COMMUNICATION DEVICE, COMMUNICATION METHOD, AND PROGRAM

Abstract

This communication device which performs packet communication comprises: a data storage unit for retaining a rule for a value-added service policy; a transmission unit for inquiring, to a translation device which performs address translation, about translation information including information before address translation; a reception unit for receiving the translation information from the translation device; and a control unit for determining, by using the translation information, whether or not the rule is to be applied to a packet which is after address translation and which is received from the translation device.

Description

[Technical field]

[0001] The present invention relates to a communication device that performs packet communication. [Background technology]

[0002] A widely used form of communication is one in which packets sent from a terminal are forwarded to an external server by a GW (gateway). The GW generally has a NAPT (Network Address Port Translation) function. The GW equipped with the NAPT function is called a NAT-GW. The NAPT process may also be called "address translation."

[0003] Between the NAT-GW and an external server, a GW (called a VAS-GW) that provides value added services (VAS) such as packet filtering may be installed. The VAS-GW generally performs processing related to value added services based on the 5-tuple of a packet. [Prior art documents] [Non-patent literature]

[0004] [Non-Patent Document 1] Juniper NETWORKS, "Network Address Port Translation," 17,Feb,2021. https: / / www.juniper.net / documentation / us / en / software / junos / interfaces-adaptive-services / topics / topic-map / network-address-port-translation.html Summary of the Invention [Problem to be solved by the invention]

[0005] The rules of the value-added service policy held by the VAS-GW are written based on the address information of the packet before address translation. Therefore, the VAS-GW cannot determine whether the rules of the value-added service policy should be applied to the packet that has been address translated by the NAT-GW in the previous stage.

[0006] The present invention has been made in consideration of the above points, and aims to provide a technique that enables rules relating to value-added services to be appropriately applied in packet communication, even when a device that performs address translation is provided in front of a device that provides a value-added service. [Means for solving the problem]

[0007] According to the disclosed technology, there is provided a communication device for performing packet communication, comprising: a data storage unit for storing rules of a value-added service policy; a transmission unit for inquiring of translation information including information before the address translation from a translation device that performs address translation; a receiving unit that receives the conversion information from the conversion device; a control unit that uses the translation information to determine whether or not to apply the rule to an address-translated packet received from the translation device; A communication device is provided, comprising: Effect of the Invention

[0008] According to the disclosed technology, a technology is provided that enables rules relating to value-added services to be appropriately applied in packet communication even when a device that performs address translation is installed in front of a device that provides a value-added service. [Brief description of the drawings]

[0009] [Figure 1] FIG. 1 is a diagram showing a basic system configuration. [Diagram 2] FIG. 1 is a diagram for explaining a problem. [Diagram 3] FIG. 1 is a diagram for explaining an overview of an embodiment. [Figure 4] FIG. 1 is a diagram for explaining method 1. [Diagram 5] FIG. 13 is a diagram for explaining method 2. [Figure 6] FIG. 13 is a diagram for explaining method 3. [Figure 7] FIG. 1 is a diagram for explaining a configuration example of a communication device. [Figure 8] FIG. 2 illustrates an example of a hardware configuration of the apparatus. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0010] Hereinafter, an embodiment of the present invention (the present embodiment) will be described with reference to the drawings. The embodiment described below is merely an example, and the embodiment to which the present invention is applied is not limited to the following embodiment.

[0011] (Basic configuration) First, the basic system configuration and operation related to this embodiment will be described, and then the problems involved will be described.

[0012] An example of the system configuration is shown in Fig. 1. Fig. 1 (and Fig. 2) show an example of a configuration that does not have the functions according to the present invention in order to explain the problem. Note that Figs. 1 and 2 are not publicly known.

[0013] 1, the system includes a GW 10, a VAS-GW (value added service - gateway) 20, and a server 30, and UEs (user equipment) 1 to 3 are connected to the GW 10. The devices are connected to each other via a wired or wireless network, and can communicate with each other as shown in the figure.

[0014] The UE is a device that transmits and receives packet communications. The UE is, for example, a PC, a smartphone, an IoT device, etc. The UE may also be called a terminal.

[0015] The GW 10 may be any network device that processes packets. The GW 10 has network functions such as L2 / L3 forwarding, a firewall, a VPN connection, DPI, a proxy, etc. The GW 10 may be called a communication device.

[0016] The GW 10 may be an S-GW or P-GW in the EPC, a UPF in the 5GC, a base station (eNodeB, gNodeB, etc.), a router, a switch, etc. The GW 10 may be a physical device or a virtual device.

[0017] The above explanation of the GW10 also applies to the VAS-GW20. The VAS-GW20 differs from the GW10 in that it has the function of providing value-added services.

[0018] In Fig. 1, UEs 1 to 3 are connected to a GW 10 and communicate with a server 30 connected to the GW 10. The server 30 is, for example, an application server. A VAS-GW 20 is installed between the GW 10 and the server 30. The VAS-GW 20 provides, for example, the following value-added services to user communications.

[0019] Packet filtering QoS control (prioritizing communications from specific UEs or specific ports, etc.) - Communication anomaly detection Policy-based routing In these processes, the VAS-GW 20 checks the packet header (5 tuples, etc.) of the received packet to determine whether or not processing of the packet is required. The 5 tuples are the source IP address, source port number, destination IP address, destination port number, and protocol number.

[0020] As an example, the VAS-GW 20 holds a value-added service policy (table) for filtering as shown in Fig. 1. As shown in the value-added service policy, by having rules for each UE in the value-added service policy, it is possible to perform various processes on user traffic.

[0021] (About the assignment) For example, in a configuration in which a large number of UEs are connected, UE addresses can be hidden and global IP addresses can be saved by performing NAPT (Network Address Port Translation) in GW10 (here, NAT-GW10) as shown in Figure 2. The NAPT process may also be called address translation. "NAPT" also includes the operation of performing only address translation without port number translation.

[0022] However, if NAPT processing is performed by NAT-GW10 (router, etc.) that precedes VAS-GW20, VAS-GW20 will receive packets from NAT-GW10 with the UE 5tuple converted, and will be unable to identify the UE and will be unable to operate value-added services correctly. Specifically, as shown in Figure 2, for example, UE addresses may be concealed, making it impossible to filter per UE, and anomaly detection may be erroneous when switching sessions.

[0023] As an existing technology, general routers (GWs) have a function to statically specify conversion rules, which makes it possible to set conversion rules in advance. However, since UE addresses and sessions increase and decrease dynamically, issues such as exhaustion of port numbers are expected.

[0024] (Technology of the embodiment) The technology according to this embodiment will be described below. Fig. 3 shows an example of a system configuration according to this embodiment. The system configuration shown in Fig. 3 is basically the same as the configuration shown in Fig. 1 or 2. The NAT-GW 100 and VAS-GW 200 correspond to the GWs described in Fig. 1 and Fig. 2 with the addition of functions according to the present invention.

[0025] The NAT-GW 100 may be called a conversion device, and the VAS-GW 200 may be called a value-added service providing device. In addition, both the NAT-GW 100 and the VAS-GW 200 may be called a communication device.

[0026] The NAT-GW 100 that notifies the session information may be any device that can recognize the session state related to NAT conversion, such as the S-GW, P-GW, UPF, base station, router, switch, etc., as described above, as well as a radius server, DHCP server, 4G / 5G core function unit (SMF, AMF, etc.), etc. The NAT-GW 100 may be a home gateway for home use, CPE, etc.

[0027] In the system according to this embodiment, the VAS-GW 200 acquires NAPT session information from the NAT-GW 200, thereby identifying information about the UE.

[0028] In addition, NAT-GW100 holds conversion rules for IP addresses, port numbers, etc. as NAPT rules, and when communication that matches these NAPT rules occurs, a NAPT session is generated and the IP address and port number of the communication that matches the session are converted. Information related to the session is session information. Session information may also be called conversion information.

[0029] In this embodiment, by sharing session information between the VAS-GW 200 and the NAT-GW 100, the VAS-GW 200 becomes able to perform packet processing related to value-added services based on the information before conversion.

[0030] The session information passed from NAT-GW100 to VAS-GW200 is, for example, "5 tuples before conversion and 5 tuples after conversion." The session information may also be "a part of the 5 tuples before conversion and a part of the 5 tuples after conversion." The session information may also be "the 5 tuples before conversion" or "a part of the 5 tuples before conversion."

[0031] Specifically, the session information passed from NAT-GW100 to VAS-GW200 may be "the source IP address and source port number before conversion and the source IP address and source port number after conversion" or "the source IP address and source port number before conversion."

[0032] There are three variations in the method for passing session information from NAT-GW100 to VAS-GW200:

[0033] Method 1 (Pull type): When VAS-GW200 receives a new 5-tuple packet from NAT-GW100, VAS-GW200 queries NAT-GW100 for session information.

[0034] Method 2 (Push type): NAT-GW100 notifies VAS-GW200 of session information after each NAPT conversion.

[0035] Method 3 (header embedding type): NAT-GW100 embeds the IP address and port number before conversion in the options header of the IP header and sends the packet.

[0036] Each method will be described in more detail below.

[0037] (Method 1: Pull type) The processing procedure of method 1 will be described with reference to Fig. 4. It is assumed that the VAS-GW 200 receives a packet for a new session from the NAT-GW 100.

[0038] In S101, the VAS-GW 200 inquires about session information from the NAT-GW 100. Inquiring about session information may mean transmitting a request for the session information.

[0039] In S102, the NAT-GW 100 transmits session information to the VAS-GW 200. The VAS-GW 200 receives the session information.

[0040] For example, assume that the 5-tuple after address conversion of the old session before the new session starts is "source IP address, source port number, destination IP address, destination port number, protocol number" = "A, B, C, D, E".

[0041] When VAS-GW200 receives a packet of a new session from NAT-GW100, for example a packet with 5 tuples of "A, B, X, Y, E", VAS-GW200 queries NAT-GW100 for session information of "A, B, X, Y, E".

[0042] In response to this query, NAT-GW100 returns to VAS-GW200, for example, information indicating that the 5-tuple of "A, B, X, Y, E" before NAPT conversion is "A', B', X, Y, E" as session information. This enables VAS-GW200 to perform filtering for the session of "A, B, X, Y, E" using, for example, a filtering rule in which the source IP address is "A'".

[0043] In method 1, the VAS-GW 200 may make an inquiry for every new session, but in that case, the amount of processing by the NAT-GW 100 may increase.

[0044] Therefore, the VAS-GW 200 may make an inquiry only when it receives a packet of a new session and the session is a communication related to the VAS policy. This makes it possible to prevent unnecessary inquiries from being generated.

[0045] To determine whether a session is communication related to the VAS policy, for example, VAS-GW200 compares the 5-tuple of the session with the VAS policy (table information) it holds, and if there is at least one piece of information in the 5-tuple that matches the VAS policy, it can determine that the session is communication related to the VAS policy.

[0046] In method 1, packets are sent from NAT-GW 100 to VAS-GW 200 even during the query processing of session information. VAS-GW 200 stores packets received during the query processing of session information in a buffer, and processes the packets stored in the buffer after acquiring the session information.

[0047] Regarding buffering received packets during session information inquiry processing, it is desirable for the VAS-GW200 to hold packets in the buffer at the time of the TCP 3-way handshake. After the TCP 3-way handshake, data transmission starts via the established connection, and there is a possibility that the buffer will overflow due to a large number of packets from the UE during the inquiry processing. By holding packets in the buffer at the time of the TCP 3-way handshake, buffer overflow can be prevented.

[0048] (Method 2: Push type) The process of method 2 will be described with reference to Fig. 5. The NAT-GW100 performs NAPT conversion on a packet received from the UE, and immediately before transferring the NAPT converted packet to the VAS-GW200, in S201, notifies the VAS-GW200 of session information.

[0049] As an example, assume that NAT-GW100 receives a packet with 5 tuples of "A', B', C, D, E" from UE, and converts "A', B', C, D, E" to "A, B, C, D, E" by NAPT conversion. At this time, before forwarding the packet, NAT-GW100 transmits information indicating that "A, B, C, D, E" was "A', B', C, D, E" before the conversion as session information to VAS-GW200. NAT-GW100 then transmits packets of "A, B, C, D, E" in that session to VAS-GW200.

[0050] Based on the session information received from NAT-GW100, VAS-GW200 can perform filtering on packets "A, B, C, D, E" using a filtering rule in which the source IP address is "A'", for example.

[0051] Session information needs to be sent from NAT-GW100 to VAS-GW200 only when the first packet of a session is sent. After that, while the session continues, VAS-GW200 can use the session information to determine whether the value-added service policy should be applied. In method 2, there is no inquiry, so communication delays can be reduced more than in method 1.

[0052] (Method 3: Header embedded type) The processing of method 3 will be described with reference to Fig. 6. NAT-GW 100 performs NAPT conversion on packets received from UE. Here, as an example, it is assumed that conversion is performed on the pair of source IP address and source port number of the packet (IP address / port number).

[0053] NAT-GW100 embeds the pre-translation IP address and port number in the IP header (specifically, the options header) of the translated packet, and at S301, sends the translated packet with the pre-translation IP address and port number embedded to VAS-GW200.

[0054] As an example, assume that NAT-GW100 receives a packet with 5 tuples "A', B', C, D, E" from a UE and converts "A', B', C, D, E" to "A, B, C, D, E" through NAPT conversion.

[0055] At this time, NAT-GW100 embeds "A', B'" in the packet after NAPT conversion, and transmits the packet with "A', B'" embedded therein to VAS-GW200. Based on "A', B'" embedded in the packet received from NAT-GW100, VAS-GW200 can perform filtering on the packets "A, B, C, D, E" using, for example, a filtering rule in which the source IP address is "A'".

[0056] In a session, the packets in which the pre-conversion IP address and port number are embedded may be the first packet of the session, or all packets in subsequent communications in the session. In addition, the VAS-GW200 may delete the option header in which the pre-conversion information is embedded. This makes it possible to conceal the source UE.

[0057] (Device configuration example) FIG. 7 is a diagram showing the functional configuration of a communication device 300 equivalent to the NAT-GW 100 or the VAS-GW 200. As shown in FIG.

[0058] As shown in FIG. 7, communication device 300 includes a transmitter 310 that transmits packets, a receiver 320 that receives packets, a controller 330 that processes packets, and a data storage unit 340 that stores various data.

[0059] When the communication device 300 operates as the VAS-GW 200 of method 1, the data storage unit 340 stores the rules of the value-added service policy. The transmitter 310 queries the NAT-GW 100 for translation information including information before address translation, and the receiver 320 receives the translation information from the NAT-GW 100. The controller 330 uses the translation information to determine whether or not to apply the rules of the value-added service policy to the address-translated packet received from the NAT-GW 100.

[0060] When the communication device 300 operates as the NAT-GW 100 of method 2, the control unit 330 performs address conversion on the received packet and generates conversion information including information before the address conversion. The transmission unit 310 transmits the conversion information to the VAS-GW 200, and transmits the address-converted packet to the VAS-GW 200 after transmitting the conversion information.

[0061] When the communication device 300 operates as the NAT-GW 100 of method 3, the control unit 330 performs address translation on the received packet and embeds translation information including information before the address translation in the packet after the address translation. The transmission unit 310 transmits the packet with the embedded translation information to the VAS-GW 200.

[0062] (Hardware configuration example) The communication device 300, which corresponds to the NAT-GW 100 or the VAS-GW 200, can be realized, for example, by using a dedicated hardware circuit, or by having a computer execute a program. This computer may be a physical computer or a virtual machine on the cloud.

[0063] That is, the communication device 300 can be realized by executing a program corresponding to the processing performed by the communication device 300 using hardware resources such as a CPU and memory built into a computer. The program can be recorded on a computer-readable recording medium (such as a portable memory) and stored or distributed. The program can also be provided via a network such as the Internet or email.

[0064] Fig. 8 is a diagram showing an example of the hardware configuration of the computer. The computer in Fig. 8 includes a drive device 1000, an auxiliary storage device 1002, a memory device 1003, a CPU 1004, an interface device 1005, a display device 1006, an input device 1007, an output device 1008, and the like, all of which are interconnected via a bus BS.

[0065] The program for realizing the processing on the computer is provided by a recording medium 1001 such as a CD-ROM or a memory card. When the recording medium 1001 storing the program is set in the drive device 1000, the program is installed from the recording medium 1001 to the auxiliary storage device 1002 via the drive device 1000. However, the program does not necessarily have to be installed from the recording medium 1001, but may be downloaded from another computer via a network. The auxiliary storage device 1002 stores the installed program as well as necessary files, data, etc.

[0066] The memory device 1003 reads out and stores the program from the auxiliary storage device 1002 when an instruction to start the program is received. The CPU 1004 realizes functions related to the communication device 300 in accordance with the program stored in the memory device 1003. The interface device 1005 is used as an interface for connecting to a network. The display device 1006 displays a GUI (Graphical User Interface) or the like according to a program. The input device 1007 is composed of a keyboard and mouse, buttons, a touch panel, or the like, and is used to input various operation instructions. The output device 1008 outputs the results of calculations.

[0067] (Effects of the embodiment) The technology according to this embodiment makes it possible to appropriately apply rules relating to value-added services in packet communication, even when a device that performs address translation is provided in front of a device that provides a value-added service.

[0068] (Additional Note) The following supplementary items are further disclosed regarding the above-described embodiment. (Additional note 1) a memory for storing rules of a value-added service policy; at least one processor coupled to the memory; Including, The processor, Inquiring a translation device that performs address translation about translation information including information before the address translation, receiving the conversion information from the conversion device; using the translation information to determine whether or not to apply the rule to the address-translated packet received from the translation device; Communications equipment. (Additional note 2) Memory, at least one processor coupled to the memory; Including, The processor, Performs address translation on the received packet and generates translation information including information before the address translation; Transmitting the conversion information to a value-added service providing device that provides a value-added service using the information before the address conversion, and transmitting the packet after the address conversion to the value-added service providing device after transmitting the conversion information. Communications equipment. (Additional note 3) Memory, at least one processor coupled to the memory; Including, The processor, Performing address translation on the received packet, and embedding translation information including information before the address translation in the packet after the address translation; The packet in which the conversion information is embedded is transmitted to a value-added service providing device that provides a value-added service by using the information before the address conversion. Communications equipment. (Additional note 4) A communication method executed by a computer that functions as a communication device that performs packet communication, the computer comprising a data storage unit that stores rules of a value-added service policy, the method comprising: sending an inquiry to a translation device that performs address translation about translation information including information before the address translation; receiving the conversion information from the conversion device; a step of determining whether or not to apply the rule to an address-translated packet received from the translation device by using the translation information; A communication method comprising: (Additional note 5) A communication method executed by a computer functioning as a communication device that performs packet communication, comprising: performing address translation on the received packet and generating translation information including information before the address translation; transmitting the conversion information to a value-added service providing device that provides a value-added service using information before the address conversion, and transmitting the packet after the address conversion to the value-added service providing device after transmitting the conversion information; A communication method comprising: (Additional note 6) A communication method executed by a computer functioning as a communication device that performs packet communication, comprising: performing address translation on a received packet and embedding translation information including information before the address translation in the packet after the address translation; transmitting the packet in which the conversion information is embedded to a value-added service providing device that provides a value-added service by using information before the address conversion; A communication method comprising: (Additional note 7) A non-transitory storage medium storing a program for causing a computer to execute each process in the communication device according to any one of claims 1 to 3.

[0069] Although the present embodiment has been described above, the present invention is not limited to such a specific embodiment, and various modifications and variations are possible within the scope of the gist of the present invention described in the claims. [Explanation of symbols]

[0070] 1~3 UE 10 GW 100 NAT-GW 20, 200 VAS-GW 30 Servers 300 Communication Equipment 310 Transmitter 320 Receiving unit 330 Control Unit 340 Data Storage Unit 1000 Drive Device 1001 Recording media 1002 Auxiliary storage 1003 Memory device 1004 CPU 1005 Interface device 1006 Display device 1007 Input Device 1008 Output device

Claims

1. A communication device for performing packet communication, a data storage unit for storing rules of a value-added service policy; a transmission unit for inquiring of translation information including information before the address translation from a translation device that performs address translation; a receiving unit that receives the conversion information from the conversion device; a control unit that uses the translation information to determine whether or not to apply the rule to an address-translated packet received from the translation device; A communication device comprising:

2. A communication device for performing packet communication, a control unit that performs address translation on a received packet and generates translation information including a 5-tuple before the address translation that corresponds to the 5-tuple after the address translation; a transmitting unit that transmits the conversion information to a value-added service providing device that provides a value-added service by using information before the address conversion, and transmits the packet after the address conversion to the value-added service providing device after transmitting the conversion information; A communication device comprising:

3. A communication device for performing packet communication, a control unit that performs address translation on a received packet and embeds translation information including information before the address translation in the packet after the address translation; a transmitting unit that transmits the packet in which the conversion information is embedded to a value-added service providing device that provides a value-added service by using information before the address conversion; A communication device comprising:

4. A communication method executed by a communication device that performs packet communication and that includes a data storage unit that stores rules of a value-added service policy, comprising: sending an inquiry to a translation device that performs address translation about translation information including information before the address translation; receiving the conversion information from the conversion device; a step of determining whether or not to apply the rule to an address-translated packet received from the translation device by using the translation information; A communication method comprising:

5. A communication method executed by a communication device that performs packet communication, comprising: performing address translation on the received packet and generating translation information including a 5-tuple before the address translation corresponding to the 5-tuple after the address translation; transmitting the conversion information to a value-added service providing device that provides a value-added service using information before the address conversion, and transmitting the packet after the address conversion to the value-added service providing device after transmitting the conversion information; A communication method comprising:

6. A communication method executed by a communication device that performs packet communication, comprising: performing address translation on a received packet and embedding translation information including information before the address translation in the packet after the address translation; transmitting the packet in which the conversion information is embedded to a value-added service providing device that provides a value-added service by using information before the address conversion; A communication method comprising:

7. A program for causing a computer to function as each unit in the communication device according to any one of claims 1 to 3.

Images