Communication device, control circuit, storage medium, and communication method

Abstract

A communication device (110) comprises: a data processing unit (111) that uses a public encryption key to conceal data to be transmitted, and uses the public encryption key to unconceal received data; an address detecting unit (113) that detects a change in the address of the host device; and a frame processing unit (112) that performs processing for transmitting and receiving frames in which data are stored and which are used in communication with a counterpart device, and that, when a change in the address of the host device is detected by the address detecting unit (113), performs processing for transmitting a notification frame, which is a frame indicating a change in the transmission source address, to the counterpart device.

Description

Communication device, control circuit, storage medium, and communication method

[0001] The present disclosure relates to a communication device, a control circuit, a storage medium, and a communication method for transmitting and receiving frames.

[0002] With the spread of the Internet, it has become difficult to assign approximately 4.3 billion IPv4 (Internet Protocol version 4) addresses to all computers, terminal devices, etc. Therefore, automatic IP (Internet Protocol) address assignment using DHCP (Dynamic Host Configuration Protocol) has been devised. However, because IP addresses assigned by DHCP change dynamically, a problem has arisen in that the correspondence between a computer (i.e., hostname) and an IP address must be updated every time the IP address changes. To address this problem, Non-Patent Document 1 proposes a technology called DDNS (Dynamic Domain Name System) in which a computer that has been assigned an IP address registers its assigned IP address (i.e., its own IP address), the name of the network it belongs to, and the hostname (FQDN, Fully Qualified Domain Name) in a DNS (Domain Name System), thereby dynamically assigning IP addresses while maintaining a constant hostname.

[0003] P. Vixie et al. “RFC2136 Dynamic Updates in the Domain Name System (DNS UPDATE)” 1997

[0004] However, with the above-mentioned conventional technology, when a change in a global IP address is detected on a terminal device, in order to notify the new global IP address of the terminal device to DNSs that manage domain names in a hierarchical structure, it is necessary to notify each hierarchical DNS, resulting in a time lag of minutes. As a result, during the notification period, the server is unable to detect that the global IP address of the terminal device has changed, and instead sends frames to the previous global IP address, resulting in the problem of being unable to deliver frames to the terminal device with the new global IP address. Furthermore, even if communication with the terminal device is restored, the server still has to perform a session information update process, which increases the processing load, especially when providing services to a large number of terminal devices.

[0005] The present disclosure has been made in view of the above, and aims to provide a communication device that can quickly restore communication with a remote device when a global IP address changes using simple processing.

[0006] In order to solve the above-mentioned problems and achieve the objectives, the communication device of the present disclosure is characterized by comprising a data processing unit that conceals data to be transmitted using a public encryption key and deciphers received data using the public encryption key, an address detection unit that detects changes to the address of the device itself, and a frame processing unit that performs sending and receiving processes for frames in which data is stored and that are used in communication with an opposing device, and that, when the address detection unit detects a change in the address of the device itself, performs processing to send a notification frame, which is a frame indicating a change in the source address, to the opposing device.

[0007] The communication device according to the present disclosure has an effect of being able to quickly restore communication with a remote device in response to a change in a global IP address using simple processing.

[0008] 1 is a diagram showing an example of the configuration of a communication system according to the first embodiment; FIG. 2 is a diagram showing an example of the configuration of an Ethernet (registered trademark) frame transmitted and received between a terminal device and a server according to the first embodiment; FIG. 3 is a diagram showing an example of WireGuard Transport Data Messages stored in Data of an Ethernet frame used in communication between a terminal device and a server according to the first embodiment; FIG. 4 is a diagram showing an example of the configuration of a communication device that is a terminal device and a server according to the first embodiment;

[0009] A communication device, a control circuit, a storage medium, and a communication method according to embodiments of the present disclosure will be described in detail below with reference to the accompanying drawings.

[0010] First Embodiment. FIG. 1 is a diagram illustrating a configuration example of a communication system 100 according to a first embodiment. The communication system 100 is a system in which a terminal device 12, which is a communication device on a mobile network 15 and which has a VPN (Virtual Private Network) function 11 implemented, communicates with a server 14, which is a communication device on a local network 2 and which has the VPN function 11 implemented. In this embodiment, the communication system 100 is described with an IEEE (Institute of Electrical and Electronics Engineers) Ethernet network in mind, but it is not limited to an Ethernet network. In this embodiment, UDP (User Datagram Protocol) is exemplified as a Layer 4 protocol in the OSI (Open Systems Interconnection) reference model defined by ISO (International Organization for Standardization), but other Layer 4 protocols may also be used. In this embodiment, WireGuard is exemplified as an implementation means for Layer 3 L3-VPN technology, but other implementation means may also be used.

[0011] The communication system 100 includes a local network 2, a public network 3, a 4G (4th Generation) wireless link 5-1, a 5G (5th Generation) wireless link 5-2, a wired link 6, a cable network 9, a terminal device 12, a server 14, a mobile network 15, a DDNS server 16, and a DNS server 17. As shown in FIG. 1 , the terminal device 12 is capable of moving along a moving path 4, and is capable of connecting to the 4G wireless link 5-1 via a wireless signal 1 before moving along the moving path 4, and of connecting to the 5G wireless link 5-2 via a wireless signal 1 after moving along the moving path 4. Here, as shown in FIG. 1 , the terminal device 12 has a global IP address X when connected via the 4G wireless link 5-1 and the wireless signal 1, and a global IP address Y when connected via the 5G wireless link 5-2 and the wireless signal 1. A terminal device 12 equipped with a VPN function 11 communicates with a server 14 equipped with the VPN function 11 using Ethernet frames.

[0012] When terminal device 12 starts communication with server 14, it accesses DNS server 17 and queries the global IP address of server 14 using the FQDN of server 14 as a key. Terminal device 12 generates and transmits an Ethernet frame using the obtained global IP address of server 14 as the destination IP address of the Ethernet frame and the global IP address (X) of its own device, i.e., terminal device 12, as the source IP address of the Ethernet frame. The Ethernet frame transmitted from terminal device 12 is transmitted to 4G wireless line 5-1 via wireless signal 1, transmitted from mobile network 15 to public network 3 via wired line 6, transmitted to cable network 9 using the destination IP address, and received by server 14 on local network 2 connected to wired line 6 via termination device 19. Note that the Ethernet frame transmitted from server 14 is received by terminal device 12 in the reverse order of the above. In the following description, the destination IP address may be simply referred to as the destination address, the source IP address may be simply referred to as the source address, and the Ethernet frame may be simply referred to as the frame.

[0013] When the terminal device 12 moves from the communication area of ​​the 4G wireless line 5-1 to the communication area of ​​the 5G wireless line 5-2, for example by moving along the travel route 4, the mobile network 15 assigns a new global IP address (Y) to the terminal device 12 by DHCP. The mobile network 15 notifies the DDNS server 16 that the global IP address of the terminal device 12 has changed from X to Y. The DDNS server 16 notifies the DNS server 17 by means of synchronization information 18 that the global IP address of the terminal device 12 has changed from X to Y.

[0014] Here, the configuration of an Ethernet frame transmitted and received between the terminal device 12 and the server 14 will be described. FIG. 2 is a diagram showing an example of the configuration of an Ethernet frame transmitted and received between the terminal device 12 and the server 14 according to the first embodiment. In this embodiment, the Ethernet frame is assumed to be an Ethernet frame 43-1 with a Virtual Local Area Network (VLAN) tag or an Ethernet frame 43-2 without a VLAN tag. However, other frame configurations such as double tagging (Q-in-Q) and MPLS (Multi-Protocol Label Switching) may also be used. The Ethernet frame 43-2 is composed of a Media Access Control (MAC) dst 40-1, a MAC src 40-2, a Type 40-3, a Data 40-4, and a Frame Check Sequence (FCS) 40-5. The Ethernet frame 43-1 with VLAN tag has the same configuration as the Ethernet frame 43-2, but with a VLAN tag 40-6 added.

[0015] The VLANTag 40-6 is composed of a Tag Protocol IDentifier (TPID) 45-1, a Priority Code Point (PCP) 45-2, a Canonical Format Indicator (CFI) 45-3, and a VLAN IDentifier (VID) 45-4. The Data 40-4 is composed of an IPv4 header 41, a UDP header 42, and Data 44. The IPv4 header 41 includes IPsrc 41-1, which is the aforementioned source IP address, IPdst 41-2, which is the aforementioned destination IP address, Proto 41-3, ToS (Type of Service) 41-4, etc. The UDP header 42 includes UDPsport 42-1, UDPdport 42-2, Length 42-3, and Checksum 42-4. In Data 44, for example, if WireGuard, which is a VPN technology, is used, TransportDataMessages 51 are stored.

[0016] 3 is a diagram showing an example of WireGuard TransportDataMessages 51 stored in Data 44 of Ethernet frames 43-1 and 43-2 used in communication between terminal device 12 and server 14 according to the first embodiment. TransportDataMessages 51 is composed of type 51-1, reserved 51-2, receiver 51-3, counter 51-4, and packet 51-5. Type 51-1 is set to "4," indicating "TransportDataMessages." Packet 51-5 is an area in which data made confidential by terminal device 12 or server 14 is stored.

[0017] Next, the configuration of the communication devices that are the terminal device 12 and the server 14 will be described. Fig. 4 is a diagram showing an example configuration of a communication device 110 that is the terminal device 12 and the server 14 according to the first embodiment. The communication device 110 includes a data processing unit 111, a frame processing unit 112, an address detection unit 113, and a communication unit 114. Note that the communication device 110 shown in Fig. 4 shows the configuration required for the terminal device 12 and the server 14 to perform the operations characteristic of this embodiment, and may also include other configurations required for the terminal device 12 and the server 14.

[0018] The data processing unit 111 encrypts data to be transmitted using a public encryption key and decrypts received data using the public encryption key. The VPN function 11 implemented in the terminal device 12 and the server 14 corresponds to the data processing unit 111. In other words, the data processing unit 111 encrypts data to be transmitted and decrypts received data using VPN technology.

[0019] The frame processing unit 112 performs transmission and reception processing of frames in which data is stored and which are used in communications with an opposing device. The frames that are the subject of transmission and reception processing in the frame processing unit 112 are the above-mentioned Ethernet frames 43-1 and 43-2. ​​The opposing device is the communication device 110 with which the terminal device 12 is communicating, and the opposing device for the server 14 is the terminal device 12.

[0020] The address detection unit 113 detects a change in the address of the communication device 110. The address is the global IP address mentioned above. For example, if the communication device 110 is the terminal device 12, the address detection unit 113 detects that the global IP address has changed from X to Y when the terminal device 12 moves along the movement path 4 as shown in FIG. 1 .

[0021] The communication unit 114 actually transmits and receives the above-mentioned frame, Ethernet frame 43-1 or Ethernet frame 43-2, to and from the other device. The communication unit 114 may be dedicated to wireless communication, dedicated to wired communication, or capable of both wireless and wired communication, depending on the type and application of the communication device 110. Furthermore, the communication device 110 may be provided with multiple communication units 114.

[0022] In addition, the communication device 110 may have the same functions for each component shown in Figure 4 regardless of the type, purpose, etc. of the terminal device 12, server 14, etc., or the functions of each component shown in Figure 4 may differ slightly depending on the type, purpose, etc. of the terminal device 12, server 14, etc.

[0023] Next, the operation when the terminal device 12, which is the communication device 110, and the server 14, which is also the communication device 110, communicate will be described. As mentioned above, the description will be made using an example in which WireGuard is used as the VPN technology. FIG. 5 is a sequence diagram showing, as a comparative example, the communication operation when the terminal device 12 and the server 14 do not perform the operations characteristic of this embodiment. The terminal device 12 first connects to the 4G wireless line 5-1. After the terminal device 12 and the server 14 share their respective public encryption keys using some means, a local IP address is assigned via DHCP (step S101). The terminal device 12, which has a global IP address (X), queries the DNS server 17 for the global IP address of the server 14 based on the FQDN of the server 14 and obtains the global IP address of the server 14 from the DNS server 17.

[0024] The terminal device 12 executes the VPN function 11, that is, the data processing unit 111 conceals the data, and the communication unit 114 transmits the Handshake Initiation 67, which is the Ethernet frame 43-1 or 43-2 generated by the frame processing unit 112, to the server 14 (step S102).

[0025] The server 14 receives the Handshake Initiation 67 at the communication unit 114, processes the Ethernet frame 43-1 or 43-2 that is the Handshake Initiation 67 at the frame processing unit 112, and when the VPN function 11 is executed, i.e., the data processing unit 111 authenticates, it sends a Handshake Response 68 to the terminal device 12 in response to the Handshake Initiation 67 (step S103).

[0026] When the terminal device 12 that received the Handshake Response 68 confirms that it has been authenticated by the server 14, VPN communication is established between the terminal device 12 and the server 14, and user data is exchanged. Specifically, as shown in Fig. 5, the server 14 transmits "from server to terminal (X) 61-1 to 61-20" to the terminal device 12, which has the global IP address (X) (step S104). At this time, the data transmitted from the server 14 to the terminal device 12 is encrypted and stored in packet 51-5 of TransportDataMessages 51 shown in Fig. 3, and TransportDataMessages 51 is stored in Data 44 shown in Fig. 2, encapsulated in Ethernet frame 43-1 or Ethernet frame 43-2, and transmitted.

[0027] The terminal device 12, which has the global IP address (X), transmits a "from terminal (X) to servers 62-1 to 62-10" message to the server 14 (step S105). At this time, the data transmitted from the terminal device 12 to the server 14 is transmitted in the same format as the data transmitted from the server 14 to the terminal device 12 described above.

[0028] Here, as the terminal device 12 moves along the travel route 4, a line switch (4G → 5G) 64 occurs (step S106). Specifically, the connection destination of the terminal device 12 is changed from the 4G wireless line 5-1 to the 5G wireless line 5-2, and therefore the global IP address of the terminal device 12 is changed from X to Y in accordance with the change in wireless line.

[0029] As a comparative example, in a case where the characteristic operation of this embodiment is not performed, the mobile network 15 that manages the 4G wireless line 5-1 and the 5G wireless line 5-2, or the terminal device 12, notifies the DDNS server 16 to which the terminal device 12 has a contract of a change in the global IP address linked to the FQDN linked to the terminal device 12. The DDNS server 16 that receives the notification of the change in the global IP address of the terminal device 12 notifies the DNS server 17 of the change in the global IP address of the terminal device 12 as synchronization information 18. However, because the DNS servers 17 are distributed all over the world and are managed hierarchically, there is a time lag of minutes before the change in the global IP address is notified to the DNS server 17. As a result, it takes time to restore communication from the server 14 to the terminal device 12, and session information update processing occurs every time the global IP address of the terminal device 12 is changed on the server 14, which causes problems such as an increase in processing load on the server 14 and delays in restoring data transmission between the terminal device 12 and the server 14.

[0030] 5, the server 14 cannot detect the change in the global IP address of the terminal device 12, and therefore transmits the "from server to terminal (X) 61-21" to the terminal device 12 as the global IP address (X) (step S107). However, the terminal device 12 connected to the 5G wireless line 5-2, i.e., whose global IP address has changed from X to Y, cannot receive the "from server to terminal (X) 61-21" from the server 14 (step S108).

[0031] Here, assuming that the global IP address of server 14 is substantially fixed unless there are administrative controls or restrictions, in response to a query from terminal device 12 to DNS server 17 about the global IP address of server 14, the reply from DNS server 17 to terminal device 12 will be that the association between the FQDN and the global IP address of server 14 will remain unchanged. Therefore, after terminal device 12 and server 14 exchange public encryption keys, server 14 subsequently authenticates the public encryption key of terminal device 12 connected to server 14 via VPN function 11, and server 14 assigns a local IP address to terminal device 12 using DHCP. By encapsulating communication between terminal device 12 and server 14 using VPN function 11, terminal device 12 and server 14 can prevent the IP address of the encapsulated packet from changing, eliminating the need for session information update processing in server 14. Note that encapsulating a packet means storing the packet in packet 51-5 of TransportDataMessages 51 shown in FIG.

[0032] In this embodiment, after a line switch (4G → 5G) 64 occurs due to movement along the movement route 4, i.e., after step S106, the terminal device 12 uses the global IP address (Y) to send a from-terminal (Y) to-server notification 63 to the server 14, which is a notification indicating that the global IP address has been changed from X to Y. This allows the server 14 to detect that the global IP address of the terminal device 12 has been changed from X to Y.

[0033] 6 is a sequence diagram showing communication operations when the terminal device 12 and the server 14 according to the first embodiment perform operations characteristic of this embodiment. In FIG. 6, the operations from step S101 to step S106 are the same as the operations from step S101 to step S106 shown in FIG. 5. When the terminal device 12 moves along the moving route 4, a line switch (4G to 5G) 64 occurs and the global IP address changes from X to Y, i.e., after step S106, the terminal device 12 transmits a "from-terminal (Y) to server notification 63" indicating that the global IP address has changed from X to Y to the server 14 (step S111). That is, when the address detection unit 113 detects a change in the global IP address of the terminal device 12, the frame processing unit 112 performs processing to transmit a notification frame indicating a change in the source IP address, i.e., the "from-terminal (Y) to server notification 63," to the server 14, which is the opposite device. The format of the from-terminal (Y) to server notification 63 may be based on, for example, the format of the TransportDataMessages 51 shown in FIG. 3, or may be based on another format.

[0034] Upon receiving the from-terminal (Y) to server notification 63, the server 14 can recognize, as a result of authenticating the public encryption key, that the from-terminal (Y) to server notification 63 is a message sent from the terminal device 12, and can also detect that the global IP address of the terminal device 12 has changed from X to Y. Therefore, in the server 14, when the frame processing unit 112 receives the from-terminal (Y) to server notification 63, a notification frame indicating a change in the source IP address of the opposite device, from the opposite device, the terminal device 12, the frame processing unit 112 performs processing to transmit an Ethernet frame 43-1 or an Ethernet frame 43-2 to the changed source IP address. As a result, the server 14 can continue communication with the terminal device 12 by using the global IP address (Y) as the destination IP address for subsequent communications addressed to the terminal device 12. Specifically, as shown in FIG. 6, the server 14 detects the change in the global IP address of the terminal device 12, and therefore transmits "from server to terminal (Y) 61-31" to the terminal device 12 as the global IP address (Y) (step S112).

[0035] Next, the hardware configuration of the communication device 110 will be described. In the communication device 110, the communication unit 114 is a communication interface. The communication interface may vary depending on the communication device 110. For example, in the communication device 110, the communication interface may be a communication interface for wired communication or a communication interface for wireless communication. Furthermore, if the communication device 110 has multiple communication interfaces, all of the communication interfaces may be communication interfaces for wired communication, all may be communication interfaces for wireless communication, or some may be communication interfaces for wired communication and the rest may be communication interfaces for wireless communication. In the communication device 110, the data processing unit 111, frame processing unit 112, and address detection unit 113 are realized by processing circuits. The processing circuit may be a processor and memory that executes a program stored in memory, or may be dedicated hardware. The processing circuit is also called a control circuit.

[0036] FIG. 7 is a diagram illustrating an example of the configuration of a processing circuit 90 that implements the communication device 110 according to the first embodiment, where the processing circuit is configured with a processor 91 and a memory 92. The processing circuit 90 illustrated in FIG. 7 is a control circuit and includes a processor 91 and a memory 92. When the processing circuit 90 is configured with the processor 91 and the memory 92, each function of the processing circuit 90 is implemented by software, firmware, or a combination of software and firmware. The software or firmware is written as a program and stored in the memory 92. The processing circuit 90 implements each function by having the processor 91 read and execute the program stored in the memory 92. That is, the processing circuit 90 includes the memory 92 for storing a program that results in the processing of the communication device 110 being executed. This program can also be said to be a program that causes the communication device 110 to execute each function implemented by the processing circuit 90. This program may be provided by a storage medium on which the program is stored, or by other means such as a communication medium.

[0037] The above program can also be said to be a program that causes communication device 110 to execute the following steps: a data processing step in which data processing unit 111 conceals data to be transmitted using a public encryption key and deciphers received data using the public encryption key; an address detection step in which address detection unit 113 detects a change in the address of the device itself; and a frame processing step in which frame processing unit 112 performs processing to send and receive frames in which data is stored and which are used in communications with an opposing device, and, when address detection unit 113 detects a change in the address of the device itself, performs processing to send a notification frame, which is a frame indicating a change in the source address, to the opposing device.

[0038] Here, the processor 91 is, for example, a CPU (Central Processing Unit), a processing device, an arithmetic unit, a microprocessor, a microcomputer, or a DSP (Digital Signal Processor), etc. The memory 92 is, for example, a non-volatile or volatile semiconductor memory such as a RAM (Random Access Memory), a ROM (Read Only Memory), a flash memory, an EPROM (Erasable Programmable ROM), or an EEPROM (Electrically EPROM), a magnetic disk, a flexible disk, an optical disk, a compact disk, a minidisk, or a DVD (Digital Versatile Disc).

[0039] FIG. 8 is a diagram illustrating an example of a processing circuit 93 that implements the communication device 110 according to the first embodiment when the processing circuit is configured with dedicated hardware. The processing circuit 93 illustrated in FIG. 8 corresponds to, for example, a single circuit, a composite circuit, a programmed processor, a parallel programmed processor, an ASIC (Application Specific Integrated Circuit), an FPGA (Field Programmable Gate Array), or a combination thereof. The processing circuit may be partially implemented with dedicated hardware and partially implemented with software or firmware. In this way, the processing circuit can implement each of the above-described functions using dedicated hardware, software, firmware, or a combination thereof.

[0040] The communication device 110 may have a panel portion, a display device, storage, and the like as a hardware configuration depending on the type of the terminal device 12, the server 14, or the like.

[0041] As described above, according to the present embodiment, when the terminal device 12 changes its global IP address due to movement or the like, it transmits a message to the server 14 notifying that its global IP address has changed, such as a "from terminal (Y) to server notification 63" in the above example. This allows the server 14 to recognize that the global IP address of the terminal device 12 has changed and the new global IP address of the terminal device 12. This allows the server 14 to maintain a communication path between the terminal device 12 and the server 14 through simple processing and quickly restore communication between the terminal device 12 and the server 14. Furthermore, by performing communication between the terminal device 12 and the server 14 using a VPN, the processing load on the server 14, such as session information update processing, can be reduced even when the global IP address of the terminal device 12 has changed.

[0042] Embodiment 2. In the first embodiment, the terminal device 12 whose global IP address has been changed transmits a "from-terminal (Y) to server" notification 63 to the server 14 to notify the server 14 that the global IP address has been changed. However, it is possible that the server 14 has transmitted a "from-server to terminal (X) 61-21" message before receiving the "from-terminal (Y) to server" notification 63 from the terminal device 12. In such a case, the server 14 is unable to determine how much data has been received by the terminal device 12 and from which data has not been received. Therefore, in the second embodiment, a case will be described in which, when the terminal device 12 changes its global IP address, the terminal device 12 transmits a notification indicating that the global IP address has been changed to the server 14, including information indicating how much data has been received.

[0043] In the second embodiment, the configurations of the communication system 100 and the communication device 110 are the same as those of the communication system 100 and the communication device 110 in the first embodiment. Fig. 9 is a sequence diagram showing a communication operation when the terminal device 12 and the server 14 according to the second embodiment perform an operation characteristic of this embodiment. In Fig. 9, the operations from step S101 to step S108 are the same as the operations from step S101 to step S108 shown in Fig. 5.

[0044] When the terminal device 12 moves along the moving route 4, a line switch (4G → 5G) 64 occurs and the global IP address changes from X to Y, i.e., after step S106, the terminal device 12 transmits a from-terminal (Y) to server notification 73 to the server 14, which is a notification indicating that the global IP address has changed from X to Y and that reception has been completed up to the from-server to the terminal (X) 61-20 (step S201). The from-terminal (Y) to server notification 73 is the from-terminal (Y) to server notification 63 to which information indicating that the terminal device 12 has received up to the from-server to the terminal (X) 61-20 has been added. That is, in the terminal device 12, the frame processing unit 112 performs processing to include a counter value indicating the number of frames received from the server 14, which is the opposite device, in a notification frame and transmit the notification frame to the server 14, which is the opposite device. The counter value is "1" for "from server to terminal (X) 61-1", "20" for "from server to terminal (X) 61-20", and so on.

[0045] Upon receiving the From-Terminal (Y) to Server Notification 73, the server 14 can recognize, as a result of public encryption key authentication, that the From-Terminal (Y) to Server Notification 73 is a message sent from the terminal device 12, and can detect that the global IP address of the terminal device 12 has changed from X to Y. Furthermore, the server 14 can determine that the terminal device 12 successfully received the data from the From-Server to Terminal (X) 61-20 but was unable to receive the data from the From-Server to Terminal (X) 61-21. Therefore, when the frame processing unit 112 of the server 14 receives the From-Terminal (Y) to Server Notification 73, which is a notification frame including a counter value indicating the number of frames received by the terminal device 12, the server 14 performs processing to transmit the frame to be sent next after the frame indicated by the counter value to the changed source IP address. This allows the server 14 to continue communication with the terminal device 12 by using the global IP address (Y) as the destination IP address for subsequent communications to the terminal device 12. 9, the server 14 detects the change in the global IP address of the terminal device 12, and therefore transmits "from server to terminal (Y) 74-21" to the terminal device 12 as the global IP address (Y) (step S202). Although the "from server to terminal (Y) 74-21" and "from server to terminal (X) 61-21" have different global IP addresses of the terminal device 12 as destinations, the stored data is the same.

[0046] As described above, according to this embodiment, when the terminal device 12 changes its global IP address, the terminal device 12 includes information on the count value indicating the data that has been successfully received in a message for notifying the server 14 that the global IP address has been changed, and transmits this information to the server 14 in the above-mentioned example as the from-terminal (Y) to-server notification 73. This allows the server 14 to recognize that the global IP address of the terminal device 12 has been changed and the new global IP address of the terminal device 12, as well as to grasp the data that has been successfully received by the terminal device 12. Therefore, the same effects as in the first embodiment can be obtained, and when restoring communication between the terminal device 12 and the server 14, communication can be restored from the middle of data transmission.

[0047] Embodiment 3 In embodiment 3, a case will be described in which the server 14 performs filtering using the global IP address of the terminal device 12 as a filtering condition. Note that embodiment 3 will be described taking as an example a case in which it is applied to embodiment 1, but it can also be applied to embodiment 2.

[0048] In the third embodiment, the configurations of the communication system 100 and the communication device 110 are the same as those of the communication system 100 and the communication device 110 in the first embodiment. Fig. 10 is a sequence diagram showing a communication operation when the terminal device 12 and the server 14 according to the third embodiment perform an operation characteristic of the present embodiment. In Fig. 10, the operations from step S101 to step S106 and step S111 to step S112 are the same as the operations from step S101 to step S106 and step S111 to step S112 shown in Fig. 6.

[0049] Since the server 14 recognizes that the global IP address of the terminal device 12 is X when communication with the terminal device 12 is initiated, the server 14 generates a filter (global IP address == X) 85-1 for determining whether IPsrc 41-1 included in the Ethernet frame 43-1 or the Ethernet frame 43-2 shown in Fig. 2 for a frame received via VPN communication is X, based on the global IP address (X) of the terminal device 12. Based on the filter (global IP address == X) 85-1, the server 14 determines that the received frame has been received normally if IPsrc 41-1 of the received frame is X, and discards the frame if IPsrc 41-1 of the received frame is other than X, and performs other operations predetermined by the operator of the server 14 or the communication system 100.

[0050] Here, when server 14 receives from-terminal (Y) to server notification 63 from terminal device 12 following line switching (4G → 5G) 64, server 14 recognizes that the global IP address of terminal device 12 has changed from X to Y, and therefore changes filter (global IP address == X) 85-1 to filter (global IP address == Y) 85-2. That is, in server 14, frame processing unit 112 sets the changed source IP address indicated in the notification frame, from-terminal (Y) to server notification 63, as a new filter condition. As a result, after changing the filter conditions, if the server 14 receives a spoofed message from the terminal device 12, "From Terminal (X) to Server 82-10," which is a message that has been transmitted from the spoofed terminal device 81 by simulating the "From Terminal (X) to Server 62-10" in some way (step S301), the server 14 can determine that the "From Terminal (X) to Server 82-10" message is a spoofed message because the IPsrc 41-1 of the "From Terminal (X) to Server 82-10" is X. This allows the server 14 to prevent service disruptions that would prevent prompt communication recovery. For example, if the IPsrc 41-1 of the received frame is X, the server 14 discards the frame (step S302).

[0051] As described above, according to this embodiment, the server 14 performs filtering using the global IP address of the terminal device 12 as a filtering condition, and when the global IP address of the terminal device 12 is changed, the server 14 performs filtering by changing the filtering condition to the new global IP address of the terminal device 12. This allows the server 14 to prevent service disruptions that hinder rapid communication recovery.

[0052] The configurations shown in the above embodiments are merely examples, and may be combined with other known technologies, or different embodiments may be combined with each other. It is also possible to omit or modify parts of the configurations as long as they do not deviate from the gist of the invention.

[0053] 1 Wireless signal, 2 Local network, 3 Public network, 4 Travel route, 5-1 4G wireless line, 5-2 5G wireless line, 6 Wired line, 9 Cable network, 11 VPN function, 12 Terminal device, 14 Server, 15 Mobile network, 16 DDNS server, 17 DNS server, 18 Synchronization information, 19 Termination device, 40-1 MACdst, 40-2 MACsrc, 40-3 Type, 40-4 Data, 40-5 FCS, 40-6 VLANTag, 41 IPv4 header, 41-1 IPsrc, 41-2 IPdst, 41-3 Proto, 41-4 ToS, 42 UDP header, 42-1 UDPsport, 42-2 UDP port, 42-3 Length, 42-4 Checksum, 43-1, 43-2 Ethernet frame, 44 Data, 45-1 TPID, 45-2 PCP, 45-3 CFI, 45-4 VID, 51 TransportDataMessages, 51-1 type, 51-2 reserved, 51-3 receiver, 51-4 counter, 51-5 packet, 61-1 to 61-21 from server to terminal (X), 61-31 from server to terminal (Y), 62-1 to 62-10 from terminal (X) to server, 63 from terminal (Y) to server notification, 64 Line switching (4G → 5G), 67 Handshake Initiation, 68 Handshake Response, 73 from terminal (Y) to server notification, 74-21 from server to terminal (Y), 81 spoofing terminal device, 82-10 from terminal (X) to server, 85-1 filter (global IP address == X), 85-2 filter (global IP address == Y), 90, 93 processing circuit, 91 processor, 92 memory, 100 communication system, 110 communication device, 111 data processing unit, 112 frame processing unit, 113 address detection unit, 114 communication unit.

Claims

1. a data processing unit that encrypts data to be transmitted using a public encryption key and decrypts received data using the public encryption key; an address detection unit that detects a change in the address of the device itself; a frame processing unit that performs a process of transmitting and receiving the frame in which the data is stored and that is used in communication with an opposing device, and that, when the address detection unit detects a change in the address of the own device, performs a process of transmitting a notification frame, which is the frame indicating a change in the source address, to the opposing device; A communication device comprising:

2. the data processing unit conceals the data to be transmitted and deconceals the received data using a Virtual Private Network technology; 2. The communication device according to claim 1.

3. the frame processing unit, when receiving from the opposite device a notification frame that indicates a change in the source address of the opposite device, performs a process of transmitting the frame to the changed source address.

2. The communication device according to claim 1.

4. the frame processing unit performs processing to include a counter value indicating the number of frames received from the opposite device in the notification frame and transmit the notification frame to the opposite device.

3. The communication device according to claim 1 or 2.

5. when the frame processing unit receives the notification frame from the opposite device, the notification frame including a counter value indicating the number of frames received by the opposite device, the frame processing unit performs a process of transmitting a frame to be transmitted next to the frame indicated by the counter value to the changed source address.

4. The communication device according to claim 3.

6. the frame processing unit sets the changed source address indicated in the notification frame as a new filter condition.

6. The communication device according to claim 3 or 5.

7. A control circuit for controlling a communication device, comprising: The data to be transmitted is concealed using a public encryption key, and the received data is deconcealed using the public encryption key; Detects changes to the device's address, a process of transmitting and receiving the frame in which the data is stored and used in communication with an opposing device, and, when a change in the address of the own device is detected, transmitting a notification frame indicating a change in the source address to the opposing device; a control circuit for causing the communication device to perform the above-mentioned steps.

8. A storage medium storing a program for controlling a communication device, The program The data to be transmitted is concealed using a public encryption key, and the received data is deconcealed using the public encryption key; Detects changes to the device's address, a process of transmitting and receiving the frame in which the data is stored and used in communication with an opposing device, and, when a change in the address of the own device is detected, transmitting a notification frame indicating a change in the source address to the opposing device; A storage medium that causes the communication device to perform the above.

9. a data processing step in which a data processing unit conceals data to be transmitted using a public encryption key and deciphers received data using the public encryption key; an address detection step in which an address detection unit detects a change in the address of the own device; a frame processing step in which a frame processing unit performs a process of transmitting and receiving the frame in which the data is stored and which is used in communication with an opposing device, and when the address detection unit detects a change in the address of the own device, performs a process of transmitting a notification frame, which is the frame indicating a change in the source address, to the opposing device; A communication method comprising: