Communication methods, communication systems, communication devices, and communication programs

Abstract

The process involves the first terminal 1a under the first NAT router 2a and the second terminal 1b under the second NAT router 2b obtaining each other's public keys, both terminals calculating a common port number P using a derivation function based on each other's public keys, the first terminal sending a packet requesting a connection via the common port number P to the second NAT router at first time intervals, and the second terminal sending a packet requesting a connection via the common port number P to the first NAT router at second time intervals. This eliminates the influence of port translation in the NAT routers, enabling successful asynchronous hole punching and establishing a secure P2P connection.

Description

Technical Field

[0001] The present invention relates to a communication method and a communication system for establishing a P2P (Peer to Peer) connection for direct communication between terminals under different NAT (Network Address Translation) routers.

Background Art

[0002] In recent years, with the spread of IoT (Internet of Things) devices and the expansion of the use of real-time communication applications, the importance of P2P connections in which terminals communicate directly without going through a server has been increasing. Usually, these terminals are often placed under a NAT router (within a private network) for security and to counter IP address exhaustion.

[0003] As a technology for P2P connections between terminals under a NAT router via the Internet, the so-called Hole Punching technology is known (for example, Patent Document 1). In this technology, it is necessary to know one's own global IP address and port number and the global IP address and port number of the destination, and for this purpose, external relay servers such as STUN (Session Traversal Utilities for NAT) servers and signaling servers are used.

[0004] In the STUN server method, each terminal obtains its own external IP address and port number from the STUN server and attempts direct communication by exchanging this information via a signaling server. However, some NAT routers (such as so-called symmetric NATs) have a specification that dynamically changes the port number for each communication partner. As a result, the communication partner between the signaling server and the destination terminal is different, and different port numbers are assigned to each, which can cause STUN-based hole punching to fail. In such cases, traditionally, a relay server called a TURN (Traversal Using Relays around NAT) server was used to relay all communication data through that server, thereby achieving NAT traversal. [Prior art documents] [Patent Documents]

[0005] [Patent Document 1] Japanese Patent Publication No. 2016-5212 [Overview of the project] [Problems that the invention aims to solve]

[0006] However, the conventional P2P connection establishment methods described above had the following problems. Firstly, the procedure for establishing a connection was complicated, resulting in delays (latency) before communication could begin. Conventional technology required multiple round-trip communications, such as querying a STUN server and exchanging information via a signaling server (SDP exchange, etc.), before actually initiating P2P communication.

[0007] Secondly, there are issues with the installation and operation costs and fault tolerance when using external servers. When using servers such as STUN servers, signaling servers, and TURN servers, even though it is communication between terminals, there are actually costs associated with installing and operating the servers. In addition, if there is a communication failure to the external server or if the external server fails, P2P connection cannot be made, and the external server becomes a single point of failure.

[0008] Thirdly, there are security issues. A signaling server is essential for terminals to exchange dynamically changing port numbers necessary for connecting to the external network, and the information exchanged is exposed to the risk of interception. There is also a risk that the global IP addresses and port numbers of each terminal, which are cached on the signaling server, may be accessed. [Means for solving the problem]

[0009] One aspect of the present invention is a communication method for establishing a P2P connection between a first terminal located under a first NAT router connected by a network and a second terminal located under a second NAT router. This communication method includes the steps of: the first terminal and the second terminal obtaining each other's global IP addresses and public keys; the first terminal and the second terminal each calculating a port number by performing an operation that takes the public key of the first terminal and the public key of the second terminal as input values ​​and both obtain the same result; the first terminal sending a packet with the source port and destination port set to the port number to the global IP address of the second terminal at a first time interval; and the second terminal sending a packet with the source port and destination port set to the port number to the global IP address of the first terminal at a second time interval, thereby causing hole punching in the first NAT router and the second NAT router, and establishing a P2P connection between the first terminal and the second terminal.

[0010] Another aspect of the present invention is a communication system comprising a first terminal under a first NAT router and a second terminal under a second NAT router. The first terminal and the second terminal each include a communication information acquisition unit that acquires each other's global IP addresses and public keys, a port number calculation unit that calculates a common port number by performing a predetermined operation on input values ​​including the public key of the first terminal and the public key of the second terminal, such that both units produce the same result, and a packet transmission unit that repeatedly transmits packets to the global IP address of the other terminal, with the source port and destination port set to the calculated port number, at predetermined time intervals, and establishes a P2P connection by causing hole punching to the first NAT router and the second NAT router by transmitting the packets to each other.

[0011] A further aspect of the present invention is a terminal device that is connected to a network via a NAT router and performs P2P communication with another terminal device that is a communication partner. This terminal device includes a communication information acquisition unit that acquires the global IP address and public key of the other terminal device, a port number calculation unit that calculates a port number common to the other terminal device by performing a predetermined operation on an input value including its own public key and the public key of the other terminal device, and a packet transmission unit that repeatedly sends packets with the source port and destination port set to the calculated port number to the global IP address of the other terminal device at predetermined time intervals.

[0012] Furthermore, the present invention can also be realized as a communication program executed by a terminal device that is connected to a network via a NAT router and performs P2P communication with another terminal device that is a communication partner. The program causes a computer to perform the following steps: obtain the global IP address and public key of the other terminal device; calculate a port number common to the other terminal device by performing a predetermined operation on an input value including its own public key and the public key of the other terminal device; and repeatedly send packets to the global IP address of the other terminal device, with the source port and destination port set to the calculated port number, at predetermined time intervals. [Effects of the Invention]

[0013] According to the present invention, the first terminal and the second terminal calculate a common port number based on each other's public keys. Unlike temporary session IDs or dynamic port numbers, public keys remain unchanged over long periods and are fixed values. As a result, once the other party's IP address and public key are obtained, subsequent P2P connections do not require accessing the external server again to exchange port information. Consequently, subsequent communications can be instantaneously established, eliminating the overhead of server access. This significantly reduces the operating costs and single-fault vulnerability of the external server, and enables a robust connection that is independent of the external server's operating status and communication conditions. [Brief explanation of the drawing]

[0014] [Figure 1] This is a block diagram showing the hardware configuration of the communication system of the present invention. [Figure 2] This is a block diagram showing the functional configuration of terminal 1. [Figure 3] This is a flowchart illustrating the operation of terminal 1. [Figure 4] This diagram illustrates the flow of packet transmission and reception. [Figure 5] This is a diagram showing the structure of a transmitted packet. [Figure 6]It is a block diagram showing the hardware configuration of a communication system in another embodiment of the present invention. [Figure 7] It is a block diagram showing the functional configuration of the terminal 1 according to the second embodiment of the present invention. [Figure 8] It is a block diagram showing the functional configuration of the terminal 1 according to the third embodiment of the present invention. [Figure 9] It is a conceptual diagram showing the configuration of a DHT network and the transmission path of a registration request packet according to the third embodiment of the present invention. [Figure 10] It is a conceptual diagram showing the configuration of a DHT network and the transfer path of an inquiry packet according to the third embodiment of the present invention.

Mode for Carrying Out the Invention

[0015] (First Embodiment) Hereinafter, the same or equivalent components, members, processes, and signals shown in each drawing are denoted by the same reference numerals, and redundant explanations are omitted as appropriate. Also, in each drawing, some members that are not important for explanation are omitted from the display. The following embodiments do not unduly limit the content of the present disclosure described in the claims, and not all of the components shown in the embodiments are essential components of the present disclosure. Also, each figure is a schematic diagram and is not necessarily drawn precisely.

[0016] FIG. 1 is an overall configuration diagram of a communication system according to the present embodiment. This system includes a terminal 1a and a terminal 1b, NAT routers 2a and 2b, and a directory server 3 located at the edge of the network NW connected via a wide area network NW.

[0017] The network NW is an IP network such as the Internet. The terminal 1a is connected under the NAT router 2a (LAN side) and accesses the network NW via the NAT router 2a. Similarly, the terminal 1b is connected under the NAT router 2b (LAN side) and accesses the network NW via the NAT router 2b. The terminals 1a and 1b are information processing devices having a communication function such as a PC, a smartphone, or an IoT device.

[0018] The NAT routers 2a and 2b are relay devices that perform conversion between private IP addresses and global IP addresses (NAT processing). In the present embodiment, at least one of these NAT routers may be of a type that dynamically changes the external port number according to the destination address (so-called symmetric NAT, etc.). The present invention enables establishment of a P2P connection without going through a relay such as a TURN server even in such an environment.

[0019] The directory server 3 is a management server installed on the network NW. The directory server 3 in the present embodiment, unlike the signaling servers used in conventional WebRTC, etc., does not need to have a function of mediating the session establishment process between terminals in real time and each time, and only needs to be accessed from each terminal only once at the first time of transmission to the destination as long as the global IP address and public key of the registered terminals are not changed. The directory server 3 has a function as a database such as a phone book that associates and holds the identification information of each terminal (1a, 1b), the currently assigned global IP address, and the "public key" of each terminal. Note that the directory server 3 is not an essential configuration of the present invention, and a configuration using the directory server 3 will be described as one of the examples. A case where the directory server 3 is unnecessary will be described later.

[0020] Here, we will explain the behavior of a NAT router and general hole punching techniques, which are prerequisites for the present invention. Normally, when a packet is sent from a terminal in the LAN to a destination on the Internet, the NAT router (or router with NAPT functionality) translates the source IP address (private IP) and source port number contained in the packet header to the router's own global IP address and the external port number assigned by the router.

[0021] In this process, the NAT router records the correspondence (mapping) of address information before and after translation in its internal translation table for a certain period of time. This record is generally called a "NAT session" or "NAT entry." When the NAT router receives a packet from an external source, it refers to this translation table and forwards the packet to a specific terminal within the LAN only if a corresponding record exists. Conversely, packets from external sources for which no corresponding record exists are considered a security threat and are discarded (dropped) by the firewall function.

[0022] In P2P communication, if both parties are behind a NAT router, the first packet is discarded because there is no corresponding record on the other party's NAT router. Hole punching is a technique that avoids this by creating a communication path (a so-called "hole") in both NAT routers.

[0023] The conventional UDP hole punching procedure is as follows: (1) First, the first and second terminals use a STUN server or the like to find out the external port number on their respective NAT routers and exchange this information with each other via a signaling server. (2) Next, the first terminal sends a packet to the external address of the second terminal. This packet is likely to be discarded by the NAT router, but the important thing is to create a "transmission record (mapping) for the second terminal" in the NAT router. (3) In parallel with this, the second terminal also sends a packet to the external address of the first terminal. At this time, since the mapping created in (2) already exists in the NAT router, the packet from the second terminal is allowed as a valid reply and reaches the first terminal. (4) Once the packet reaches the first terminal, bidirectional communication becomes possible. However, as mentioned above, this conventional hole punching method requires the exchange of port numbers via an external server each time communication occurs, which is the problem described in the problem the invention aims to solve. This embodiment solves these problems by using public key-based port calculation and asynchronous transmission control.

[0024] (Configuration of Terminal 1) Next, the specific configuration of Terminal 1 (1a, 1b) will be described with reference to Figure 2. As shown in Figure 2, Terminal 1 comprises a control unit 101, a communication unit 102, and a storage unit 103. Terminals 1a and 1b basically have the same hardware and functional configurations.

[0025] (Communication Unit 102) The communication unit 102 is a communication interface such as Wi-Fi, LTE / 5G, or wired LAN, and sends and receives packets with other devices on the network NW via the NAT router 2 (2a, 2b). The storage unit 103 is a storage medium such as flash memory or RAM. The storage unit 103 stores its own private key and public key, as well as the public key and IP address of the terminal (peer) that will be the communication partner, obtained from the directory server 3 or other routes. It also stores the common port number calculated by the calculation described later, and the communication history when the connection is successful.

[0026] (Control Unit 101) The control unit 101 is composed of a CPU, MPU, etc., and operates as the following functional units by executing the communication program of this embodiment. The control unit 101 includes, as functional blocks, a communication information acquisition unit 1011, a port number calculation unit 1012, a packet transmission unit 1013, and a connection establishment unit 1014. The control unit 101 realizes each functional block by reading the application program stored in the storage unit 103 and executing processing.

[0027] (Communication information acquisition unit 1011) The communication information acquisition unit 1011 performs the process of acquiring the global IP address and public key of the communication partner. Specifically, if there is a history of connecting to the partner's terminal and a valid global IP address and public key exist in the storage unit 103, the information is read from the storage unit. If it does not exist, a query is made to the directory server 3 via the communication unit 102 and the information is saved in the storage unit 103.

[0028] As mentioned above, the communication information acquisition unit 1011 can obtain the global IP address and public key of the communication partner by means other than the directory server 3. For example, the user of the terminal device may exchange the global IP address and public key in advance using another protocol (e.g., email or short-range wireless communication) and store them in the storage unit 103. Alternatively, the global IP address and public key of the terminal to be communicated with may be stored in the storage unit 103 of terminal 1 as an initial setting. In this case, the communication information acquisition unit 1011 does not need to access the directory server 3 in order to obtain the global IP address and public key of the communication partner that are stored in the storage unit.

[0029] (Port number calculation unit 1012) The port number calculation unit 1012 calculates a port number to be used in common with the communication partner's terminal using a predetermined derivation function, based on its own public key stored in the storage unit 103 and the communication partner's public key obtained by the communication information acquisition unit 1011. A deterministic algorithm is used for this calculation, which yields the same result for both parties. The calculated port number is passed to the packet transmission unit 1013.

[0030] The formula for the common port number (port) derivation function executed in the port number calculation unit 1012 can be expressed, as an example, by the following formula (1). port = 40000 + (BLAKE2s(sorted(pubA || pubB) || epoch) mod 20000) (1) pubA: Public key of terminal 1a pubB: Public key of terminal 1b epoch: A value indicating the current time sorted(): A function that sorts multiple input data in a predetermined order (e.g., lexicographical order or value order). BLAKE2s: Cryptographic hash functions

[0031] Let's explain equation (1). First, the operation sorted(pubA || pubB) guarantees symmetry between the first and second terminals. If we simply concatenate "my key + the other party's key," the concatenation order will be reversed on terminal 1a and terminal 1b, resulting in mismatched hash values. Therefore, by sorting (rearranging) both public keys before concatenation, the input value of the hash function will be the same regardless of which terminal performs the calculation.

[0032] `epoch` is a parameter that gives the calculated port number "temporal dynamism." `epoch` represents the current time, for example, in UNIX® time, and is defined as an integer value (in milliseconds). By including this parameter in the hash input, the common port number P becomes a value that changes at predetermined time intervals (time slots). This improves resistance to port scan attacks and replay attacks, because even if the port number at a certain point in time is guessed by a third party, the port number will change at the next time interval. In this case, it is desirable that terminals 1a and 1b are synchronized using NTP (Network Time Protocol) or similar. Furthermore, this value may be rounded to allow for a time lag between terminals 1a and 1b. For example, the last digit of `epoch` can be rounded to 0 to give a tolerance of about 10ms.

[0033] BLAKE2s converts the input value (a concatenated data of sorted public key and time information) into a fixed-length bit string, adding unpredictable randomness. Dividing this hash value by modulo 20000 normalizes the value to an integer in the range of 0 to 19999. Finally, by adding the base offset value of 40000, the final port number `port` is mapped to the range of 40000 to 59999. This range is set to a so-called private / dynamic port area, meaning it is a range of numbers that each user can freely use, and is designed to avoid port conflicts with other applications, as it is less likely to overlap with specific registered ports.

[0034] This derived function generates a common port number for both terminal 1a and terminal 1b at predetermined time intervals. The derived function is not limited to equation (1); any other equation that generates a common port number between terminal 1a and terminal 1b at predetermined time intervals from similar inputs may be used.

[0035] (Packet transmission unit 1013) The packet transmission unit 1013 controls the transmission of packets for NAT traversal (hole punching). Specifically, it generates UDP packets with the port numbers calculated by the port number calculation unit 1012 set as the "destination port" and "source port," and sends them toward the global IP address of the communication partner. The packet transmission unit 1013 also has a function to control the timing of this transmission, so that terminal 1a and the second terminal continue to send packets periodically at the same time interval. Here, the time interval is synonymous with a time slot. For example, if the epochs of terminals 1a and 1b are expressed in milliseconds, a time interval of 10ms is expressed as a time with the last digit of the epoch being 0. As a result, terminals 1a and 1b each send packets individually according to their own epochs and time slots, and as a result, terminals 1a and 1b send packets to each other in synchronous order.

[0036] Note that the time intervals between packet transmissions by terminal 1a and terminal 1b can be different, but they must include a time when their time slots coincide. For example, terminal 1a's time slot could be 10ms (last digit of epoch is 0), and terminal 1b's time slot could be 100ms (last digit of epoch is 00). As explained in the hole punching section, the NAT router's translation table records are only valid for a predetermined time, so the time interval between packet transmissions by terminal 1a and terminal 1b must be sufficiently shorter than this predetermined time. Typical NAT routers retain translation table records for several seconds to tens of seconds, so it is desirable that the difference in the packet transmission time intervals between terminal 1a and terminal 1b be 0 (simultaneous) or several hundred milliseconds or less.

[0037] (Connection establishment unit 1014) The connection establishment unit 1014 monitors the reception of packets from the other terminal in parallel with the transmission by the packet transmission unit 1013. When it receives a packet from the other terminal using the calculated common port number, the connection establishment unit 1014 determines that NAT traversal was successful, stops the repeated transmission for hole punching by the packet transmission unit 1013, and starts a P2P communication session (sending and receiving application data).

[0038] (Operation flow of terminal 1) Next, referring to Figure 3, the specific procedure for establishing a P2P connection performed by terminal 1 (terminal 1a or terminal 1b) will be described. Note that this process is executed in parallel (asynchronously) on terminals 1a and 1b.

[0039] (Step S01) First, the communication information acquisition unit 1011 acquires the global IP address and public key of the communication partner. This is done by querying the directory server 3, as described above. However, if the information is already cached in the storage unit 103, or if information about the communication partner already exists in the storage unit 103 as described above, the acquisition is considered complete by reading that information, and no access to the directory server 3 is performed.

[0040] (Step S02) The port number calculation unit 1012 calculates a common port number P using its own public key and the public key and time information epoch of the other party obtained in step S01. Since a deterministic function like the one in equation (1) above is used for this calculation, terminals 1a and 1b can independently derive the same port number P without communicating with each other.

[0041] (Step S03: Packet transmission and NAT behavior) The packet transmission unit 1013 generates a packet for NAT traversal (a punching packet) using the calculated port number P and sends it to the recipient. The structure of the transmitted packet and the behavior of the NAT router will now be explained with reference to Figures 4 and 5.

[0042] FIG. 5 is a diagram showing the configuration of packets (particularly packets for hole punching) transmitted and received between terminal 1a and terminal 1b. This packet can be roughly divided into an "IP / UDP header part" and a "payload (actual data part)", and the payload is composed of an "application-specific header part" and "application data".

[0043] <IP / UDP header part> This includes a standard IPv4 or IPv6 header and a UDP header. In the illustration of FIG. 5, only what is necessary for this embodiment is shown, and the IP / UDP header part includes other header information necessary for communication. The source port number and destination port number in the UDP header are set with the common port number (P) calculated by the above formula (1). As a result, the NAT router processes this packet as being associated with a specific application session, maintains the mapping (hole), and allows packets to the port P to pass through for a certain period of time.

[0044] <Payload part> The payload is the actual data part and is the area that terminal 1a and terminal 1b read and process after reception. This area is encrypted using the public key of the destination. Therefore, only a legitimate receiving terminal with the corresponding private key can decrypt it. The payload part consists of an application-specific header part and an application data part.

[0045] <Application-specific header part> This area is a metadata area that can be referred to when the receiving side processes the received packet. It is the specific header information used in the application of this embodiment. This part is provided for the purpose of preventing unnecessary packet processing and ensuring security when terminal 1 receives a packet that has passed through the NAT by hole punching. This area includes data that guarantees whether the received packet is worth processing. Specific examples are as follows. • Magic Number: A fixed sequence of bytes used to identify a packet as belonging to this P2P system. It is used to filter out noise (irrelevant packets) on the internet. • Epoch ID: A value that identifies the time interval (epoch) used to calculate the port number. The receiving end can determine "which time key the packet was calculated with" by looking at this value, allowing for proper processing even if the order in which packets are received is reversed due to network delays.

[0046] The configuration of the application-specific header allows for minimizing processing at the receiving terminal 1 even if unrelated packets accidentally arrive at a port where hole punching has been performed, preventing unnecessary packet processing and ensuring security.

[0047] <Application Data> This area contains data that is processed by the application after terminals 1a and 1b refer to the application-specific header and determine that the packet is valid. The data can be in any format that the application running on terminals 1a and 1b can use, such as text, images, videos, or binary data.

[0048] By encrypting the entire payload with the recipient's public key and including one's own signature within it, the following security benefits can be achieved. Firstly, confidentiality. Even if packets are intercepted by a NAT router or on the internet, a third party without the private key cannot decipher their contents. Secondly, authenticity is guaranteed. Regarding port number P, there is a possibility that a malicious third party might accidentally send junk data to the same port at the same time. However, the receiving end can maintain security by successfully decrypting the encrypted payload and accepting only legitimate packets based on the information proving their authenticity within the decrypted data, discarding the rest.

[0049] Next, referring to Figure 4, we will specifically explain the contents of the transmitted packet header, the translation process by the NAT router, and the operation that causes hole punching. The box labeled "Header" next to the network configuration in Figure 4 indicates a packet sent by terminal 1, and the illustration shows the information of the packet header (see Figure 5).

[0050] <Sent from terminal 1a> As shown on the left side of Figure 4, terminal 1a (private IP: 192.168.0.5) generates a packet with terminal 1b's global IP (BBBB) as the destination and common port number P as the destination port. In this case, the source port within the LAN from terminal 1a to NAT router 2a can be arbitrary. Terminal 1a can also bind (bind) the source port number to the same common port number P and send packets. In this embodiment, we assume that the source port is any port A. Therefore, the packet header before reaching NAT router 2a will be as follows. • Destination address (DistIP): BBBB • Destination port (DistPort): P • Source IP address (SrcIP): 192.168.0.5 • Source port (SrcPort): portA

[0051] When this packet passes through NAT router 2a (global IP: AAAA), NAT (NAPT) processing is performed. The NAT router is designed to attempt to preserve the source port number (port preservation). Therefore, the translated packet header is sent to the internet network in the following state as shown in the diagram. • Destination address (DistIP): BBBB • Destination port (DistPort): P • Source IP address: AAAA • Source port (SrcPort): P As a result, a mapping is created in the translation table of NAT router 2a that "forwards replies to external port P to internal port A (192.168.0.5)".

[0052] <Sent from terminal 1b> Similarly, as shown on the right side of Figure 4, terminal 1b (private IP: 192.168.0.2) also sends packets toward terminal 1a's global IP (AAAA) and common port number P. Second terminal 1b also has its source port set to port B, and the packet header after passing through NAT router 2b (global IP: BBBB) is as follows. • Destination address (DistIP): AAAA • Destination port (DistPort): P Sender IP address: BBBB • Source port (SrcPort): P This creates a mapping in NAT router 2b that "forwards replies to external port P to internal port B (192.168.0.2)."

[0053] <Packet arrival> As shown in Figure 4, packets from both sides flow towards the other party's "global IP address" and "port number P". Here, since port P is already open on NAT router 2a, the packet sent from terminal 1b passes through as a valid reply and is forwarded to terminal 1a (192.168.0.5). The same applies in the reverse direction. In this way, by using the "common port number P" as both the "source" and "destination", the port saving function of the NAT router is made to its fullest extent, and NAT traversal can be successfully achieved with a high probability.

[0054] (Step S04) After sending the packet, the connection establishment unit 1014 listens on port number P and determines whether it has received a packet from terminal 1b. Due to the transmission in step S03, port P is mapped to the NAT router 2a, and a packet addressed to itself is sent from terminal 1b at the same time as terminal 1a's packet transmission. Therefore, the NAT router 2a receives the packet from terminal 1b so that the packets pass each other by. At this time, as explained in the hole punching explanation above, a mapping for port P exists, so the packet from terminal 1b is allowed by the NAT router 2a as a valid reply and reaches terminal 1a. The connection establishment unit 1014 determines whether it has received a packet from the communication partner. If it has received a packet from the communication partner and has successfully verified its payload, the connection establishment unit 1014 proceeds to step S05. If the connection establishment unit 1014 determines that a packet from the communication partner will not arrive at a time shorter than the predetermined time interval for packet transmission in step S03, that is, before the next packet transmission, it returns to step S03 and continues sending packets.

[0055] (Step S05) Upon receiving a valid packet, the connection establishment unit 1014 instructs the packet transmission unit 1013 to stop sending packets. This stops the periodic transmission of connection request packets, which had previously been repeated at the first time interval (T1) or second time interval (T2), thus preventing the waste of network bandwidth.

[0056] The connection establishment unit 1014 of the terminal that first receives the packet sends an ACK packet back to the other terminal. This is to notify the other terminal that the hole punching was successful and that the other terminal's packet has been received. When both parties have received mutually authenticated packets, the handshake is completed and a logical P2P session is established. The connection establishment unit 1014 stores the successful connection information as a "session cache" in the storage unit 103. Specifically, it records the other party's public key, the global IP address with which the connection was successful, and the common port number P used. Processing of this flow ends when the P2P session is established.

[0057] As previously mentioned, the sequence of processes in this processing flow is executed in parallel on terminals 1a and 1b. However, if the connection establishment in step S05 is successful on at least one of the terminals, a P2P session will be established between terminals 1a and 1b, and the P2P connection will be successful. This is because if hole punching is successful on one terminal, that terminal will be able to respond to packets from the other side, and the other side's NAT router will also be able to successfully perform hole punching.

[0058] From this point forward, terminal 1a and terminal 1b can send and receive application layer data (video, audio, files, etc.) to and from each other using this established P2P path.

[0059] As described above, the communication system and communication method according to this embodiment solve the server dependency, timing control, and port number determination issues that plagued conventional P2P connection technologies. In conventional P2P, it was necessary to query an external server to obtain information about the global IP address and port of the NAT router to which one's terminal is connected, and the global IP address and port of the destination NAT router. However, in this embodiment, the IP address and public key information of the other party are only known once in advance of the P2P connection, and thereafter a P2P connection can be established quickly with zero configuration without accessing an external server. Furthermore, because there is no dependency on an external server, a P2P connection can be established without being affected by external server failures or network failures.

[0060] Furthermore, in terms of security, since a common port is calculated using each party's public key and time slot, it is difficult for other companies to guess, thus preventing port attacks on NAT routers from other companies. In addition, since communication packets are encrypted using the public key of the destination terminal, the likelihood of them being read even if intercepted is reduced.

[0061] (Second embodiment) In the first embodiment, information about the communication partner was obtained using the directory server 3 in step S01, but in this embodiment, the information is obtained via another terminal (terminal 1c) that is already participating in the P2P network.

[0062] As shown in Figure 6, in addition to terminals 1a and 1b, this system also has terminal 1c under the control of the third NAT router 2c. Here, terminal 1c is assumed to be a known terminal that has already established a P2P connection with at least one (or both) of terminals 1a and 1b, or is in a state where it can communicate with them via some route.

[0063] The procedure for step S01 (acquisition of communication information) in this embodiment is as follows: When terminal 1a's communication information acquisition unit 1011 wants to connect with a new communication partner, terminal 1b, it first sends a search request to terminal 1c, which is a known terminal. This search request includes the identification ID of the partner to be found (terminal 1b).

[0064] Terminal 1c refers to the connection information stored in the memory unit 103 based on past connection history and other data. If terminal 1c knows terminal 1b's latest "global IP address" and "public key," terminal 1c sends that information back to terminal 1a.

[0065] Terminal 1a stores the information received from terminal 1c (the IP address and public key of terminal 1b) in the storage unit 103. The subsequent steps S02 to S05 are the same as in the first embodiment. That is, prior connection information is obtained via terminal 1c, but packet transmission (hole punching) and data communication are performed directly between terminal 1a and terminal 1b without going through terminal 1c.

[0066] Next, with reference to Figure 7, the functional configuration of terminal 1 in the second embodiment will be described. The basic configuration is the same as that of the first embodiment shown in Figure 2, but the control unit 101 in this embodiment differs in that it further includes a connection information response unit 1015, as shown in Figure 7.

[0067] The connection information response unit 1015 is a processing block that operates when the device functions as a known peer (a terminal with a P2P connection) in the network. Specifically, it receives discovery requests from other terminals (terminal 1a, terminal 1b) via the communication unit 102.

[0068] The connection information response unit 1015 searches the storage unit 103 using the "ID of the person to be found" included in the received search request as the search key. In this embodiment, the storage unit 103 is assumed to store not only its own connection history but also a routing table for managing information on other nodes participating in the P2P network.

[0069] If the search finds a valid "global IP address" and "public key" for the relevant terminal (for example, terminal 1b), the connection information response unit 1015 generates a response containing that information and sends it back to the terminal that made the inquiry.

[0070] The above explanation describes the operation of terminal 1a, but as already mentioned, terminal 1b also obtains connection information in the same way. At this time, terminal 1b similarly queries the P2P-connected terminal (which may be terminal 1c or any other terminal 1) to obtain connection information and performs the processes from steps S02 to S05.

[0071] As described above, by adopting the configuration shown in Figure 7, each terminal device can function not only as a communication endpoint but also as a database node that replaces the directory server. This eliminates the need for a directory server in the communication system of the present invention, resulting in a configuration that is completely independent of external servers.

[0072] (Third embodiment) Next, with reference to Figure 9, the specific operation in the third embodiment will be described. In this embodiment, multiple terminals 1 (peers A to E) located on a network NW such as the Internet maintain P2P connections with each other and form a logical distributed hash table network. In this embodiment, each terminal that has already established a P2P connection is represented as a peer. Note that in Figure 9, since P2P connections have already been established between each peer, the NAT routers connected to each peer are omitted from the illustration.

[0073] Each terminal device 1's control unit 101 (connection information response unit 1015) functions as a DHT node. The storage unit 103 stores the correspondence between identification information and connection information within the hash space it is responsible for, as a DHT routing table. The table in Figure 9 shows a portion of the routing table stored in the storage unit 103 of each peer. Note that the public key information is omitted from the illustrated routing table.

[0074] Peer D in Figure 9 functions as a "known peer (bootstrap node)" in the P2P network. Terminal 1a is under the control of NAT router 2a and, in its initial state, does not belong to the P2P network and does not know the IP addresses of each peer in the P2P network. However, it is assumed that it knows only Peer D, which is the entry point to the network, as the bootstrap node. The bootstrap node information is stored in the memory unit 103 as an initial setting of the program that executes this communication method.

[0075] The differences between this embodiment and the first and second embodiments are the process of joining the P2P network (initial connection process) shown in Figure 8 as a preliminary step to step S01, the addition of an initial connection unit 1016 to terminal 1, the processing content of step S01, and the operation of the communication information acquisition unit 1011 and connection information response unit 1015. These points will be explained in detail.

[0076] (Initial connection process) Figure 8 shows an example of a first terminal 1a joining a P2P network that peers A through E are participating in. The first terminal 1a is under the control of NAT router 2a and, as a known peer (bootstrap node) that serves as the entry point to the network, is initially assumed to know only the IP address of peer D, the connection port number used when registering, and the identifier for accessing peer D.

[0077] The initial connection unit 1016 of terminal 1a sends a registration request packet, as shown in the lower left of Figure 8, to peer D using peer D's IP address and the port number for the registration request connection. This packet contains an identifier, IP address, and public key information for requesting access to peer D. The connection information response unit 1015 of peer D sends its own IP address and public key information to terminal 1a as a response packet.

[0078] Terminal 1a and peer D will each have each other's IP addresses and public keys. Subsequently, the process from steps S02 to S05 is carried out in the same manner as in the first embodiment, and terminal 1a and peer D establish a P2P connection.

[0079] After the connection is established, the connection information response unit 1015 of peer D identifies the "responsible node" corresponding to terminal 1a's ID (or its hash value) from within the network, according to the DHT algorithm. For example, if the hash value of terminal 1a's ID belongs to the hash space managed by peer E, peer D forwards the information of the first terminal 1a to peer E. Upon receiving the forwarding, peer E stores the set of terminal 1a's "ID, IP address, and public key" in its management table within its storage unit 103. As a result, all other peers in the network can obtain the connection information (IP address and public key) of the first terminal 1a via DHT by searching using the first terminal 1a's ID. In other words, the first terminal 1a is registered in the network not only as a "searching party" but also as a "searched party (a peer that can receive connections)".

[0080] (Step S01) The communication information acquisition unit 1011 of terminal 1a obtains the global IP address and public key of the communication partner (in this case, Peer B). First, the communication information acquisition unit 1011 refers to the routing table in its own storage unit 103. If the result of the referencing is that the global IP address and public key of the communication partner Peer B are available, the unit proceeds to step S02. If not, based on the DHT algorithm, it selects Peer A as the node that is closer to Peer B or is more likely to know the information among the nodes it knows. The communication information acquisition unit 1011 sends a query packet to Peer A. Based on the query packet, Peer A sends Peer B's IP address and public key to terminal 1a. The communication information acquisition unit 1011 receives the sent response packet and proceeds to step S02.

[0081] The example in Figure 10 shows a case where terminal 1a and peer A are not directly connected in a P2P network. The communication information acquisition unit 1011 shows that when it sends a query packet to peer A, peer D relays the query packet to peer B, and then relays the response packet from peer A to terminal 1a. In other words, each peer in the P2P network can refer to the routing table and answer the IP address and public key to any other peer, and each peer in the P2P network can establish a direct P2P connection with any other peer.

[0082] According to the third embodiment described above, multiple terminal devices 1 autonomously form an overlay network using a DHT (Distributed Hash Table) and manage each other's connection information in a distributed manner. The greatest advantage of this configuration is that it does not require any centralized external server, and the network is maintained solely by the collection of terminals (peers). This fundamentally eliminates the risk of bottlenecks caused by concentrated access to a specific server and service interruptions due to server downtime (single point of failure).

[0083] Furthermore, each peer on the P2P network autonomously attempts to connect to each peer registered in its routing table, expanding the one-to-one connection to many-to-many connections, thus constructing a mesh topology (mesh network) across the entire network. Connections are established without the need to query dynamic ports; only the initial connection requires obtaining the other party's IP address and public key from the routing table. Subsequent connections can be established with zero configuration. Additionally, each peer's connection uses a port calculated based on its public key, reducing the possibility of external port scanning, and the communication itself is encrypted, ensuring security for each connection. This makes it possible to build and maintain a large-scale, secure mesh network at extremely low cost.

[0084] The present inventors have described the invention in detail based on embodiments above, but the present invention is not limited to the above embodiments. Furthermore, the above embodiments are described in detail for the purpose of explaining the present invention in an easy-to-understand manner, and are not necessarily limited to those having all the described configurations. Some of the configurations of the above embodiments can be added, deleted, or replaced with other configurations.

[0085] Each of the above configurations, functions, and processing means may be implemented in hardware, in whole or in part, for example, by designing them as integrated circuits. Alternatively, each of the above configurations and functions may be implemented in software by having a processor interpret and execute programs that implement each function. Information such as programs, tables, and files that implement each function can be stored in memory, hard disks, SSDs, or other recording devices, or in recording media such as IC cards, SD cards, or DVDs. [Explanation of Symbols]

[0086] 1 Terminal device, 2 NAT router, 3 Directory server, 101 Control unit, 1011 Communication information acquisition unit, 1012 Port number calculation unit, 1013 Packet transmission unit, 1014 Connection establishment unit, 1015 Connection information response unit, 1016 Initial connection unit, 102 Communication unit, 103 Storage unit, NW Network

Claims

1. A method for establishing a P2P connection between a first terminal located under a first NAT router connected by a network and a second terminal located under a second NAT router, The first terminal and the second terminal obtain each other's global IP addresses and public keys, The first terminal and the second terminal each take the public key of the first terminal and the public key of the second terminal as input values ​​and perform an operation that yields the same result to calculate the port number; The first step is to send a packet from the first terminal to the global IP address of the second terminal, with the source port and destination port set to the aforementioned port numbers, at a first time interval. The steps include sending packets from the second terminal to the global IP address of the first terminal at a second time interval, with the source port and destination port set to the aforementioned port numbers, Includes, A communication method for establishing a P2P connection between a first terminal and a second terminal by causing hole punching in at least one of the first NAT router and the second NAT router.

2. In the step of obtaining each other's global IP addresses and public keys, the first terminal and the second terminal shall, if the other party's global IP address and public key are stored in their own storage, obtain them from the storage; otherwise, query a third terminal on the network to obtain the other party's global IP address and public key and store them in their own storage. The communication method according to claim 1.

3. The aforementioned calculation takes time information based on the current time as an input value and dynamically changes the port number in accordance with changes in said time information. The communication method according to claim 1.

4. The packets transmitted from the first terminal to the second terminal are encrypted, at least in part, using the public key of the second terminal. The packets transmitted from the second terminal to the first terminal are encrypted, at least in part, using the public key of the first terminal. The communication method according to claim 1.

5. A communication system comprising a first terminal under the control of a first NAT router and a second terminal under the control of a second NAT router, The first terminal and the second terminal are, A communication information acquisition unit that obtains each other's global IP addresses and public keys, A port number calculation unit calculates a common port number by performing a predetermined operation on input values ​​including the public key of the first terminal and the public key of the second terminal, such that both yield the same result. A packet transmission unit that repeatedly transmits packets with the source port and destination port set to the calculated port numbers, directed towards the global IP address of the recipient terminal, at predetermined time intervals, Equipped with, A communication system that establishes a P2P connection by causing hole punching in at least one of the first NAT router and the second NAT router by sending the aforementioned packets to each other.

6. A communication device that connects to a network via a NAT router and establishes a P2P connection with other terminal devices that it communicates with, A communication information acquisition unit that acquires the global IP address and public key of the aforementioned other terminal device, A port number calculation unit calculates a port number common to the other terminal device by performing a predetermined operation on an input value that includes its own public key and the public key of the other terminal device, A packet transmission unit that repeatedly transmits a first packet, with the source port and destination port set to the calculated port numbers, to the global IP address of the other terminal device at predetermined time intervals, A connection establishment unit that listens for a second packet transmitted from the other terminal device on the port number, determines that the hole punching of the NAT router was successful upon receiving the second packet, and establishes the P2P connection, A communication device equipped with the following features.

7. A program executed by a terminal device that is connected to a network via a NAT router and establishes a P2P connection with other terminal devices that it communicates with, The steps include obtaining the global IP address and public key of the other terminal device, The steps include: calculating a port number common to the other terminal device by performing a predetermined operation on an input value that includes the public key of the user and the public key of the other terminal device; The steps include repeatedly sending packets with the source port and destination port set to the calculated port numbers to the global IP address of the other terminal device at predetermined time intervals, The steps include: waiting for a second packet transmitted from the other terminal device on the port number, determining that the NAT router's hole punching was successful upon receiving the second packet, and establishing the P2P connection; A communication program that includes this.

Images