Sorting device, sorting method, and sorting program

Abstract

This allows network users to easily connect to different networks, such as the internet or a VPN. [Solution] In a distribution device 10 located within a network, the destination network 14a of the storage unit 14 stores either the Internet or a VPN destination network corresponding to the source address of a network user. The acquisition unit 15a acquires communication packets sent by network users. The distribution unit 15b distributes the acquired communication packets to the destination networks stored in the destination network 14a of the storage unit 14, corresponding to the source address of the communication packets.

Description

Technical Field

[0001] The present invention relates to a distribution device, a distribution method, and a distribution program.

Background Art

[0002] Conventionally, the network to which a user connects is determined by the settings for each terminal, whether it is a wired network or a mobile network. For example, in the case of a mobile network, it is uniquely determined by the combination of a SIM card, an APN (Access Point Name), and an ID. Therefore, in order for a user of a mobile network to connect to different networks such as the Internet / VPN (Virtual Private Network), it is necessary to change the settings by replacing the SIM card of the terminal at hand or changing either the APN or the ID (Identification).

[0003] Also, a technique has been disclosed in which a dedicated adapter is installed at a mobile user base so that a user can connect to different networks such as the Internet / VPN (see Non-Patent Documents 1 and 2).

Prior Art Documents

Non-Patent Documents

[0004]

Non-Patent Document 1

Non-Patent Document 2

[0005] However, conventional technologies have a problem in that it is not easy for network users to connect to different networks such as the internet or VPNs. For example, connecting to a different network with conventional technologies requires operations at the user terminal or user site. Also, if the user terminal moves away from the dedicated adapter at the user site, it becomes impossible to connect to the network. Therefore, it is difficult for users to seamlessly connect to different networks with conventional technologies.

[0006] The present invention has been made in view of the above, and aims to enable network users to easily connect to different networks such as the Internet or VPN. [Means for solving the problem]

[0007] To solve the above-mentioned problems and achieve the objective, the distribution device according to the present invention is a distribution device located in a network, and is characterized by comprising: a storage unit that stores either the Internet or a VPN destination network corresponding to the source address of a user of the network; an acquisition unit that acquires communication packets sent by a user of the network; and a distribution unit that distributes the acquired communication packets to the destination networks stored in the storage unit corresponding to the source address of the communication packets. [Effects of the Invention]

[0008] According to the present invention, network users can easily connect to different networks such as the Internet or a VPN. [Brief explanation of the drawing]

[0009] [Figure 1] Figure 1 is a diagram illustrating the overview of the distribution device. [Figure 2] Figure 2 is a diagram illustrating the overview of the distribution device. [Figure 3] Figure 3 is a diagram illustrating the overview of the distribution device. [Figure 4] Figure 4 is a schematic diagram illustrating the general configuration of the distribution device. [Figure 5] Figure 5 is a diagram illustrating the data structure of the connected network. [Figure 6] Figure 6 is a diagram illustrating the processing of the distribution unit. [Figure 7] Figure 7 is a diagram illustrating the processing of the distribution unit. [Figure 8] Figure 8 is a diagram illustrating the processing of the distribution unit. [Figure 9] Figure 9 is a diagram illustrating the processing of the distribution unit. [Figure 10] Figure 10 is a sequence diagram illustrating an information processing procedure. [Figure 11] Figure 11 is an example of a computer that executes an information processing program. [Modes for carrying out the invention]

[0010] Hereinafter, one embodiment of the present invention will be described in detail with reference to the drawings. However, the present invention is not limited to this embodiment. Furthermore, in the drawings, the same parts are denoted by the same reference numerals.

[0011] [Overview of the distribution device] Figures 1 to 3 are diagrams for explaining the outline of the distribution device. As shown in Figure 1, the distribution device 10 of the present embodiment connects the communication transmitted by the user to either a different network such as the Internet or a VPN according to the contract of the user of the network. In Figure 1, as an example of the network with which the user contracts, a mobile network is illustrated, and as an example of a different network, it is illustrated that user communication packets are distributed to either the Internet or a VPN.

[0012] This distribution device 10 is arranged within the network and does not require operation at the user terminal or user base of the network. Also, as illustrated in Figure 1, it is also possible for an enterprise information system administrator or the like to change the setting of the destination network for the distribution device 10 via the GUI and API of the portal site for their own contract users. Thus, according to the distribution device 10, it becomes possible for the user to connect to a different network such as the Internet / VPN without requiring operation at the user terminal or user base of the network.

[0013] Specifically, as illustrated in Figure 2, the distribution device 10 connects the communication of the user to either the Internet or a VPN according to the contract pattern of the user of the network. Note that in Figure 2, a mobile network is illustrated as an example of the network with which the user contracts, but the same processing applies to a wired network.

[0014] In pattern (1), an example is illustrated where the contract of a user (user ID: Zaaaa) of a mobile network is only for Internet communication, and the distribution device 10 connects all the communication (source address: aaaa) transmitted by this user to the Internet.

[0015] Pattern (2) exemplifies the case where a user (user ID: Zcccc) of a mobile network subscribes to both Internet communication and VPN communication. The distribution device 10 distributes the connection destination based on the destination address of the communication (source address: cccc) sent by the user. That is, when the destination address is a global address, the distribution device 10 connects to the Internet, and when the destination address is a private address, it connects to the VPN.

[0016] Pattern (3) exemplifies the case where a user (user ID: Zbbbb) of a mobile network subscribes only to VPN communication. The distribution device 10 connects all the communications (source address: bbbb) sent by this user to the VPN.

[0017] Pattern (4) exemplifies the case where a user (user ID: Zdddd) of a mobile network subscribes to both VPN communication and Internet communication to a specific destination (hereinafter also referred to as specific communication breakout). When the destination address of the communication (source address: dddd) sent by this user is a specific address designated for the user such as a Web conference, the distribution device 10 connects to the Internet, and when the destination address is other than the designated specific address, it connects to the VPN.

[0018] Note that the unit of the user's contract may be a company or a department of a company, etc. In this case, an information system administrator of the company can make settings according to the above contracts for each source address block for the company's users.

[0019] Also, the processing target of the distribution device 10 is not limited to the communication packets sent by the contract users of the mobile network. As illustrated in FIG. 3, the processing of the distribution device 10 of the present embodiment is also applicable to the communication packets sent by the contract users of the wired network. In the example shown in FIG. 1, the access line of the contract user is wireless, whereas in the example shown in FIG. 3, the only difference is that the access line of the contract user is a wired line.

[0020] [Configuration of the distribution device] Figure 4 is a schematic diagram illustrating the general configuration of the distribution device. As illustrated in Figure 4, the distribution device 10 of this embodiment is located within a network. The distribution device 10 is implemented using a general-purpose computer such as a personal computer and includes an input unit 11, an output unit 12, a communication control unit 13, a storage unit 14, and a control unit 15.

[0021] The input unit 11 is implemented using an input device such as a keyboard or mouse, and in response to input operations by the operator, it inputs various instruction information, such as processing start, to the control unit 15. The output unit 12 is implemented using a display device such as a liquid crystal display, a printing device such as a printer, etc.

[0022] The communication control unit 13 is implemented using a NIC (Network Interface Card) or the like, and controls communication between the control unit 15 and external devices via the network. For example, the communication control unit 13 controls communication between the control unit 15 and the prediction device 20, or a server that manages information on corporate services related to communication used for information processing, which will be described later.

[0023] The memory unit 14 is implemented using semiconductor memory elements such as RAM (Random Access Memory) or flash memory, or storage devices such as hard disks or optical discs. The memory unit 14 pre-stores processing programs for operating the distribution device 10, as well as data used during the execution of the processing programs, or temporarily stores them each time processing is performed. The memory unit 14 may also be configured to communicate with the control unit 15 via the communication control unit 13.

[0024] In this embodiment, the storage unit 14 stores the destination network 14a used in the processing described later. The destination network 14a stores either the Internet or a VPN destination network corresponding to the source address of the network user.

[0025] Here, Figure 5 illustrates the data structure of the destination network. As illustrated in Figure 5, the destination network 14a stores information specifying the network to connect to for each source address of the network's contracted user. As described above, the contract specifying the destination network is not limited to each source address; for example, it can be done on a company or company department basis. In that case, the destination network may be specified for each block of source addresses.

[0026] In the example shown in Figure 5, for instance, block AA1 (range AA1) of the source addresses for the general affairs department of company A is configured to connect only to the internet. Furthermore, block AA2 (range AA2) of the source addresses for the general affairs department of company A is configured to either connect to the internet or to a VPN.

[0027] Furthermore, for company C, a specific communication breakout destination address is configured for the source address block CCC. In other words, for the source address block CCC, it is configured to connect to the internet only when a specific destination is specified, and for communications with any other destination, it is configured to connect to the VPN. Figure 4 shows that communications with IP address C and FQDN (Fully Qualified Domain Name) C as the destination connect to the internet, and communications with any other destination connect to the VPN.

[0028] Furthermore, the destination network 14a can also be configured by the company's IT department or other personnel for their contracted users via the portal site's GUI and API.

[0029] The control unit 15 is implemented using a CPU (Central Processing Unit), NP (Network Processor), FPGA (Field Programmable Gate Array), etc., and executes a processing program stored in memory. As a result, the control unit 15 functions as an acquisition unit 15a and a distribution unit 15b, as illustrated in Figure 4. These functional units may be implemented on different hardware. Furthermore, a single functional unit may be implemented across multiple hardware components. For example, as will be described later, the distribution unit 15b may be implemented across a distribution router 15c and a communication control device 15d. The control unit 15 may also include other functional units.

[0030] The acquisition unit 15a acquires communication packets transmitted by network users. Specifically, the acquisition unit 15a acquires communication packets transmitted by network contract users. The network accessed by the transmitting user may be either a wired network or a mobile network.

[0031] The distribution unit 15b distributes the acquired communication packets to the destination networks stored in the destination network 14a corresponding to the source address of the communication packets. Specifically, the distribution unit 15b uses the source address of the acquired communication packets to refer to the destination network 14a and identifies the destination network corresponding to that source address. Then, the distribution unit 15b connects to the identified network and transmits the communication packets.

[0032] Here, Figures 6 to 9 are diagrams illustrating the processing of the distribution unit. Specifically, as illustrated in Figure 6, the distribution unit 15b is composed of a distribution router 15c and a communication control device 15d.

[0033] Figure 6 illustrates the specific processing of pattern (1) shown in Figure 2. In this case, the mobile network (mobile network) or wired network user's contract is for internet communication only, and the distribution device 10 connects all communications originating from this user to the internet.

[0034] Specifically, the destination network 14a is configured to connect only to the internet for source addresses. The distribution router 15c has a distribution function (contract) that distributes communication packets according to the user's contract, and a distribution function (VPN) that forwards them to the VPN. The distribution function (contract) of the distribution router 15c refers to the destination network 14a using the source address of the acquired communication packet and forwards it to the communication control device 15d which is connected to the internet.

[0035] The communication control device 15d has a CGN (Carrier Grade Network address translator) that performs mutual conversion between global IP addresses and private IP addresses, and a specific communication breakout function described later. The forwarded communication packets are connected to the internet via the CGN.

[0036] Figure 7 illustrates the specific processing of pattern (2) shown in Figure 2. In this case, the mobile network or wired network user's contract is configured to connect to either the Internet or VPN. In this case, the distribution unit 15b connects the acquired communication packet to the VPN if the destination address is a private address, and connects the communication packet to the Internet if the destination address is a global address.

[0037] Specifically, the destination network 14a is configured to connect to either the Internet or a VPN based on the source address. The distribution function (contract) of the distribution router 15c refers to the destination network 14a using the source address of the acquired communication packet, and if the destination address is a private address, it connects the communication packet to the VPN via the distribution function (VPN). On the other hand, if the destination address is a global address, the distribution function (contract) of the distribution router 15c connects the communication packet to the Internet by forwarding it to the CGN of the communication control device 15d.

[0038] Figure 8 illustrates the specific processing of pattern (3) shown in Figure 2. In this case, the mobile network or wired network user's contract is for VPN communication only, and the distribution device 10 connects all communications originating from this user to the VPN.

[0039] Specifically, the destination network 14a is configured to connect only to the VPN for source addresses. The distribution function (contract) of the distribution router 15c refers to the destination network 14a using the source address of the acquired communication packet and connects the communication packet to the VPN via the distribution function (VPN).

[0040] Figure 9 illustrates the specific processing of pattern (4) shown in Figure 2. In this case, the destination network 14a connected to the storage unit 14 also stores a specific destination address corresponding to the source address, as described above. The distribution unit 15b then connects communication packets with a specific destination address to that destination address on the Internet, and connects communication packets with destination addresses other than the specific destination address to the VPN.

[0041] Specifically, the distribution function (contract) of the distribution router 15c refers to the destination network 14a and forwards the acquired communication packets to the communication control device 15d. The specific communication breakout function of the communication control device 15d connects to the internet via the CGN and forwards the communication packet to the specified address if the destination address of the communication packet is a specified address. On the other hand, if the destination address of the communication packet is not a specified address, the specific communication breakout function of the communication control device 15d connects the communication packet to the VPN via the distribution function (VPN) of the distribution router 15c.

[0042] [Distribution Processing Procedure] Next, an example of the sorting process by the sorting device 10 according to this embodiment will be described with reference to Figure 10. Figure 10 is a flowchart illustrating the sorting process procedure. The flowchart in Figure 10 starts, for example, when an input instructing the start of the learning process is received.

[0043] First, the acquisition unit 15a acquires communication packets sent by the network's contracted user (step S1).

[0044] Next, the distribution unit 15b distributes the acquired communication packets to the destination networks stored in the destination network 14a corresponding to the source address of the communication packets (step S2). Specifically, the distribution unit 15b uses the source address of the acquired communication packets to refer to the destination network 14a and identifies the destination network corresponding to that source address. Then, the distribution unit 15b connects to the identified network and forwards the communication packets.

[0045] For example, the distribution unit 15b connects the acquired communication packet to the VPN if the destination address is a private address, and connects the communication packet to the internet if the destination address is a global address.

[0046] Furthermore, if the memory unit 14 stores a specific destination address corresponding to the source address, the distribution unit 15b connects communication packets with a specified destination address to that destination address on the Internet, and connects communication packets with destination addresses other than the specified destination address to the VPN. This completes the series of distribution processes.

[0047] [effect] As described above, in the distribution device 10 located within the network of the above embodiment, the destination network 14a of the storage unit 14 stores either the Internet or a VPN destination network corresponding to the source address of a network user. The acquisition unit 15a acquires communication packets sent by network users. The distribution unit 15b distributes the acquired communication packets to the destination networks stored in the destination network 14a corresponding to the source address of the communication packets.

[0048] As a result, the distribution device 10 eliminates the need for operation at user terminals or user locations, enabling users to seamlessly connect to different networks. In this way, the distribution device 10 allows network users to easily connect to different networks such as the internet or VPN.

[0049] Specifically, the distribution unit 15b connects the communication packet to the VPN if the destination address is a private address, and connects the communication packet to the internet if the destination address is a global address. This eliminates the need for operations at the user terminal or user site, allowing the user to seamlessly and easily connect to different networks such as the internet or VPN.

[0050] Furthermore, the storage unit 14 may also store a specific destination address corresponding to the source address. In this case, the distribution unit 15b connects communication packets with a specific destination address to that destination address, and connects communication packets with destination addresses other than the specific destination address to the VPN. As a result, the distribution device 1 can easily enable internet communication to the specific destination address and connect other communications to the VPN.

[0051] [System configuration, etc.] Each component of the illustrated device is a functional concept and does not necessarily have to be physically configured as shown. In other words, the specific forms of distribution and integration of each device are not limited to those shown, and all or part of them can be functionally or physically distributed and integrated in any unit according to various loads and usage conditions. Furthermore, each processing function performed by each device can be implemented, all or any part of it, by a CPU or GPU and programs that are analyzed and executed by that CPU or GPU, or by hardware using wired logic.

[0052] Furthermore, among the processes described in this embodiment, all or part of the processes described as being performed automatically can be performed manually, or all or part of the processes described as being performed manually can be performed automatically by known methods. In addition, the processing procedures, control procedures, specific names, and information including various data and parameters shown in the above document and drawings can be arbitrarily changed unless otherwise specified.

[0053] [program] It is also possible to create a program that describes the processing performed by the sorting device described in the above embodiment in a computer-executable language. For example, it is possible to create a program that describes the processing performed by the sorting device 1 according to the embodiment in a computer-executable language. In this case, the same effects as in the above embodiment can be obtained by having a computer execute the program. Furthermore, the same processing as in the above embodiment may be realized by recording such a program on a computer-readable recording medium and having a computer read and execute the program recorded on this recording medium.

[0054] Figure 11 shows an example of a computer running a distribution program. Computer 1000 includes, for example, memory 1010, a CPU 1020, a hard disk drive interface 1030, a disk drive interface 1040, a serial port interface 1050, a video adapter 1060, and a network interface 1070. These components are connected by a bus 1080.

[0055] Memory 1010 includes ROM (Read Only Memory) 1011 and RAM 1012. ROM 1011 stores, for example, a boot program such as BIOS (Basic Input Output System). The hard disk drive interface 1030 is connected to the hard disk drive 1031. The disk drive interface 1040 is connected to the disk drive 1041. A removable storage medium, such as a magnetic disk or optical disk, is inserted into the disk drive 1041. A serial port interface 1050 is connected to, for example, a mouse 1051 and a keyboard 1052. A video adapter 1060 is connected to, for example, a display 1061.

[0056] Here, the hard disk drive 1031 stores, for example, the OS 1091, the application program 1092, the program module 1093, and the program data 1094. The information described in the above embodiment is stored, for example, in the hard disk drive 1031 or the memory 1010.

[0057] Furthermore, the distribution program is stored in the hard disk drive 1031 as a program module 1093 containing instructions to be executed by the computer 1000, for example. Specifically, the program module 1093 containing instructions for each process executed by the distribution device 1 described in the above embodiment is stored in the hard disk drive 1031.

[0058] Furthermore, the data used for information processing by the distribution program is stored as program data 1094, for example, in the hard disk drive 1031. The CPU 1020 then reads the program module 1093 and program data 1094 stored in the hard disk drive 1031 into the RAM 1012 as needed and executes the procedures described above.

[0059] Furthermore, the program module 1093 and program data 1094 related to the distribution program are not limited to being stored on the hard disk drive 1031; for example, they may be stored on a removable storage medium and read by the CPU 1020 via a disk drive 1041 or the like. Alternatively, the program module 1093 and program data 1094 related to the distribution program may be stored on another computer connected via a network such as a LAN (Local Area Network) or WAN (Wide Area Network) and read by the CPU 1020 via a network interface 1070.

[0060] Although embodiments applying the invention made by the present inventors have been described above, the present invention is not limited by the descriptions and drawings that constitute part of the disclosure of the present invention in this embodiment. That is, all other embodiments, examples, and operational techniques made by those skilled in the art based on this embodiment are included in the scope of the present invention. [Explanation of symbols]

[0061] 10 Sorting device 11 Input section 12 Output section 13 Communication Control Unit 14 Storage section 14a Destination Network 15 Control Unit 15a Acquisition part 15b Sorting section

Claims

1. A distribution device located within a network, A storage unit that stores either the Internet or a VPN destination network corresponding to the source address of the user of the aforementioned network, An acquisition unit that acquires communication packets sent by users of the aforementioned network, A distribution unit that distributes the acquired communication packets to the destination networks stored in the storage unit corresponding to the source address of the communication packets, A sorting device characterized by having the following features.

2. The distribution device according to claim 1, characterized in that the distribution unit connects the communication packet to a VPN when the destination address of the communication packet is a private address, and connects the communication packet to the Internet when the destination address is a global address.

3. The memory unit further stores a specific destination address corresponding to the source address, The distribution device according to claim 1, characterized in that the distribution unit connects communication packets with a specific destination address to the destination address and connects communication packets with a destination address other than the specific destination address to the VPN.

4. An information processing method performed by a distribution device located within a network, The distribution device has a storage unit that stores either the Internet or a VPN destination network corresponding to the source address of the network user. The acquisition process involves acquiring communication packets sent by users of the aforementioned network, A distribution step of distributing the acquired communication packets to the destination networks stored in the storage unit corresponding to the source address of the communication packets, A distribution method characterized by including the following.

5. The system refers to a memory unit that stores the destination network, either the Internet or a VPN, corresponding to the source address of the network user. The acquisition step involves acquiring communication packets sent by users of the aforementioned network, A distribution step which involves distributing the acquired communication packet to the destination network stored in the storage unit corresponding to the source address of the communication packet, A distribution program characterized by having a computer execute it.

Images