate from the first communication device 20 and verifies whether the signature on the client certificate is from a reliable certificate authority (client authentication). Note that the client authentication performed by the second communication device 60 may be omitted. (c) The first communication device 20 and the second communication device 60 start public key encryption communication using the public key attached to the certificate. Here, communication (key exchange) is performed to exchange common key information (not a public key or a private key) between the two devices. Since this communication is encrypted using public key encryption, the risk of it being intercepted is extremely low. (d) The first communication device 20 and the second communication device 60 start common key encryption communication using a common key. Note that the upper layer application protocol starts from this state.

[0063] Here, mutual authentication (server authentication, client authentication) during a TLS connection will be described in more detail.

[0064] To perform mutual authentication, the system administrator must first set up a local certification authority (LCA). Specifically, for example, an LCA can be set up within one PC. By setting up the LCA, an LCA certificate is created and stored as electronic data within the PC. Note that a specific program such as an LCA construction support tool may be used to set up the LCA.

[0065] Next, the certificate for the main body created using a predetermined program or the like is transferred to the first communication device 20 and the second communication device 60. The certificate exchanged between the first communication device 20 and the second communication device 60 during TLS connection contains the signature of the LCA. To confirm that this is definitely the signature of the LCA previously constructed, the certificate of that LCA is required. For this reason, when the main body certificate is transferred to the first communication device 20 and the second communication device 60, the certificate of the LCA is also transferred together.

[0066] When the main certificate is transferred to the first communication device 20 and the second communication device 60, the main private key (file format) required for encrypted communication is also transferred. In this manner, the main certificate, the LCA certificate, and the main private key are transferred to the first communication device 20 and the second communication device 60.

[0067] (STEP 3) Transfer In step 3, the first communication device 20 and the second communication device 60 perform the following forwarding operations. (a) The first communication device 20 transmits data received from the TCP-connected client device 10 to the TLS-connected second communication device 60 (via the first router 30 and the second router 50), and conversely transmits data received from the second communication device 60 to the client device 10. (i) The second communication device 60 transmits data received from the TCP-connected server device 70 to the TLS-connected first communication device 20 (via the first router 30 and the second router 50), and conversely transmits data received from the first communication device 20 to the server device 70.

[0068] (STEP 4) Cutting In step 4, the following disconnection operations are performed.

[0069] Communication with the communication device 1 is disconnected when any of the TCP connection between the client device 10 and the first communication device 20, the TLS connection between the first communication device 20 and the second communication device 60, and the TCP connection between the second communication device 60 and the server device 70 is disconnected.

[0070] The first communication device 20 of the present embodiment described above has a first port group P21 (P21a to P21d) capable of establishing a connection (logical communication path) using a first communication standard (TCP), a second port group P22 (P22a to P22d) capable of establishing a connection using a second communication standard (TLS) that is more secure than the first communication standard, and a control unit 210 that performs control to receive first data sent using the first communication standard (TCP) from the first port group P21 and transmit the first data from the second port group P22 using the second communication standard (TLS) after a connection using the first communication standard (TCP) and a connection using the second communication standard (TLS) have been established, and to receive second data sent using the second communication standard (TLS) from the second port group P22 and transmit the second data from the first port group P21 using the first communication standard (TCP).

[0071] Because the second port group P22 (P22a to P22d) of the first communication device 20 supports the highly secure second communication standard (TLS), sufficient information security can be ensured even when the second port group P22 (P22a to P22d) is connected to the Internet 40.

[0072] In addition, since the first port group P21 (P21a to P21d) of the first communication device 20 supports the first communication standard (TCP), the first communication device 20 can easily connect to a client device 10 or the like in the first network 41, which is less secure than the second communication standard (TLS).

[0073] The above-mentioned first communication device 20 can realize suitable communication that simultaneously achieves highly secure communication using the second port group P22 (P22a to P22d) and easy connectivity to the first network 41 using the first port group P21 (P21a to P21d).

[0074] The second communication device 60 of the present embodiment described above has a first port group P61 (P61a to P61d) capable of establishing a connection (logical communication path) using a first communication standard (TCP), a second port group P62 (P62a to P62d) capable of establishing a connection using a second communication standard (TLS) that is more secure than the first communication standard, and a control unit 610 that performs control to receive first data sent using the first communication standard (TCP) from the first port group P61 and transmit the first data from the second port group P62 using the second communication standard (TLS) after a connection using the first communication standard (TCP) and a connection using the second communication standard (TLS) have been established, and to receive second data sent using the second communication standard (TLS) from the second port group P62 and transmit the second data from the first port group P61 using the first communication standard (TCP).

[0075] The second communication device 60 has a second port group P62 (P62a to P62d) that supports the highly secure second communication standard (TLS), so that sufficient information security can be ensured even when the second port group P62 (P62a to P62d) is connected to the Internet 40.

[0076] In addition, since the first port group P61 (P61a to P61d) of the second communication device 60 is compatible with the first communication standard (TCP), the second communication device 60 can easily connect to a server device 70 or the like in the second network 42, which is less secure than the second communication standard (TLS).

[0077] The above-mentioned second communication device 60 can realize suitable communication that simultaneously achieves highly secure communication using the second port group P62 (P62a to P62d) and easy connectivity to the second network 42 using the first port group P61 (P61a to P61d).

[0078] In the communication device 1 of the present embodiment described above, the first communication device 20 and the second communication device 60 are directly exposed to the Internet 40, but the client device 10 and the server device 70 are not directly exposed to the Internet 40. This makes it possible to avoid direct attacks on the client device 10 and the server device 70, thereby improving the security of communication.

[0079] The TLS mutual authentication of this embodiment is more secure than login / password authentication because it is a communication in which electronic certificates held by both the first communication device 20 and the second communication device 60 are exchanged. Therefore, by using the communication device 1 of this embodiment, it is possible to reject spoofed connections by external attackers while permitting connections from authenticated parties (the first communication device 20 and the second communication device 60), thereby improving the security of communication.

[0080] In the communication device 1 of this embodiment, TLS encryption is performed between the first communication device 20 and the second communication device 60, so that the risk of eavesdropping and tampering can be reduced.

[0081] In the communication device 1 of the present embodiment described above, the security of communication is ensured by the first communication device 20 and the second communication device 60, so there is no need to make any changes to the lines or devices on the client side of the first communication device 20 or on the server side of the second communication device 60. This eliminates the need to make system changes to encrypt lines or devices.

[0082] In this embodiment, by using the client devices 11 to 13 or the server devices 71 to 73, it is possible to obtain the same effects as those obtained by the client device 10 or the server device 70.

[0083] (Second embodiment (reverse connection mode))

[0084] Fig. 6 is a diagram for explaining the operation of the communication device 2 of the second embodiment. In the following explanation, the same components as those shown in Figs. 1 to 5 are given the same reference numerals, and duplicate explanations will be omitted.

[0085] The communication device 2 of this embodiment has a client device 10, a first communication device 20, a first router 30, a second router 50, a second communication device 60, and a server device 70, similar to the communication device 1 shown in FIG.

[0086] In the communication device 2 of this embodiment, similar to the communication device 1 shown in FIG. 1, the client device 10, the first communication device 20, and the first router 30 are provided in a first network 41, and the second router 50, the second communication device 60, and the server device 70 are provided in a second network 42.

[0087] The communication device 2 of this embodiment differs from the communication device 1 shown in FIG. 1 in the method of connection using the first and second communication standards, and this point will be described in detail with reference to FIGS.

[0088] (STEP 1) Setting In step 1, the first communication device 20, the second communication device 60, and the first router 30 perform the following setting operations.

[0089] (1) Setting of the first communication device 20 As described above, the first communication device 20 can perform a setting operation in the first mode (standard mode) or the second mode (reverse connection mode) to establish a connection. When performing a setting operation in the reverse connection mode, the user transmits information to the first communication device 20 indicating that the mode is the reverse connection mode.

[0090] When the control unit 210 receives information indicating that the mode is the reverse connection mode, the control unit 210 stores the information indicating that the mode is the reverse connection mode in the memory 220, and starts the setting operation by referring to the information indicating that the mode is the reverse connection mode stored in the memory 220.

[0091] Next, the user transmits the client information to the first communication device 20 in order to operate the first communication device 20 in the client mode. When the control unit 210 receives the client information, it stores the client information in the memory 220 and performs a setting operation by referring to the client information stored in the memory 220.

[0092] Next, the user transmits information on waiting port number 502 (P21a) for TCP connection to first communication device 20. When control unit 210 receives the information on waiting port number for TCP connection, it stores the information on waiting port number 502 (P21a) for TCP connection in memory 220 and performs a setting operation based on the information stored in memory 220.

[0093] Next, the user supplies information on the standby port number 802 (P22a) for the TLS connection to the first communication device 20. When the control unit 210 receives the information on the standby port number for the TLS connection, it stores the information on the standby port number 802 (P22a) for the TLS connection in the memory 220 and performs a setting operation based on the information stored in the memory 220.

[0094] (2) Setting of the second communication device 60 As described above, the second communication device 60 can perform a setting operation in the first mode (standard mode) or the second mode (reverse connection mode) to establish a connection. When performing a setting operation in the reverse connection mode, the user transmits information to the second communication device 60 indicating that the mode is the reverse connection mode.

[0095] When the control unit 610 receives information indicating that the mode is the reverse connection mode, it stores the information indicating that the mode is the reverse connection mode in the memory 620, and starts the setting operation by referring to the information indicating that the mode is the reverse connection mode stored in the memory 620.

[0096] Next, the user transmits the server device information to the second communication device 60 in order to operate the second communication device 60 in the server device mode. When the control unit 610 receives the server device information, the control unit 610 stores the server device information in the memory 620 and performs a setting operation based on the server device information stored in the memory 220.

[0097] Next, the user supplies information on the destination port number 802 (P22a) of the TLS connection to the second communication device 60. When the control unit 610 receives the information on the destination port number of the TLS connection, it stores the information on the destination port number 802 (P22a) of the TLS connection in the memory 620 and performs a setting operation based on the information stored in the memory 620.

[0098] Next, the user supplies information on the IP address or domain name (server2.jp) of the TLS connection destination to the second communication device 60. When the control unit 610 receives the information on the IP address or domain name of the TLS connection destination, it stores the information on the IP address or domain name (server2.jp) of the TLS connection destination in the memory 620 and performs a setting operation based on the information stored in the memory 620.

[0099] Next, the user supplies information on destination port number 502 (P71a) of the TCP connection to second communication device 60. When control unit 610 receives the information on destination port number of the TCP connection, it stores the information on destination port number 502 (P71a) of the TCP connection in memory 620 and performs a setting operation based on the information stored in memory 620.

[0100] Next, the user supplies information on the IP address or domain name (192.168.1.200) of the server device 70 to the second communication device 60. When the control unit 610 receives the information on the IP address or domain name of the server device 70, it stores the information on the IP address or domain name (192.168.1.200) of the server device 70 in the memory 620 and performs a setting operation based on the information stored in the memory 620.

[0101] (3) Setting the first router 30 The user transmits information required for setting to the first router 30. As a result, the control unit 310 of the first router 30 (a) opens a reception port and passes the packet to the local address port (P22a) of the first communication device 20, and (b) makes the destination identifiable from outside using a fixed IP address or DDNS.

[0102] The communication device 2 of the present embodiment described above does not need to open a port on the router (second router 50) on the server device 70 side, so that the server device 70, which is a field device or the like, is less likely to be the target of attacks.

[0103] The communication device 1 of the first embodiment is in standard mode, so for example, a fixed IP address or DDNS contract is required for each server device, and the communication device 2 of the present embodiment is in reverse connection mode, so for example, a fixed IP address, DDNS contract procedures, etc. are required for each client device. For example, if there are four server devices (70-73) and one client device (10), four contract procedures, etc. are required in the standard mode, and one contract procedure, etc. is required in the reverse connection mode.

[0104] For example, when the field equipment installed in a factory is a server device and the PC monitoring the server device is a client device, the number of server devices will often be greater than the number of client devices, so by selecting the reverse connection mode instead of the standard mode, the number of contract procedures, etc. can be reduced. It goes without saying that when the number of client devices is greater than the number of server devices, the number of contract procedures can be reduced by selecting the standard mode instead of the reverse connection mode.

[0105] Third embodiment

[0106] Fig. 7 is a diagram for explaining a communication device of the third embodiment, and Fig. 8 is another diagram for explaining the communication device of the third embodiment. In the following description, the same reference numerals are given to configurations similar to those shown in Figs. 1 to 6, and duplicated description will be omitted.

[0107] The communication device 3 shown in Figures 7 and 8 differs from the communication devices shown in Figures 1 to 6 in that it has a client device 11 (see Figure 7) in addition to client device 10, and has a server device 71 (see Figure 8) in addition to server device 70.

[0108] In FIG. 7, like client device 10, client device 11 has a control unit 111 that performs various controls, and a first port P11b that can be connected to a second port P21b for first communication of the first communication device 20 using a first communication standard.

[0109] The control unit 111 can receive data etc. supplied from the first communication second port P21b of the first communication device 20 at the first port P11b, and transmit data etc. from the first port P11b to the first communication second port P21b.

[0110] The control unit 210 of the first communication device 20 controls the transmission of data etc. received from the first port for second communication P22a from the first port for first communication P21a, and the transmission of data etc. received from the second port for second communication P22b from the second port for first communication P21b.

[0111] In addition, the control unit 210 controls the data etc. received by the first port for first communication P21a to be transmitted from the first port for second communication P22a, and the data etc. received by the second port for first communication P21b to be transmitted from the second port for second communication P22b.

[0112] In addition to the configuration shown in Figures 1 to 6, the first router 30 has a first port P31b and a second port P32b that are connectable to the second communication second port P22b of the first communication device 20 using the second communication standard.

[0113] The control unit 310 of the first router 30 controls the reception of data etc. supplied from the first port P22a for the second communication of the first communication device 20 at the first port P31a and transmission of the same to the Internet 40 from the second port P32a, and the reception of data etc. supplied from the second port P22b for the second communication of the first communication device 20 at the first port P31b and transmission of the same to the Internet 40 from the second port P32b.

[0114] In addition, the control unit 310 receives data and the like supplied from the Internet 40 at the second port P32a and transmits the data from the first port P31a to the second communication first port P22a, It performs control so that data etc. supplied from the Internet 40 is received at the second port P32b and transmitted from the first port P31b to the second communication second port P22b.

[0115] In FIG. 8, the control unit 510 of the second router 50 controls the receiving of data etc. supplied from the second port P32a of the first router 30 to the Internet 40 at the first port P51a and transmission from the second port P52a to the first port for second communication P62a of the second communication device 60, and the receiving of data etc. supplied from the second port P32b of the first router 30 to the Internet 40 at the first port P51b and transmission from the second port P52b to the second port for second communication P62b of the second communication device 60.

[0116] In addition, the control unit 510 controls the receiving of data, etc. supplied from the first port P62a for second communication of the second communication device 60 at the second port P52a and transmission from the first port P51a to the second port P32a of the first router 30 (via the Internet 40), and the receiving of data, etc. supplied from the second port P62b for second communication of the second communication device 60 at the second port P52b and transmission from the first port P51b to the second port P32b of the first router 30 (via the Internet 40).

[0117] The control unit 610 of the second communication device 60 controls the transmission of data etc. received from the first port for second communication P62a from the first port for first communication P61a, and the transmission of data etc. received from the second port for second communication P62b from the second port for first communication P61b.

[0118] In addition, the control unit 610 controls the transmission of data etc. received from the first port for first communication P61a from the first port for second communication P62a, and the transmission of data etc. received from the second port for first communication P61b from the second port for second communication P62b.

[0119] Like the server device 70, the server device 71 has a control unit 711 that performs various controls, and a first port P71b that can be connected to the first communication second port P61b of the second communication device 60 using the first communication standard. The first port P71b can receive data, etc. from the first communication second port P61b, and transmit data, etc. to the first communication second port P61b.

[0120] The communication device 3 of the present embodiment described above includes the client device 11 and the server device 71 in addition to the client device 10 and the server device 70, and therefore can perform suitable control using the client devices 10, 11 and the server devices 70, 71.

[0121] In the present embodiment, the case where two client devices and two server devices 70 are used has been described as an example, but the present invention is not limited to this. For example, one client device and multiple server devices 70 may be used, multiple client devices and one server device 70 may be used, or one client device and one server device 70 may be used.

[0122] In the above embodiment, the case where one first router 30 and one second router 50 are used has been described as an example, but the present invention is not limited to this. It goes without saying that at least one of the first router 30 and the second router 50 may be multiple.

[0123] The configurations of the above-described embodiments can be combined with each other. Although various embodiments and modifications have been described above, the present invention is not limited to these. For example, combinations of the configurations of the above-described embodiments and other aspects that are conceivable within the scope of the technical idea of ​​the present invention are also included in the scope of the present invention. [Industrial Applicability]

[0124] According to the present invention, it is possible to provide a communication device and a communication apparatus capable of realizing suitable communication control. [Explanation of symbols]

[0125] 1. Communications equipment 10 Client Device 20 1st communication equipment 30 First Router 50 Second Router 60 Second communication equipment 70 Server equipment

Claims

1. a first port group capable of establishing a connection using a first communication standard; a second port group capable of establishing a connection using a second communication standard having higher security than the first communication standard; After the connection using the first communication standard and the connection using the second communication standard are established, a control unit that performs control to receive first data transmitted using the first communication standard from the first port group and transmit the first data from the second port group using the second communication standard, and to receive second data transmitted using the second communication standard from the second port group and transmit the second data from the first port group using the first communication standard, the control unit is capable of performing a control operation in a first mode when a client is provided on the first port group side, and is capable of performing a control operation in a second mode when a server is provided on the first port group side, When the control unit performs a control operation in the first mode, the control unit receives a connection request from the client through the first port group and transmits the connection request through the second port group; A communications device that receives the connection request from the second port group and transmits the connection request from the first port group when the control unit performs a control operation in the second mode.

2. 2. A communication device according to claim 1, The first port group includes: a first communication first port for receiving the first data and transmitting the second data; a first communication second port for receiving third data different from the first data and transmitting fourth data different from the second data, The second port group includes: a second communication first port for receiving the second data and transmitting the first data; a second port for second communication for receiving the fourth data and for transmitting the third data.

3. A communication device including the communication device according to claim 1 or claim 2, a first communication device provided by the client on the side of the first port group, and a second communication device provided by the server on the side of the first port group, A communication device in which, when the first communication device and the second communication device connect using the second communication standard, each device sends and receives certificates to verify the signature of the other device's certificate, and the connection is established only if both devices are authenticated.

Images