Address management device, address management system, and address management method

Abstract

An address management device (100) comprises: an address inventory management unit (110) that manages completed payouts and pending payouts, for each address in a subnet allocated to each terminal group (11, 12) and server group (21, 22); an address payout unit (120) that, triggered by an inquiry about an address from a terminal (1) or a server (2), makes a request to the address inventory management unit (110) for an address payout, together with identifiers for the terminal and the server and information about the sites to which the terminal and the server are connected; and a gateway setting management unit (130) that, for a subnet to be added to or deleted from a route advertisement notified from the address inventory management unit (110), adds or deletes a route advertisement setting with respect to gateways (3, 4) for sites included in the notification .

Description

Address management device, address management system and address management method

[0001] The present invention relates to an address management device, an address management system, and an address management method.

[0002] In a secure closed network spanning multiple bases, policy control for communications, such as permission / denial of communications and communication rate restrictions, may be performed for the purpose of ensuring security and communication quality according to the type of terminal and server. This policy control is often applied at the gateway (GW) of each base that bundles communications between bases, in order to simplify operations such as setting confirmation by consolidating the setting points. It is assumed that terminals at each base will connect from under another base due to movement, and in such cases, policy control according to the terminal group to which the terminal belongs is applied at the GW of each base.

[0003] 9 is a diagram showing an address management system S that aggregates policies for gateways installed at bases in a secure closed network spanning multiple bases and assigns addresses to mobile terminals for that purpose. The address management system S shown in FIG. 9 includes a terminal group 11 (terminal group <1>) that is, for example, an Internet of Things (IoT) device and is made up of multiple mobile terminals (hereinafter referred to as terminals) 1 that can move between user bases 31 to 33 (user bases <1> to <3>), and a terminal group 12 (terminal group <2>) that is, for example, a business device and is made up of multiple terminals 1 that can move between user bases 31 to 33 (user bases <1> to <3>). The terminal groups 11 and 12 refer to a group of terminals to which the same communication control policy (communication control such as communication permission / prohibition and communication rate limiting) is applied.

[0004] The address management system S includes a server group 21 (server group <1>), which is, for example, an IoT management system, and a server group 22 (server group <2>), which is, for example, a business system, each of which is composed of a plurality of servers 2 installed at a cloud base 41. The servers 2 include not only physical servers but also virtual machines and containers. The server groups 21 and 22 refer to a group of servers 2 to which the same communication control policy (communication control such as permission or denial of communication and communication rate restrictions) is applied.

[0005] The address management system S includes a GW3 on the user base side that bundles communications between user bases 31 to 33 (user bases <1> to <3>) in the direction of the arrow in Fig. 9 and connects to an inter-base VPN 52 of a wide area network (NW) 51, and a GW4 on the cloud base side that bundles communications with a cloud base 41 in the direction of the arrow in Fig. 9 and connects to an inter-base VPN (Virtual Private Network) 52 of the wide area NW 51. Within the inter-base VPN 52 shown in Fig. 9, a route 53 connecting the GW3 and GW4 of each base is shown in accordance with policy control (Fig. 10).

[0006] FIG. 10 is a table showing an example of the communication control policy 60 for the base-to-base VPN 52 of FIG. 9 . The communication control policy 60 of FIG. 10 stores keys associating source terminal groups with destination server groups, and actions for each key. For example, when the source terminal group <1> and the destination server group <1> are keys, the action is "permit communication with communication rate limit." Also, when the source terminal group <2> and the destination server group <1> are keys, when the source terminal group <2> and the destination server group <2> are keys, and when the source terminal group <2> and the destination terminal group <2> are keys, the action is "permit communication" in all cases. That is, in the case of the source terminal group <1>, the action is "permit communication with communication rate limit" only for the destination server group <1>. In the case of the source terminal group <2>, the action of only the destination terminal group <1> is "communication not permitted", and in the case of other destinations, the action is "communication permitted".

[0007] In this way, the address management system S assumes that the terminal 1 at each user base moves and connects from under another base. The address management system S applies policy control to the GWs 3 and 4 at each base according to the communication control policy 60 (FIG. 10) according to the terminal group 11 or 12 to which the terminal 1 belongs.

[0008] Non-Patent Document 1 describes a method for reducing the amount of communication control policy settings in an address management system that manages addresses assigned to terminals by aggregating the IP (Internet Protocol) address ranges of each terminal group by performing the following operations:

[0009] FIG. 11 shows an example in which the technique of Non-Patent Document 1 is applied to the address management system S shown in FIG. 9 . Components identical to those in FIG. 9 are assigned the same reference numerals. The address management system S shown in FIG. 11 includes an address management device 70. As indicated by the dashed arrows in FIG. 11 , the address management device 70 assigns addresses corresponding to the terminal groups 11 and 12 and the server groups 21 and 22. More specifically, when issuing an authentication request or assigning an address when connecting the terminal 1 or the server 2 to the network, the address management device 70 determines the terminal group 11 or 12 and the server group 21 or 22 to which the terminal 1 or the server 2 belongs based on the identifier (e.g., MAC address) of the terminal 1 or the server 2, and assigns an address from the allocation range of the corresponding terminal group 11 or 12 and server group 21 or 22.

[0010] The address management device 70 increases or decreases the addresses assigned to each terminal group in a contiguous range from within the subnet (network range) assigned to each base when the number of terminals increases or decreases. Here, network communications are managed not only by IP addresses but also by communications between networks, and actual networks are managed by subdividing them using subnet masks. A network range (subnet) is specified by combining an IP address and a subnet mask (for example, " / 1" to " / 32" in the case of IPv4). The subnet mask is used to define the network range. Note that the first address is the network address (start IP), and the last address is the broadcast address (end IP), and cannot be used. The host address is a usable IP.

[0011] When address duplication occurs between terminals, the address management device 70 releases and reallocates the address of the terminal.

[0012] Figure 12 is a diagram illustrating how subnets assigned to user locations are used by the address management device 70 of Figure 11. The box 80 in Figure 12 shows an image of a group of subnets such as " / 24." The subnet 80 has a terminal group <1> allocation range 81 and a terminal group <2> allocation range 82. The address management device 70 (Figure 11) (1) increases or decreases the addresses assigned to each terminal group in a continuous range (hereinafter referred to as "address range" as appropriate) in accordance with an increase or decrease in the number of terminals, as shown by the open two-way arrows in Figure 12.

[0013] (2) When the allocation range for a terminal group is increased due to an increase in terminals, if the range overlaps with the range of another terminal group (symbol a in FIG. 12), the address management device 70 releases the address of the allocated terminal (recovers the allocated address) and then allocates it to a terminal in the new terminal group. In the example of FIG. 12, the address allocation of a terminal with an address in the lower row of terminal group <2> is released and then allocated to a terminal in terminal group <1>.

[0014] As described above, by the above (1) and (2), even if the number of terminals at each base increases or decreases, the addresses of each terminal group become a continuous range, and aggregation by subnet mask becomes possible.

[0015] In this way, the address management system S of Figure 12 can aggregate the IP address ranges of each terminal group and reduce the amount of communication control policy settings by having the address management device 70 perform the operations (1) and (2) above.

[0016] Masahide Aikawa and Takashi Imaizumi, "Proposal of an Aggregatable Address Allocation Method Using ALC," Proceedings of the Forum on Information Science and Technology, Sep. 2012

[0017] As described above, in the prior art, in order to reduce the amount of communication control policy settings at the GW, a technology has been proposed in which (1) the addresses assigned to a group of terminals (IoT devices, business terminals, etc.) are increased or decreased in a contiguous range from the subnet assigned to the base when the number of terminals increases or decreases, and (2) when address duplication occurs between groups of terminals, the addresses are released and reallocated.

[0018] However, the above (1) and (2) have the following problems. Problem (1) will be explained in detail with reference to FIG. 12. In the prior art, the allocation range of each terminal group is divided into multiple subnets even when the addresses are consecutive. In FIG. 12, even when the addresses are consecutive, they are divided into subnets for terminal group <1> allocation range 81 and terminal group <2> allocation range 82. For example, addresses 192.168.0.0 to 192.168.0.100 are consecutive addresses, but even when the addresses are consecutive, they are divided into multiple subnets, resulting in three subnets: 192.168.0.0 / 26 + 192.168.0.64 / 27 + 192.168.0.96 / 30. Because they are divided into multiple subnets, the amount of policy settings increases, resulting in an increase in GW load and a deterioration in transfer performance. Conventional technology does not provide a solution for cases where a network is divided into multiple subnets, and when a network is divided into multiple subnets, the amount of policy settings increases, the processing load on the GW increases, and transfer performance deteriorates.

[0019] Problem (2): When a terminal moves frequently and the allocation range changes frequently (symbol a in FIG. 12), addresses already assigned to the terminal are frequently released, which increases the impact of communication interruptions. In this way, with the conventional technology, when a terminal moves frequently, there is a problem that addresses are frequently released and reassigned, which can have an impact on communication, such as communication interruptions.

[0020] The present invention has been made in view of this background, and an object of the present invention is to reduce the amount of communication control policy settings required for a gateway installed at a base in a secure closed network spanning multiple bases.

[0021] In order to solve the above-mentioned problems, the address management device determines the terminal group and server group to which the terminal or server belongs based on the identifier of the terminal or server when connected to a network, and assigns an address from the allocation range of the relevant terminal group and server group, and is characterized by comprising: an address inventory management unit that manages assigned and unassigned addresses for each address in the subnet assigned to each of the terminal groups and server groups; an address assignment unit that, upon receiving an address inquiry from the terminal or the server, requests the address inventory management unit to assign an address along with the identifiers of the relevant terminal and server and information about the base to which the relevant terminal and server are connected; and a gateway setting management unit that adds or deletes route advertisement settings to the gateway of the base included in the notification for the subnet to which a route advertisement is to be added or deleted, as notified by the address inventory management unit.

[0022] According to the present invention, it is possible to reduce the amount of communication control policy settings for a gateway installed at a base in a secure closed network spanning multiple bases.

[0023] 6 is a diagram showing the schematic configuration of an address management system including an address management device according to an embodiment of the present invention. FIG. 7 is a functional block diagram of the address management device according to an embodiment of the present invention. FIG. 8 is a diagram showing a terminal group <1> subnetwork allocated by an address management device according to an embodiment of the present invention for each terminal group. FIG. 9 is a diagram showing a terminal group <2> subnetwork allocated by an address management device according to an embodiment of the present invention for each terminal group. FIG. 10 is a diagram showing, in the form of a table, an example of a communication control policy set for each GW in the address management system according to an embodiment of the present invention. FIG. 11 is a diagram showing a terminal group subnet management table in the address management system according to an embodiment of the present invention. FIG. 12 is a flowchart of assigned address determination in the address management device according to an embodiment of the present invention. FIG. 13 is a diagram showing details of the route advertisement subnetwork of the GW of each user site when it is determined that there is vacancy in the subnet in steps S2 to S7 of the address determination flowchart of FIG. 6. FIG. 14 is a hardware configuration diagram showing an example of a computer that realizes the functions of the address management device in the address management system according to an embodiment of the present invention. FIG. 15 is a diagram showing an address management system that aggregates policies of GWs installed at sites in a secure closed network spanning sites and assigns addresses to mobile terminals for that purpose. FIG. 16 is a diagram showing, in the form of a table, an example of a communication control policy for the site-to-site VPN of FIG. 10. FIG. 11 is an example in which the technique of Non-Patent Document 1 is applied to the address management system shown in FIG. FIG. 12 is a diagram illustrating an image of use of a subnet assigned to a user site by the address management device of FIG. 11.

[0024] An address management device and the like in a mode for carrying out the present invention (hereinafter referred to as "the present embodiment") will be described below with reference to the drawings. [Overview] Fig. 1 is a schematic configuration diagram of an address management system equipped with an address management device according to an embodiment of the present invention. Components that are the same as those in Fig. 11 are given the same reference numerals. This embodiment is an example of application to an address management system that executes a policy aggregation method in a VPN spanning multiple bases and a method of assigning addresses to mobile terminals for that purpose.

[0025] As shown in FIG. 1, the address management system 1000 comprises a terminal group 11 (terminal group <1>) and a terminal group 12 (terminal group <2>) consisting of a plurality of terminals 1 that can move between user bases 31 to 33 (user bases <1> to <3>), a server group 21 (server group <1>) and a server group 22 (server group <2>) consisting of a plurality of servers 2 installed at a cloud base 41, a GW3 that bundles communications between the user bases 31 to 33 (user bases <1> to <3>) and connects to an inter-base VPN 52 of the wide area network 51, a GW4 that bundles communications at the cloud base 41 and connects to an inter-base VPN (Virtual Private Network) 52 of the wide area network 51, and an address management device 100.

[0026] Terminal 1 is a mobile terminal that can move between user bases 31 to 33 (user bases <1> to <3>). Terminal group 11 (terminal group <1>) is, for example, IoT equipment. Terminal group 12 (terminal group <2>) is, for example, business equipment. Terminal groups 11 and 12 refer to a group of terminals to which the same communication control policy (communication control such as permission / prohibition of communication and communication rate restrictions) is applied.

[0027] The servers 2 include not only physical servers but also virtual machines and containers. The server group 21 (server group <1>) is, for example, an IoT management system. The server group 22 (server group <2>) is, for example, a business system. The server groups 21 and 22 refer to a group of servers 2 to which the same communication control policy (communication control such as permission / denial of communication and communication rate restriction) is applied.

[0028] In the inter-site VPN 52 shown in FIG. 1, a route 53 is shown that connects the GWs 3 and 4 at each site in accordance with policy control (FIG. 4).

[0029] The address management system 1000 comprises GWs 3 and 4 at each base that bundle communications between bases and performs policy control for communications, such as allowing or denying communications and limiting communication rates, depending on the type of terminal 1 and server 2, for a secure closed network spanning multiple bases, and an address management device 100 that aggregates the policies of GWs 3 and 4 and assigns addresses to terminals.

[0030] The address management device 100 sets up subnets for each terminal group or server group. Specifically, when a terminal 1 or server 2 connects to the network and requests authentication or issues an address, the address management device 100 determines the terminal group 11, 12 and server group 21, 22 to which the terminal 1 or server 2 belongs based on the identifier of the terminal 1 or server 2, and assigns an address from the allocation range of the corresponding terminal group 11, 12 and server group 21, 22.

[0031] 2 is a functional block diagram of the address management device 100. The address management device 100 includes an address inventory management unit 110, an address assignment unit 120 that requests assignment of an address of the terminal 1 or the server 2, and a GW setting management unit 130 that manages the route advertisement settings of the GWs 3 and 4.

[0032] <Address inventory management unit 110> The address inventory management unit 110 manages whether each address in the subnet assigned to each terminal group and server group has been assigned or not. In response to an address assignment request from the address assignment unit 120, the address inventory management unit 110 determines the terminal group and server group to which the terminal or server that made the assignment request belongs, returns the unassigned addresses of the subnet of the relevant terminal group and server group, and marks the relevant addresses as assigned. In this case, the returned addresses follow the method shown in Figure 5, which will be described later. After receiving an address return notification from the address assignment unit 120, the address inventory management unit 110 marks the addresses included in the notification as unassigned.

[0033] Specifically, the address inventory management unit 110 notifies the address issuing unit 120 of the user base to which the address has been assigned in the cases of order 3 or order 4 described later in [Address management method for each terminal group in an address management system]. Conversely, when an address issued in the above case of order 3 or order 4 is released, the address inventory management unit 110 notifies the GW setting management unit 130 of the addition or deletion of a subnet for route advertisement and the base where the subnet is set.

[0034] <Address Issuance Unit 120> When the address issuance unit 120 receives an address inquiry from the terminal 1 or the server 2, it requests the address inventory management unit 110 to assign an address, along with the identifiers of the terminal 1 and the server 2 and the base information to which the terminal 1 and the server 2 are connected. The address issuance unit 120 responds to the inquiring terminal 1 and the server 2 with the address returned from the address inventory management unit 110. After receiving an address return notification from the terminal 1 or the server 2, the address issuance unit 120 notifies the address inventory management unit 110 of the returned address.

[0035] The address assignment unit 120 assigns an address to the terminal 1 at each base from a subnet corresponding to the terminal group to which the address belongs, based on the assigned base and priority set for each address.

[0036] <GW Setting Management Unit 130> The GW setting management unit 130 adds or deletes route advertisement settings for the GW of the base included in the notification, for the subnet to which the route advertisement is to be added or deleted, notified by the address inventory management unit 110.

[0037] <Terminal / Server> When the terminal 1 or the server 2 connects to the network, it queries the address management device 100 about the address used by the terminal 1, and communicates using the address provided in response. When the terminal 1 or the server 2 disconnects from the network, it notifies the address management device 100 that the address has been returned.

[0038] <GW> GWs 3 and 4 are assumed to be configured in advance to advertise the communication control policies for the subnets of each terminal group and server group, as well as the subnets assigned to terminals 1 and servers 2 within the base where the GW in question is located, to GWs at other bases using OSPF (Open Shortest Path First), BGP (Border Gateway Protocol), etc.

[0039] The operation of the address management system 1000 and the address management device 100 configured as described above will be described below.

[0040] [Subnet Allocation by Terminal Group] Figures 3A and 3B are diagrams illustrating subnets allocated by the address management device 100 (Figure 1) to each terminal group. Figure 3A shows a subnet 150 for terminal group 11 (terminal group <1>) (Figure 1) allocated by the address management device 100 to each terminal group. In this subnet for terminal group 11 (terminal group <1>), a user location <1> allocation 151, a user location <2> allocation 152, and a user location <3> allocation 153 are set. Figure 3B shows a subnet 160 for terminal group 12 (terminal group <2>) (Figure 1) allocated by the address management device 100 to each terminal group. In this subnet for terminal group 12 (terminal group <2>), a user location <1> allocation 161, a user location <2> allocation 162, and a user location <3> allocation 163 are set.

[0041] The address management device 100 sets up subnets (subnet 150 for terminal group <1>, subnet 160 for terminal group <2>) for each terminal group, in this case terminal group 11 (terminal group <1>) shown in Fig. 3A and terminal group 12 (terminal group <2>) shown in Fig. 3B. Then, the address management device 100 sets up (assigns) the subnets (white double-headed arrows in Fig. 3A).

[0042] The address management device 100 sets the policy for the GWs 3 and 4 in a subnet that aggregates the address ranges for each terminal group. This allows for constant aggregation regardless of whether the number of terminals 1 in the user base increases or decreases.

[0043] [Image of Communication Control Policy Set in Each GW] Figure 4 is a diagram showing, in the form of a table, an example of the communication control policy 170 set in each GW of the address management system 1000. The communication control policy 170 of the address management system 1000 in Figure 4 stores keys that associate the source terminal group subnet with the destination server group and terminal group subnet, and the action for each key. For example, if the source terminal group <1> subnet and the destination server group <1> subnet are the keys, the action is "communication permitted with communication rate limit." Also, if the source terminal group <2> subnet and the destination server group <1> subnet are the keys, if the source terminal group <2> subnet and the destination server group <2> subnet are the keys, or if the source terminal group <2> subnet and the destination terminal group <2> subnet are the keys, the action is "communication permitted" in all cases. That is, in the case of the source subnetwork for terminal group <1>, the action is "communication permitted with communication rate restrictions" only for the destination subnetwork for server group <1>. In the case of the source subnetwork for terminal group <2>, the action is "communication not permitted" only for the destination subnetwork for terminal group <1>, and for other destinations the action is "communication permitted."

[0044] In this way, the address management system 1000 can aggregate settings by using subnets for each terminal group or server group as a key. Since the subnets for terminal groups do not change even if the number of terminals in each base increases, the number of policy settings does not increase.

[0045] [Subnet Management Table for Terminal Group] Fig. 5 is a diagram showing a subnet management table for terminal group in the address management system 1000. Here, the subnet management table 180 for terminal group <1> in the terminal group 11 (terminal group <1>) in Fig. 1 will be described. Note that the subnet management table for terminal group <2> in the terminal group 12 (terminal group <2>) in Fig. 2 has a similar format.

[0046] The address management system 1000 prepares in advance addresses equal to or greater than the number of terminals 1 in each terminal group, assuming that the subnet management table 180 for terminal group <1> in Fig. 5 will be used. The subnet management table 180 for terminal group <1> stores, for each address, the user base (user bases <1> to <3>), priority (high priority / low priority), and allocation status (in use / unused / unused -> used by user base <1>).

[0047] As shown in Figure 1, in terminal group <1> (terminal group 11 in Figure 1), terminal 1 moves between user locations 31 to 33 (user locations <1> to <3>). For this reason, the subnet management table 180 for terminal group <1> sets user locations <1> to <3> for the prepared addresses and manages the allocation status for each of user locations <1> to <3>. In this embodiment, the priority of the user location is also set and reflected in the allocation.

[0048] As shown by arrow b in Figure 5, addresses are assigned to terminals within an allocation site in ascending order of addresses. For example, addresses are assigned to terminal 1 within user site <1> in ascending order of addresses, starting with "192.168.0.1". Similarly, addresses are assigned to terminal 1 within user site <2> in descending order of addresses, starting with "192.168.0.86", and addresses are assigned to terminal 1 within user site <3> in descending order of addresses, starting with "192.168.0.171".

[0049] 5, if there is no imbalance in the number of terminals at each base, the GW at each user base advertises only high-priority subnets. In other words, the GWs 3 and 4 at each base do not add advertised routes in response to an increase or decrease in the number of terminals 1 as long as they are within the high-priority range.

[0050] Now, as shown by symbol d in Figure 5, let us consider a case in which terminal 1 moves, causing terminals 1 of terminal group <1> to concentrate at user location <1>, and all high-priority and low-priority addresses assigned to user location <1> in the address range for terminal group <1> to be in use.

[0051] In this case, the process moves to the arrow e in Figure 5. In the process of arrow e in Figure 5, a search is made for low-priority vacant addresses from among the address ranges assigned to locations other than user location <1>, and allocation is performed. In this case, addresses are allocated in descending order. Since this part of the address range has not originally been advertised by GW3 (Figure 1) at user location <1>, a setting is added to make it a target for route advertisement.

[0052] [Address management method for each terminal group in the address management system] The address management method for each terminal group in the address management system will be described with reference to the subnet management table 180 for terminal group <1> in Fig. 5. The address inventory management unit 110 (Fig. 2) of the address management device 100 sets address ranges with high and low allocation priorities for each user location for addresses for each terminal group, as in the subnet management table 180 for terminal group <1> in Fig. 5.

[0053] <Address Assignment Order> When assigning an address to a terminal 1, the address inventory management unit 110 searches for a vacant address in the following order 1 to 4, and assigns it.

[0054] Step 1: A free address is searched for in the high-priority address range of the user site to which the terminal is connected, and an allocation is performed (see step S2 in the flow of FIG. 6, which will be described later).

[0055] Step 2: A vacant address is searched for in the low-priority address range of the user site to which the terminal is connected, and an allocation is performed (see step S3 in the flow of FIG. 6, which will be described later).

[0056] Step 3: A vacant address is searched for in the low-priority address range of another base, and an allocation is performed (see step S5 in the flow of FIG. 6, which will be described later).

[0057] Step 4: A free address is searched for in the high-priority address range of another base, and an allocation is performed (see step S6 in the flow of FIG. 6, which will be described later).

[0058] <Search Again> When an address reassignment occurs, such as when the terminal is restarted or when the terminal is moved away from the connection location, the address inventory management unit 110 searches for an available address again in the above order 1 to 4. This prevents, as much as possible, a situation in which a discontinuous address range is assigned to one user location, such as in the above order 3 or order 4.

[0059] <Advertisement Route Setting> The address management device 100 sets the advertisement route from the GWs 3 and 4 of each of the user bases 31 to 33 as follows: Basic state: The GWs 3 and 4 are set to advertise the route of the high-priority address range of each user base.

[0060] When the case of the above step 3 occurs: When a low-priority address of another user site is assigned, the GWs 3 and 4 are configured to advertise the route in an address range that aggregates the assigned address.

[0061] If the above case of step 4 occurs: To prevent multiple user locations from advertising overlapping address ranges, configure the following (1) and (2). (1) For GWs 3 and 4 of user locations 31 to 33 to which high-priority addresses of other user locations 31 to 33 have been assigned, configure the system to advertise routes using an address range that aggregates the assigned high-priority addresses. (2) For GWs 3 and 4 of user locations 31 to 33 to which a high-priority address range has been assigned, configure the system to advertise routes using an address range that aggregates addresses excluding the high-priority addresses assigned to other user locations 31 to 33.

[0062] Adjusting the ratio of high priority to low priority: The address management device 100 adjusts the ratio of high priority to low priority according to the frequency of terminal movement for each terminal group, as follows (3) and (4). This suppresses frequent changes to the settings of advertisement routes to GWs 3 and 4 due to the allocation of low priority addresses. (3) If terminal movement is not frequent, the ratio of high priority is increased, and if the terminal movement is slight (terminal movement less than a predetermined amount), an address can be allocated from among the high priority addresses. (4) If terminal movement is frequent, the ratio of high priority is decreased, reducing the frequency of occurrence of the case in order 4 above, in which unused high priority addresses are allocated to another user site, and suppressing the frequency of setting updates for GWs 3 and 4.

[0063] [Flow of Assigned Address Determination in Address Management Device and Route Advertisement Subnet of GW] The flow of assigning address determination in the address management device 100 and the route advertisement subnet of the GW will be described. Fig. 6 is a flowchart of assigning address determination in the address management device 100. Fig. 7 is a diagram showing details of the route advertisement subnet of the GW of each user site when it is determined that there is vacancy in the subnet in steps S2 to S7 of the address determination flowchart in Fig. 6. Note that Figs. 6 and 7 should originally be explained as one figure, but have been divided into two figures due to space constraints.

[0064] 6, in step S1, the address assignment unit 120 (FIG. 2) of the address management device 100 detects that an address assignment request has arrived at the address management device 100 from terminal 1 (FIG. 1) of the terminal group <1> at the user site <1>.

[0065] In step S2, the address issuing unit 120 determines whether or not there is a vacant address in the high-priority subnetwork for user site <1> within the terminal group <1> subnetwork, by referring to the terminal group <1> subnetwork management table 180 in Fig. 5. If there is a vacant address in the high-priority subnetwork for user site <1> within the terminal group <1> subnetwork (S2: Yes), the process proceeds to step S8, and if there is no vacant address in the high-priority subnetwork for user site <1> within the terminal group <1> subnetwork (S2: No), the process proceeds to step S3.

[0066] If there is a vacant high-priority subnet for user site <1> within the terminal group <1> subnet (Yes in S2: arrow A), it becomes the route advertisement subnet of the GW of user site <1> and the GW of user site <2> as shown by arrow A in Figure 7. That is, at the GW of user site <1>, it is the high-priority subnet (a11) for user site <1> of terminal group <1>, and at the GW of user site <2>, it is the high-priority subnet (a21) for user site <2> of terminal group <1>. The above high-priority subnet (a11) for user site <1> of terminal group <1> and the high-priority subnet (a21) for user site <2> of terminal group <1> are the basic state.

[0067] In step S3 of Fig. 6, the address issuing unit 120 determines whether or not there is a vacant address in the low-priority subnetwork for user site <1> within the terminal group <1> subnetwork, by referring to the terminal group <1> subnetwork management table 180 of Fig. 5. If there is a vacant address in the low-priority subnetwork for user site <1> within the terminal group <1> subnetwork (S3: Yes), the process proceeds to step S8, and if there is no vacant address in the low-priority subnetwork for user site <1> within the terminal group <1> subnetwork (S3: No), the process proceeds to step S4.

[0068] If there is a vacant subnet in the low-priority subnet for user site <1> within the terminal group <1> subnet (Yes in S3: arrow B), it becomes the route advertisement subnet of the GW of user site <1> and the GW of user site <2> as shown by arrow B in Figure 7. That is, at the GW of user site <1>, it is a subnet that aggregates addresses already assigned to terminal 1 from the high-priority subnet for user site <1> of terminal group <1> and the low-priority subnet for user site <1> of terminal group <1> (b12). Also, at the GW of user site <2>, it is a high-priority subnet for user site <2> of terminal group <1> (b22).

[0069] In step S4 of Fig. 6, the address issuing unit 120 refers to the terminal group <1> subnet management table 180 of Fig. 5 to determine whether or not there is a vacant address in the low-priority subnet for user site <2> within the terminal group <1> subnet. If there is a vacant address in the low-priority subnet for user site <2> within the terminal group <1> subnet (S4: Yes), the process proceeds to step S8, and if there is no vacant address in the low-priority subnet for user site <2> within the terminal group <1> subnet (S4: No), the process proceeds to step S5.

[0070] If there is a vacant subnet in the low-priority subnet for user site <2> within the terminal group <1> subnet (Yes in S4: arrow C), it becomes the route advertisement subnet of the GW of user site <1> and the GW of user site <2> as shown by arrow C in Figure 7. That is, at the GW of user site <1>, it is a subnet (c13) that aggregates addresses already assigned to terminal 1 from the high-priority subnet for user site <1> of terminal group <1> and the low-priority subnet for user site <2> of terminal group <1>. Also, at the GW of user site <2>, it is a high-priority subnet (c23) for user site <2> of terminal group <1>.

[0071] In step S5 of Fig. 6, the address issuing unit 120 refers to the terminal group <1> subnetwork management table 180 in Fig. 5 to determine whether or not there is a vacant address in the low-priority subnetwork for user site <n (n is any natural number)> in the terminal group <1> subnetwork. If there is a vacant address in the low-priority subnetwork for user site <n> in the terminal group <1> subnetwork (S5: Yes), the process proceeds to step S8, and if there is no vacant address in the low-priority subnetwork for user site <n> in the terminal group <1> subnetwork (S5: No), the process proceeds to step S6.

[0072] If there is a vacant subnet in the low-priority subnet for user site <n> within the terminal group <1> subnet (Yes in S5: arrow D), it becomes the route advertisement subnet of the GW of user site <1> and the GW of user site <2> as shown by arrow D in Figure 7. That is, at the GW of user site <1>, it is a subnet that aggregates addresses already assigned to terminal 1 from the high-priority subnet for user site <1> of terminal group <1> and the low-priority subnet for user site <n> of terminal group <1> (d14). Also, at the GW of user site <2>, it is the high-priority subnet for user site <2> of terminal group <1> (d24).

[0073] In step S6 of Fig. 6, the address issuing unit 120 refers to the terminal group <1> subnet management table 180 of Fig. 5 to determine whether or not there is a vacant address in the high-priority subnet for the user site <2> within the terminal group <1> subnet. If there is a vacant address in the high-priority subnet for the user site <2> within the terminal group <1> subnet (S6: Yes), the process proceeds to step S8, and if there is no vacant address in the high-priority subnet for the user site <2> within the terminal group <1> subnet (S6: No), the process proceeds to step S7.

[0074] If there is a vacant subnet in the high-priority subnet for user site <2> within the terminal group <1> subnet (Yes in S6: arrow E), it becomes the route advertisement subnet of the GW of user site <1> and the GW of user site <2> as shown by arrow E in Figure 7. That is, at the GW of user site <1>, it is a subnet that aggregates addresses already assigned to terminal 1 from the high-priority subnet for user site <1> of terminal group <1> and the high-priority subnet for user site <2> of terminal group <1> (e15). Also, at the GW of user site <2>, it is a subnet (e25) that aggregates addresses from the high-priority subnet for user site <2> of terminal group <1> excluding addresses already assigned to user site <1>.

[0075] In step S7 of Fig. 6, the address issuing unit 120 determines whether or not there is a vacant address in the high-priority subnetwork for user site <n> within the terminal group <1> subnetwork, by referring to the terminal group <1> subnetwork management table 180 of Fig. 5. If there is a vacant address in the high-priority subnetwork for user site <n> within the terminal group <1> subnetwork (S7: Yes), the process proceeds to step S8, and if there is no vacant address in the high-priority subnetwork for user site <n> within the terminal group <1> subnetwork (S7: No), the process proceeds to step S9.

[0076] If there is a vacant subnet in the high-priority subnet for user site <n> within the terminal group <1> subnet (Yes in S7: arrow F), it becomes the route advertisement subnet of the GW of user site <1> and the GW of user site <2> as shown by arrow F in Figure 7. That is, at the GW of user site <1>, it is a subnet that aggregates addresses already assigned to terminal 1 from the high-priority subnet for user site <1> of terminal group <1> and the high-priority subnet for user site <n> of terminal group <1> (f16). Also, at the GW of user site <2>, it is the high-priority subnet for user site <2> of terminal group <1> (f26). In the case of the high-priority subnet (f16) for user site <1> of terminal group <1> and the high-priority subnet (f26) for user site <2> of terminal group <1>, the route advertisement subnet for user site <n> will be the same as the above a25 ``at the GW of user site <2>, a subnet that aggregates addresses from the high-priority subnet for user site <2> of terminal group <1>, excluding addresses already assigned to user site <1>.''

[0077] 6, in step S8, the address assignment unit 120 assigns the discovered free address to the terminal, and the processing of this flow ends. In step S9, the address assignment unit 120 notifies the administrator of the address shortage, and the processing of this flow ends. If there are no free addresses in the high-priority subnet for user site <n> within the terminal group <1> subnet (S7: No), all addresses in the subnet for terminal group <1> have been assigned, and there is a shortage, so the administrator is notified to assign additional addresses for terminal group <1>.

[0078] [Hardware Configuration] The address management device 100 (FIGS. 1 and 2) according to the above embodiment is realized by, for example, a computer 900 configured as shown in FIG. 8. FIG. 8 is a hardware configuration diagram showing an example of the computer 900 that realizes the functions of the address management device 100 (FIGS. 1 and 2). The computer 900 has a CPU 901, a ROM 902, a RAM 903, a HDD 904, a communication interface (I / F) 906, an input / output interface (I / F) 905, and a media interface (I / F) 907.

[0079] The CPU 901 operates based on programs stored in the ROM 902 or HDD 904, and controls each part of the address management device 100 (FIGS. 1 and 2). The ROM 902 stores a boot program executed by the CPU 901 when the computer 900 is started, programs that depend on the hardware of the computer 900, and the like.

[0080] The CPU 901 controls an input device 910 such as a mouse or keyboard, and an output device 911 such as a display, via an input / output I / F 905. The CPU 901 acquires data from the input device 910 via the input / output I / F 905, and outputs generated data to the output device 911. Note that a GPU (Graphics Processing Unit) or the like may be used as a processor together with the CPU 901.

[0081] The HDD 904 stores programs executed by the CPU 901 and data used by the programs. The communication I / F 906 receives data from other devices via a communication network (e.g., NW (Network) 920) and outputs the data to the CPU 901, and also transmits data generated by the CPU 901 to other devices via the communication network.

[0082] The media I / F 907 reads a program or data stored in the recording medium 912 and outputs it to the CPU 901 via the RAM 903. The CPU 901 loads a program related to a target process from the recording medium 912 onto the RAM 903 via the media I / F 907, and executes the loaded program. The recording medium 912 is an optical recording medium such as a DVD (Digital Versatile Disc) or a PD (Phase Change Rewritable Disc), a magneto-optical recording medium such as an MO (Magneto Optical Disc), a magnetic recording medium, a conductive memory tape medium, a semiconductor memory, or the like.

[0083] For example, when the computer 900 functions as the address management device 100 (FIGS. 1 and 2) configured as one device according to this embodiment, the CPU 901 of the computer 900 executes a program loaded onto the RAM 903 to realize the functions of the address management device 100. In addition, the HDD 904 stores data in the RAM 903. The CPU 901 reads and executes a program related to the target processing from the recording medium 912. Alternatively, the CPU 901 may read a program related to the target processing from another device via a communication network (NW 920).

[0084] [Effects] As explained above, the address management device 100 (FIGS. 1 and 2) determines the terminal groups 11, 12 and server groups 21, 22 to which the terminal 1 or server 2 belongs based on the identifier of the terminal 1 or server 2 at the time of network connection, and assigns addresses from the allocation ranges of the relevant terminal groups 11, 12 and server groups 21, 22. The address management device 100 also manages assigned and unassigned addresses (see the subnet management table 180 for terminal group <1> in FIG. 5) within the subnets (see the communication control policy 170 in FIG. 4) assigned to each of the terminal groups 11, 12 and server groups 21, 22. The system comprises a management unit 110 (Figure 2), an address assignment unit 120 (Figure 2) that, upon receiving an address inquiry from a terminal 1 or a server 2, requests the address inventory management unit 110 to assign an address along with the identifiers of the terminal 1 and server 2 and the base information to which the terminal 1 and server 2 are connected, and a GW setting management unit 130 (Figure 2) that adds or deletes route advertisement settings to the gateways (GW3, 4) of the bases included in the notification for the subnet to which the route advertisement is to be added or deleted, as notified by the address inventory management unit 110.

[0085] As described in the problem to be solved, the number of communication control policies may increase due to the load imposed on determining whether a communication control policy matches each packet, and an increase in the number of communication control policies can cause a decrease in the amount of communication that can be transferred by the GW. The address management device 100 aggregates, by subnet, the IP addresses of the terminal groups 11 and 12 and the server groups 21 and 22, which are the source (terminal groups 11 and 12) and destination (server groups 21 and 22) of the communication control policies set in the GW. By enabling policy settings to be aggregated, it is possible to reduce the amount of communication control policy settings for the GWs installed at bases in a secure closed network spanning multiple bases.

[0086] The effects will be explained in more detail below. As shown in Figures 3A and 3B, the address management device 100 sets up subnets (subnet 150 for terminal group <1>, subnet 160 for terminal group <2>) for each terminal group. By setting the policy for the GW in a subnet that aggregates the address ranges for each terminal group, it is possible to always aggregate terminals regardless of whether the number of terminals within the base increases or decreases (solving problem (1)).

[0087] The address management device 100 also configures (allocates) subnets, as indicated by the open two-way arrow in FIG. 3A . The allocation ranges to each base can be fragmented as much as possible without releasing already allocated ranges (solving problem (2)), preventing the number of routes held by the gateway from increasing. Here, the address management device 100 dynamically changes the allocation ranges to the terminal groups under each base in response to an increase or decrease in the number of terminals by adding or deleting route advertisement settings to the gateway 3 installed at the base (see the dashed arrows pointing from the address management device 100 to the gateway 3 in FIG. 1 ). Therefore, the address management device 100 configures each gateway to advertise routes for the address ranges allocated to the terminal groups under that gateway using a routing protocol such as BGP. In this way, the address management device 100 aggregates policy settings by performing allocations using subnets for each terminal group.

[0088] Furthermore, the address management device 100 aggregates the settings for the policies set for each GW by using the subnets for each terminal group and server group as keys, as shown in Fig. 4. Since the subnets for the terminal groups do not change even if the number of terminals in each base increases, the policy settings do not increase either.

[0089] In the address management device 100 (FIGS. 1 and 2), the address assignment unit 120 assigns an address to the terminal 1 at each base from a subnet corresponding to the terminal group to which the address belongs, based on the assigned base and priority set for each address.

[0090] That is, when allocating addresses to the terminal groups 11 and 12, the address management device 100 sets high and low allocation priority ranges for each terminal group 11 and 12 (FIG. 1) by base, and allocates addresses starting with the smallest addresses in the high-priority range within the user bases 31 to 33 (FIG. 1) to which the terminal 1 belongs (see the subnet management table 180 for terminal group <1> in FIG. 5). Then, when all high-priority and low-priority addresses have been allocated, the address management device 100 allocates addresses starting with the largest low-priority addresses of other user bases, and performs route advertisement for the allocated portion from the GW 3 (FIGS. 6 and 7). This divides the subnets allocated to the terminal groups 11 and 12 into multiple ones, reducing the increase in the amount of policy settings, and also preventing address release and reallocation even when the terminal 1 moves, reducing the degradation of forwarding performance at the GW 3 and the impact on communications.

[0091] The address management system 1000 (FIG. 1) comprises a gateway at each base that bundles communications between the bases, and an address management device 100 that aggregates the gateway policies and assigns addresses to the terminal 1, and performs policy control for communications, such as permission or denial of communication and communication rate restrictions, according to the type of terminal 1 and server 2, for a secure closed network spanning multiple bases. The address management device 100 (FIG. 1, FIG. 2) assigns addresses to each terminal group and server group to which the terminal 1 or server 2 belongs based on the identifier of the terminal 1 or server 2 when an authentication request and address assignment are made when the terminal 1 or server 2 is connected to the network. The system is equipped with an address inventory management unit 110 that manages issued and unissued addresses for each address in the assigned subnet, an address assignment unit 120 that, upon receiving an address inquiry from a terminal 1 or a server 2, requests the address inventory management unit 110 to assign an address along with the identifiers of the terminal 1 and server 2 and the base information to which the terminal 1 and server 2 are connected, and a GW setting management unit 130 that adds or deletes route advertisement settings to the gateway of the base included in the notification for the subnet to which a route advertisement is to be added or deleted as notified by the address inventory management unit 110.

[0092] The address management system 1000 includes the address management device 100, which aggregates the IP addresses of the terminal groups 11 and 12 and the server groups 21 and 22 by subnetwork. The address management device 100 enables policy settings to be aggregated, thereby reducing the amount of communication control policy settings for GWs installed at bases in a secure closed network spanning multiple bases.

[0093] Note that, among the processes described in the above embodiments, all or part of the processes described as being performed automatically can be performed manually, or all or part of the processes described as being performed manually can be performed automatically using known methods. Furthermore, the processing procedures, control procedures, specific names, and information including various data and parameters shown in the above documents and drawings can be changed as desired unless otherwise specified. Furthermore, the components of each device shown in the drawings are functionally conceptual and do not necessarily have to be physically configured as shown. In other words, the specific form of distribution and integration of each device is not limited to that shown in the drawings, and all or part of the devices can be functionally or physically distributed and integrated in any unit depending on various loads, usage conditions, etc.

[0094] Furthermore, the above-described configurations, functions, processing units, processing means, etc. may be partially or entirely implemented in hardware, for example, by designing them as integrated circuits. The above-described configurations, functions, etc. may also be implemented by software that causes a processor to interpret and execute programs that implement the respective functions. Information such as programs, tables, and files that implement the respective functions may be stored in a memory, a recording device such as a hard disk or a solid-state drive (SSD), or a recording medium such as an integrated circuit (IC) card, a secure digital (SD) card, or an optical disk.

[0095] REFERENCE SIGNS LIST 1 Terminal 2 Server 3, 4 GW (gateway) 11, 12 Terminal group (terminal group <1>, <2>) 21, 22 Server group (server group <1>, <2>) 31 to 33 User base (user base <1> to <3>) 41 Cloud base 51 Wide area NW 52 Base-to-base VPN 100 Address management device 110 Address inventory management unit 120 Address issuance unit 130 GW setting management unit 150 Subnet for terminal group <1> 160 Subnet for terminal group <2> 170 Communication control policy 180 Subnet management table for terminal group <1> 1000 Address management system

Claims

1. An address management device that determines the terminal group and server group to which a terminal or server belongs based on the identifier of the terminal or server when connected to a network, and assigns an address from the allocation range of the relevant terminal group and server group, comprising: an address inventory management unit that manages assigned and unassigned addresses for each address in a subnetwork assigned to each of the terminal groups and server groups; an address assignment unit that, upon receipt of an address inquiry from the terminal or server, requests the address inventory management unit to assign an address along with the identifiers of the terminal and server and information about the base to which the terminal and server are connected; and a gateway setting management unit that adds or deletes route advertisement settings to the gateway of the base included in the notification for the subnet to which a route advertisement is to be added or deleted as notified by the address inventory management unit.

2. The address management device according to claim 1, characterized in that the address assignment unit assigns addresses from the assignment range based on the assignment base and priority set for each address, from within the subnetwork corresponding to the terminal group to which the terminal at each base belongs.

3. An address management system comprising: gateways at each base that bundle communications between bases, and performs policy control for communications, such as allowing or not allowing communications and limiting communication rates, depending on the type of terminal and server, for a secure closed network spanning multiple bases; and an address management device that aggregates the policies of the gateways and assigns addresses to the terminals, wherein the address management device comprises: an address inventory management unit that manages assigned and unassigned addresses for each address in a subnet assigned to each terminal group and server group to which the terminal or server belongs based on the identifier of the terminal or server when an authentication request and address assignment is made when the terminal or server is connected to the network; an address assignment unit that, upon receiving an address inquiry from the terminal or the server, requests the address inventory management unit to assign an address together with the identifiers of the terminal and server and information on the base to which the terminal and server are connected; and a gateway setting management unit that adds or deletes route advertisement settings for the gateway of the base included in the notification for the subnet to which a route advertisement is to be added or deleted as notified by the address inventory management unit.

4. An address management method of an address management device that determines the terminal group and server group to which a terminal or server belongs based on the identifier of the terminal or server when connected to a network, and assigns an address from the allocation range of the relevant terminal group and server group, wherein the address management device executes the steps of: managing assigned and unassigned addresses for each address in a subnetwork assigned to each of the terminal groups and server groups; requesting the assignment of an address together with the identifiers of the terminal and server and information on the base to which the terminal and server are connected, in response to an address inquiry from the terminal or server; and adding or deleting route advertisement settings to the gateway of the base included in the notification for the subnetwork to which the notified route advertisement is to be added or deleted.

Images