Information processing device

Abstract

To conceal the IP address of a server device to which a client device connects.SOLUTION: An information processing device obtains, from a user device, a query for requesting by the DNS protocol a name resolution of a first device that is accessible via a wide-area network; obtains a first IP address that is an IP address of the first device, based on the query; generates a second IP address that is a dummy IP address corresponding to the first IP address; replaces the first IP address with the second IP address; transmits a response to the query to the user device, with the second IP address as a result of the name resolution; and transfers, when receiving a connection request with the second IP address as a destination from the user device, the connection request to the wide-area network with the destination replaced from the second IP address to the first IP address.SELECTED DRAWING: Figure 6

Description

[Technical Field]

[0001] The present disclosure relates to mobile communications. [Background technology]

[0002] A method for connecting private networks via the Internet and communicating with each other is well known. In this regard, for example, Patent Document 1 discloses a system for performing IP address conversion in a connection between VPN segments. [Prior art documents] [Patent documents]

[0003] [Patent Document 1] Japanese Patent Application Laid-Open No. 2003-087336 Summary of the Invention [Problem to be solved by the invention]

[0004] The present disclosure aims to conceal the IP address of a server device to which a client device connects. [Means for solving the problem]

[0005] One aspect of an embodiment of the present disclosure is An information processing device comprising a control unit configured to perform the following operations: obtain from a user device a query requesting name resolution of a first device accessible via a wide area network using a DNS (Domain Name System) protocol; obtain a first IP address that is the IP address of the first device based on the query; generate a second IP address that is a dummy IP address corresponding to the first IP address; replace the first IP address with the second IP address, and send a response to the query to the user device using the second IP address as a result of the name resolution; and, when a connection request addressed to the second IP address is received from the user device, replace the destination from the second IP address with the first IP address and then forward the connection request to the wide area network.

[0006] Other aspects include a method executed by the above-described device, a program for causing a computer to execute the method, or a computer-readable storage medium non-transitoryly storing the program. [Effects of the Invention]

[0007] According to the present disclosure, it is possible to conceal the IP address of a server device to which a client device connects. [Brief explanation of the drawings]

[0008] [Figure 1] 1 is a schematic diagram of a communication system according to a first embodiment. [Figure 2] FIG. 2 is a diagram showing components of an in-vehicle device. [Figure 3] A diagram showing the components of a resolver DNS. [Figure 4] An example of a translation table generated by a resolver DNS. [Figure 5] FIG. 1 is a diagram showing components of a conversion device. [Figure 6] A sequence diagram of data exchanged between each component. [Figure 7]10 is a flowchart of a process executed by the conversion device. DETAILED DESCRIPTION OF THE INVENTION

[0009] In recent years, the number of vehicles that can connect to wireless networks has increased as automobiles have become more connected. By communicating with a server device, it becomes possible to provide vehicles with information that contributes to road safety and the latest traffic information.

[0010] In such a system, attacks via the network can be a problem. For example, if an attacker learns the IP address (in this specification, this means the IPv4 address and IPv6 address) of the server device that communicates with the vehicle, they may launch an attack using a fake vehicle or a denial-of-service attack. However, packet communication using IP (Internet Protocol) usually sends Because the packet contains the source IP address and destination IP address, it is difficult to conceal the IP address of the communication destination device. In particular, since terminals installed in automobiles often use mobile communication networks, there is a risk that the packet can be read by terminals on the same network and the communication destination device can be identified. The information processing device according to the present disclosure solves such a problem.

[0011] An information processing device according to a first aspect of the present disclosure includes a control unit configured to: obtain from a user device a query requesting name resolution of a first device accessible via a wide area network using a DNS protocol; obtain a first IP address that is the IP address of the first device based on the query; generate a second IP address that is a dummy IP address corresponding to the first IP address; replace the first IP address with the second IP address, and send a response to the query to the user device using the second IP address as a result of the name resolution; and, when a connection request addressed to the second IP address is received from the user device, replace the destination from the second IP address with the first IP address and then forward the connection request to the wide area network.

[0012] The information processing device according to the present disclosure has functions as a device (resolver) that performs name resolution on a network and a device that performs IP address translation. The information processing device may be located on the same network as a user device, or may be located in a portion that aggregates multiple networks. The information processing device performs name resolution in response to a request from a user device, and also performs IP address translation of packets sent from the user device between the information processing device and the wide area network.

[0013] A control unit included in the information processing device receives a query (typically a DNS query) for name resolution of a first device from a user device, and obtains an IP address (first IP address) of the first device based on the query. The first IP address can be obtained by recursively querying other DNS servers that perform name resolution. In other words, the control unit provides a function as a name resolver.

[0014] The control unit also generates a second IP address, which is a dummy IP address corresponding to the first IP address. The second IP address is an IP address used to conceal the first IP address. The second IP address may be a fictitious IP address. The control unit transmits the second IP address to the user device in response to the query instead of the first IP address, so that the user device attempting to communicate with the first device generates a connection request addressed to the second IP address.

[0015] On the other hand, when such a connection request is sent from the user device, the control unit replaces the destination IP address from the second IP address with the first IP address and transfers the request to the wide area network. With this configuration, within the network to which the user device is connected, the IP address of the first device is treated as the second IP address, not the first IP address. In other words, even if packets transmitted between the user device and the first device are intercepted within the network, the true IP address of the first device cannot be determined. This reduces the risk of attacks.

[0016] In addition, when the control unit receives a response message to a connection request from the first device, it may replace the sender included in the response message from the first IP address to the second IP address and forward the response message to the user device. This makes it possible to conceal the first IP address contained in the return packet.

[0017] Furthermore, the control unit may replace the first IP address with the second IP address using different rules for each of the plurality of user devices. If the control unit generates the second IP address using the same rule, the combination of the first IP address and the second IP address will be fixed. To avoid this, the second IP address may be generated using a different rule for each user device. With this configuration, the second IP address will be different for each user device, which can confuse attackers.

[0018] Substituting the first IP address with the second IP address includes substituting the first IP address with the second IP address during the name resolution.

[0019] The control unit may also associate the first IP address, the second IP address, and the user device identification information and register them in a conversion table. By using the conversion table, IP address conversion can be easily performed. In addition, when the control unit receives a connection request from a user device, it may compare the identification information (e.g., source IP address) and destination IP address included in the connection request with a conversion table, and if a matching record is found, it may obtain the first IP address included in the record and replace the destination with the obtained first IP address. The control unit may also reject a connection request addressed to a second IP address registered in the conversion table and sent from a device having identification information different from the identification information associated with the registered second IP address. If a connection request is sent to the first device from a device that is not registered in the conversion table (i.e., if a replay attack is performed by copying the second IP address), it is possible to reject the connection.

[0020] Specific embodiments of the present disclosure will be described below with reference to the accompanying drawings. Unless otherwise specified, the hardware configuration, module configuration, functional configuration, etc. described in each embodiment are not intended to limit the technical scope of the disclosure to those configurations.

[0021] (First embodiment) An overview of a communication system according to a first embodiment will be described with reference to Fig. 1. The communication system according to this embodiment is a system in which a vehicle 10 equipped with an on-vehicle device 100 communicates with a server device 500 via a wide area network (the Internet). The system may include a plurality of vehicles 10 (on-vehicle devices 100).

[0022] The vehicle 10 is a connected car with a wireless communication function. The vehicle 10 can connect to a predetermined network and communicate with any device via the Internet.

[0023] The server device 500 is a device that collects data from the in-vehicle device 100 and provides information to the in-vehicle device 100 . The network to which the vehicle 10 is connected and the network in which the server device 500 is located are connected to each other via the Internet. Hereinafter, the network to which the vehicle 10 is connected will be referred to as a vehicle-side network, and the network in which the server device 500 is located will be referred to as a server-side network.

[0024] The vehicle-side network includes an access point that wirelessly communicates with the in-vehicle device 100, a resolver DNS 200 that performs name resolution on the network, and a conversion device 300 that performs IP address conversion between the Internet and the vehicle-side network. The access point is a device that provides wireless access to the vehicle-side network. In addition to the server device 500, the server-side network is also provided with an authoritative DNS 400, which is a DNS server for performing name resolution for the server device 500. The authoritative DNS 400 may be provided in the server-side network or in a different network.

[0025] The vehicle-side network and the server-side network are connected to each other via a wide area network (Internet). The vehicle-side network may be a wireless communication network using Wi-Fi (registered trademark) or a mobile communication network using a cellular communication system.

[0026] Each element that makes up the system will be explained in detail. The vehicle 10 is a connected car that has a function of communicating with an external network. The vehicle 10 is equipped with an in-vehicle device 100.

[0027] The in-vehicle device 100 is a computer for collecting and providing information. In this embodiment, the in-vehicle device 100 has a function of collecting information related to the traveling of the vehicle 10 and transmitting the information to the server device 500, and a function of providing information to the occupants of the vehicle 10 based on the information received from the server device 500. The in-vehicle device 100 may be a device that provides information to a passenger in the vehicle 10 (for example, a car navigation device), or may be an electronic control unit (ECU) included in the vehicle 10. The in-vehicle device 100 may also be a data communication module (DCM) having a communication function.

[0028] The in-vehicle device 100 can be configured as a computer having a processor such as a CPU or GPU, a main memory such as a RAM or ROM, and an auxiliary memory such as an EPROM, a hard disk drive, or removable media. The auxiliary memory stores an operating system (OS), various programs, various tables, etc., and by executing the programs stored therein, various functions that match predetermined purposes, as described below, can be realized. However, some or all of the functions may be realized by hardware circuits such as ASICs or FPGAs.

[0029] FIG. 2 is a diagram showing the system configuration of the in-vehicle device 100. As shown in FIG. The in-vehicle device 100 includes a control unit 101 , a storage unit 102 , a communication unit 103 , and an input / output unit 104 .

[0030] The control unit 101 is a calculation unit that executes a predetermined program to realize various functions of the in-vehicle device 100. The control unit 101 may be realized by, for example, a CPU or the like. The control unit 101 is configured to have a function providing unit 1011 as a functional module. The functional module may be realized by executing a stored program by a CPU.

[0031] The function providing unit 1011 executes various functions provided by the in-vehicle device 100. The functions provided by the in-vehicle device 100 include, for example, the following. Navigation function This is a function that provides route navigation based on map data provided by the server device 500. ·Traffic information provision function This is a function that provides traffic information based on information provided by the server device 500. Data transmission function This is a function of collecting information (speed information, position information, etc.) relating to the travel of the vehicle 10 and transmitting it to the server device 500. These functions can be provided, for example, via the input / output unit 104 (touch panel). In order to provide these functions, the in-vehicle device 100 may also have a GPS antenna, a GPS module, and the like.

[0032] The function providing unit 1011 is configured to be able to execute these functions by communicating with the server device 500. The function providing unit 1011 stores the URL of the server device 500, which is the communication destination, and uses the URL to make an inquiry (DNS query) to the resolver DNS 200. The function providing unit 1011 also communicates with the server device 500 using the IP address obtained as a result. Communication is initiated when the in-vehicle device 100 transmits a connection request to the server device 500, and the server device 500 transmits a response message in response to this.

[0033] The storage unit 102 is a memory device including a main storage device and an auxiliary storage device. The auxiliary storage device stores an operating system (OS), various programs, various tables, etc., and by loading the programs stored therein into the main storage device and executing them, various functions that meet predetermined purposes, as will be described later, can be realized. The main memory may include RAM (Random Access Memory) and ROM (Read Only Memory). The auxiliary memory may include EPROM (Erasable Programmable ROM) and hard disk. It may also include a disk drive (HDD, Hard Disk Drive). may include removable media, i.e., portable recording media.

[0034] The communication unit 103 is a wireless communication interface for connecting the in-vehicle device 100 to a network. The communication unit 103 is configured to be able to communicate with a network (vehicle-side network) using a communication standard such as mobile communication, wireless LAN, or Bluetooth (registered trademark).

[0035] The input / output unit 104 is a means for accepting input operations performed by the device user and presenting information. In this embodiment, it is made up of a single touch panel display. That is, it is made up of a liquid crystal display and its control means, and a touch panel and its control means.

[0036] Next, a description will be given of the resolver DNS 200. The resolver DNS 200 is a device that performs name resolution for the server device 500 in response to a DNS query received from the in-vehicle device 100.

[0037] The resolver DNS200 uses processors such as CPUs and GPUs, main memory devices such as RAM and ROM, and auxiliary memory devices such as EPROMs, hard disk drives, and removable media. The resolver DNS 200 may be configured as a single computer, or may be configured as a plurality of computers that cooperate with each other.

[0038] 3 is a diagram showing the system configuration of the resolver DNS 200. The resolver DNS 200 includes a control unit 201, a storage unit 202, and a communication unit 203.

[0039] The control unit 201 is an arithmetic unit that controls the resolver DNS 200. The control unit 201 can be realized by an arithmetic processing unit such as a CPU. The control unit 201 is configured to have two functional modules: an address acquisition unit 2011 and an address concealment unit 2012. Each functional module may be realized by causing a CPU to execute a program stored in an auxiliary storage unit.

[0040] The address acquisition unit 2011 recursively queries higher-level DNS servers based on the DNS query received from the in-vehicle device 100, and acquires the IP address of the server device 500. The IP address of the server device 500 is provided by the authoritative DNS 400, but the address acquisition unit 2011 may communicate with multiple DNS servers in the process.

[0041] The address concealment unit 2012 rewrites the IP address of the server device 500 provided by the authoritative DNS 400 (hereinafter referred to as the first IP address) to a dummy IP address (hereinafter referred to as the second IP address). The IP address can be rewritten based on any conversion rule. The resolver DNS 200 may store a conversion table such as that shown in Fig. 4, and rewrite the IP address based on the conversion table. In the example of Figure 4, the conversion source field is a field in which a first IP address is stored. The conversion destination field is a field in which a second IP address is stored. The target device field is a field in which the IP address of the in-vehicle device 100 is stored. In the example of Figure 4, the first IP address is replaced with the second IP address using a different conversion rule for each in-vehicle device 100. The second IP address may be selected from a pre-generated list (for example, in order, randomly, etc.), or may be dynamically generated by any method such as function calculation or random generation.

[0042] The address concealment unit 2012 transmits the rewritten IP address to the in-vehicle device 100 as a response to the DNS query (DNS reply). In parallel with this, the address concealment unit 2012 sets the conversion rule used for the conversion in the conversion device 300. This makes it possible to appropriately rewrite the connection request generated by the in-vehicle device 100 before transferring it to the Internet.

[0043] The storage unit 202 is configured to include a main storage device and an auxiliary storage device. The main storage device is a memory in which the programs executed by the control unit 201 and the data used by the control programs are expanded. The auxiliary storage device is a device in which the programs executed by the control unit 201 and the data used by the control programs are stored.

[0044] The communication unit 203 is a communication interface for connecting the resolver DNS 200 to a network. The communication unit 203 includes, for example, a network interface board and a wireless communication circuit for wireless communication.

[0045] Next, the conversion device 300 will be described. The conversion device 300 converts the DNS resolver 200 Therefore, the in-vehicle device 100 is a device that rewrites the destination IP address and source IP address contained in the IP header of a packet that is sent or received by the in-vehicle device 100 based on the set conversion rule. Like the resolver DNS 200, the conversion device 300 can be configured as a computer having a processor such as a CPU or GPU, a main memory such as a RAM or ROM, and an auxiliary memory such as an EPROM, a hard disk drive, or removable media.

[0046] 5 is a diagram showing the system configuration of the conversion device 300. The conversion device 300 includes a control unit 301, a storage unit 302, and a communication unit 303.

[0047] The control unit 301 is an arithmetic unit that controls the conversion device 300. The control unit 301 can be realized by an arithmetic processing unit such as a CPU. The control unit 301 is configured to have, as a functional module, an address conversion unit 3011. This functional module may be realized by causing a CPU to execute a program stored in an auxiliary storage unit.

[0048] The address conversion unit 3011 rewrites the destination IP address included in the connection request sent from the on-board device 100 based on the conversion rule set by the resolver DNS 200. Specifically, when a connection request addressed to the second IP address is sent from the on-board device 100, the address conversion unit 3011 rewrites the IP address to the first IP address and transfers it to the Internet. IP address rewriting is done using the NAT (Network Address Translation) function. It can be realized.

[0049] Furthermore, when the address conversion unit 3011 receives a packet transmitted from the server device 500, it rewrites the source IP address included in the packet. Specifically, when a packet having a first IP address as its source is transmitted from the server device 500, it rewrites the packet to the second IP address and transfers it to the in-vehicle device 100.

[0050] By performing such an operation by address conversion unit 3011, all IP addresses of server device 500 in the vehicle-side network are converted from the first IP addresses to the second IP addresses.

[0051] The storage unit 302 and the communication unit 303 are similar to the storage unit 202 and the communication unit 203, and therefore a description thereof will be omitted.

[0052] 2, 3, and 5 are merely examples, and all or part of the illustrated functions may be performed using dedicated circuits. Furthermore, programs may be stored or executed using a combination of main and auxiliary storage devices other than those illustrated.

[0053] Next, the flow of communication when the in-vehicle device 100 connects to the server device 500 will be described in more detail.

[0054] Fig. 6 is a sequence diagram showing the flow of data when the on-board device 100 connects to the server device 500. Note that in the example of Fig. 6, a gateway (access point) in the vehicle-side network is not shown.

[0055] First, the in-vehicle device 100 generates a DNS query to acquire the IP address of the server device 500. The DNS query is sent to the access point to which the in-vehicle device 100 is connected, and is transferred to the resolver DNS 200.

[0056] The resolver DNS 200 recursively queries the higher-level DNS servers and acquires the IP address (first IP address) of the server device 500. The IP address of the server device 500 is ultimately provided by the authoritative DNS 400.

[0057] Next, the resolver DNS 200 generates a second IP address, which is a dummy IP address corresponding to the obtained first IP address. Also, the resolver DNS 200 generates a conversion table that associates the first IP address, the second IP address, and the IP address of the in-vehicle device 100 with each other, and transmits this to the conversion device 300. As a result, the conversion rule generated by the resolver DNS 200 is set in the conversion device 300. The conversion table associates the first IP address, the second IP address, and the IP address of the in-vehicle device 100 with one another. Furthermore, the resolver DNS 200 returns the second IP address to the in-vehicle device 100 as a response (DNS reply) to the DNS query. If the first IP address is provided in both IPv4 and IPv6, it is preferable to generate the second IP address in both IPv4 and IPv6. In this case, both the A record and the AAAA record of the DNS reply are subject to rewriting.

[0058] The in-vehicle device 100 generates a connection request addressed to the second IP address and transmits the connection request to a gateway (access point) in the vehicle-side network. The connection request is forwarded to the conversion device 300. The destination IP address included in the connection request is a dummy address.

[0059] When the conversion device 300 receives a connection request that satisfies the following conditions, it rewrites the destination IP address according to the conversion table. (1) The IP address of the device (the in-vehicle device 100) that sent the connection request matches the IP address of the target device registered in the conversion table. (2) The destination address in the IP header matches the destination IP address registered in the conversion table. As a result, the destination IP address included in the IP header is rewritten from the second IP address to the first IP address. The connection request with the rewritten destination IP address is transferred to the Internet and reaches server device 500.

[0060] The server device 500 generates a packet based on the connection request and returns it to the conversion device 300 . When the conversion device 300 receives a packet that satisfies the following conditions, it rewrites the source IP address according to the conversion table. (1) The destination IP address matches the IP address of the target device registered in the conversion table. (2) The source IP address included in the IP header matches the source address registered in the translation table. As a result, the source IP address included in the IP header is rewritten from the first IP address to the second IP address. The packet with the rewritten source IP address reaches the in-vehicle device 100.

[0061] In the above description, an example has been given in which the in-vehicle device 100 transmits a connection request to the server device 500, and the server device 500 returns a packet in response to this, but the conversion device 300 also performs similar processing in communication after the connection between the in-vehicle device 100 and the server device 500 is completed. In the following description, data transmitted from the in-vehicle device 100 to the server device 500 will be referred to as a request, and a reply thereto will be referred to as a response.

[0062] 7 is a flowchart of the process executed by the conversion device 300. The process shown in the figure is started when the conversion device 300 receives a request from the in-vehicle device 100 or a response thereto from the server device 500.

[0063] First, in step S11, it is determined whether the device that sent the request is legitimate. In this step, the determination is affirmative if the IP address of the in-vehicle device 100 included in the request or response exists in the target device field of the conversion table. In step S12, it is determined whether the IP address to be converted is registered in the conversion table. If a request is received from the in-vehicle device 100 and the destination included in the request is present in the conversion table (conversion destination field), this step is determined as positive. If a response is received from the server device 500 and the sender included in the response is present in the conversion table (conversion source field), this step is determined as positive.

[0064] In step S13, it is determined whether the type of packet is a request or a response. If the type of packet is a request, the process proceeds to step S14, where the translation device 300 rewrites the destination included in the IP header from the second IP address to the first IP address. If the packet is a response, the process proceeds to step S15, where the translation device 300 rewrites the source included in the IP header from the first IP address to the second IP address.

[0065] As described above, in the communication system according to the first embodiment, the resolver DNS 200 generates a dummy IP address and returns the dummy IP address to the in-vehicle device 100 as the IP address of the server device 500. The resolver DNS 200 also generates a translation table including the dummy IP address and shares it with the translation device 300. The translation device 300 rewrites the destination and source of a packet based on the translation table. With this configuration, all IP addresses of the server device 500 within the vehicle-side network are replaced from the first IP addresses to the second IP addresses. That is, even if packets are intercepted within the vehicle-side network, it becomes impossible to identify the communication destination.

[0066] Furthermore, conversion device 300 refuses to relay packets sent from devices that are not registered in the conversion table. Devices that do not access server device 500 through legitimate procedures are not registered in the conversion table, so even if an attacker attempts a replay attack on the server device, this can be prevented.

[0067] (Modification of the first embodiment) In the first embodiment, the resolver DNS 200 and the translation device 300 are illustrated as separate devices, but the resolver DNS 200 and the translation device 300 may be the same device. Furthermore, the resolver DNS 200, the translation device 300, and the access point may be the same device.

[0068] Furthermore, the conversion table transmitted to the conversion device 300 may be deleted at a predetermined timing. For example, the conversion device 300 may delete the conversion table when all communications initiated by the in-vehicle device 100 are completed or when a predetermined period of time has elapsed since the first request. In the first embodiment, the resolver DNS 200 generates a dummy IP address (second IP address) after acquiring the IP address of the server device 500, but this is not limiting. That is, the second IP address may be generated at any timing between when the resolver DNS 200 receives a DNS query and when the resolver DNS 200 returns a DNS reply. The second IP address may also be selected from a pre-generated list (for example, in order, randomly, etc.), or may be dynamically generated using any method, such as function calculation or random generation. In addition, in the first embodiment, the IP address of the in-vehicle device 100 is registered in the conversion table, but identification information other than the IP address (for example, a MAC address, etc.) that can identify the in-vehicle device 100 may also be registered in the conversion table.

[0069] (Other variations) The above-described embodiment is merely an example, and the present disclosure can be implemented by appropriately modifying it within the scope that does not deviate from the gist thereof. For example, the processes and means described in this disclosure can be freely combined and implemented as long as no technical contradiction occurs.

[0070] Furthermore, a process described as being performed by one device may be shared and executed by multiple devices. Alternatively, a process described as being performed by different devices may be executed by a single device. In a computer system, the hardware configuration (server configuration) by which each function is realized can be flexibly changed.

[0071] The present disclosure can also be realized by providing a computer program implementing the functions described in the above embodiments to a computer, and having one or more processors in the computer read and execute the program. Such a computer program may be provided to the computer via a non-transitory computer-readable storage medium connectable to the computer's system bus or via a network. Non-transitory computer-readable storage media include, for example, any type of disk, such as a magnetic disk (e.g., a floppy disk, a hard disk drive (HDD), etc.), an optical disk (e.g., a CD-ROM, a DVD disk, a Blu-ray disk), a read-only memory (ROM), a random access memory (RAM), an EPROM, an EEPROM, a magnetic card, a flash memory, an optical card, or any type of medium suitable for storing electronic instructions. [Explanation of symbols]

[0072] 10. Vehicle 100...In-vehicle equipment 200...Resolver DNS 300...Conversion device 400...Authoritative DNS 500 Server device

Claims

1. obtaining a query from a user device requesting name resolution of a first device accessible via a wide area network via a DNS protocol; obtaining a first IP address based on the query, the first IP address being an IP address of the first device; generating a second IP address that is a dummy IP address corresponding to the first IP address; replacing the first IP address with the second IP address and transmitting a response to the query to the user device using the second IP address as a result of the name resolution; When a connection request addressed to the second IP address is received from the user device, the destination is replaced from the second IP address to the first IP address, and the connection request is then forwarded to the wide area network; a control unit configured to perform the control unit replaces the first IP address with the second IP address using a different rule for each of the plurality of user devices; Information processing device.

2. the control unit is further configured, when receiving a response message to the connection request from the first device, to replace a sender included in the response message from the first IP address with the second IP address, and then forward the response message to the user device. The information processing device according to claim 1 .

3. the control unit registers the first IP address, the second IP address, and the identification information of the user device in a translation table in association with each other; performing the substitution for each of the user devices using the conversion table; 3. The information processing device according to claim 1.

4. The control unit converts the second IP address from the user device registered in the conversion table. performing said substitution when a connection request destined for the address is received. The information processing device according to claim 3 .

5. the control unit performs the substitution when a connection request addressed to the second IP address is received from the user device registered in the conversion table, and denies the connection when a connection request addressed to the second IP address is received from a device not registered in the conversion table. The information processing device according to claim 3 .

Images