Conversion device and server

Abstract

A conversion device (14) according to the present disclosure is provided in a second network connected to a first network, and comprises: a storage unit (111) that stores a conversion rule predetermined for use between the conversion device (14) and a server (15) that provides an application executed by a user terminal (11); and a control unit (143) that converts, on the basis of the conversion rule, first connection source information used by the user terminal (11) to connect to the first network and second connection source information used by the user terminal (11) to communicate with the server (15) for executing the application, and transmits the converted connection source information to the server (15).

Description

Converter and Server

[0001] The present disclosure relates to a conversion device and a server.

[0002] In some cases, a user terminal connected to a communications carrier network provided by a provider of network connection services (e.g., a communications carrier) uses an application provided by a server on an external network. In such a case, the service provider providing the application needs to identify the user terminal that transmits and receives data.

[0003] Patent document 1 describes a method in which a service provider identifies a user terminal by delivering a one-time password containing several alphanumeric characters to the user terminal via SMS (Short Message Service), and the user inputs the delivered one-time password.

[0004] JP 2012-226594 A

[0005] The technique described in Patent Document 1 guarantees that the user has a line-authenticated user terminal, but it cannot guarantee that the user terminal on which the service client application is executed is the same as the user terminal that transmits and receives data. For example, in real-time communication applications using audio and video, different connections may be used for the U-plane that transmits and receives data and the C-plane that controls the session. The technique described in Patent Document 1 cannot guarantee that the two are linked.

[0006] Furthermore, the method described in Patent Document 1 requires the user to input a one-time password. Furthermore, the method described in Patent Document 1 may result in messages not being delivered due to the SMS reception settings of the user terminal, making the method unusable. Therefore, the method described in Patent Document 1 may not be able to identify the user terminal quickly enough.

[0007] Furthermore, the technology described in Patent Document 1 may cause problems such as increased communication overhead due to the exchange of authentication messages, and increased power consumption in IoT applications where low power consumption is required.

[0008] Furthermore, with the technology described in Patent Document 1, when a service provider uses SMS authentication to identify a user terminal, there is a risk that re-authentication inquiries will be concentrated due to a fault switching on the service provider side, causing congestion in the telecommunications carrier network.

[0009] The purpose of the present disclosure, made in consideration of the above-mentioned problems, is to provide a conversion device and a server that can easily and quickly identify that a user terminal connected to a telecommunications carrier network is the same as a user terminal running an application provided by a server located on an external network.

[0010] A conversion device according to one embodiment is a conversion device provided in a first network that accommodates a user terminal, and includes: a memory unit provided in a second network connected to the first network that stores a conversion rule that is predetermined between the conversion device and a server that provides an application to be executed on the user terminal; and a control unit that converts first connection source information for the user terminal to connect to the first network and second connection source information used by the user terminal to communicate with the server to execute the application based on the conversion rule, and transmits the converted connection source information to the server.

[0011] In one embodiment, the server is provided on a second network connected to a first network that accommodates user terminals, and provides applications to be executed on the user terminals. A conversion device is provided on the first network, and the conversion device converts first connection source information for the user terminal to connect to the first network and second connection source information used by the user terminal to communicate with the server to execute the application based on a conversion rule predetermined between the conversion device and the server, transmits the converted connection source information to the server, and includes a memory unit that stores the conversion rule, and a control unit that determines, based on the conversion rule, whether the first connection source information and the second connection source information notified from the user terminal are compatible with the converted connection source information transmitted from the conversion device.

[0012] According to the present disclosure, it is possible to easily and quickly identify that a user terminal connected to a communications carrier network is the same as a user terminal executing an application provided by a server located in an external network.

[0013] 1 is a diagram illustrating an example of a configuration of a communication system according to an embodiment of the present disclosure; FIG. 2 is a diagram illustrating an example of a configuration rule for connection source information; FIG. 3 is a flowchart illustrating an example of an operation of the conversion device illustrated in FIG. 1; and FIG. 4 is a diagram illustrating an example of conversion of connection source information by the conversion device illustrated in FIG.

[0014] Hereinafter, embodiments of the present disclosure will be described with reference to the drawings.

[0015] 1 is a diagram illustrating an example of a configuration of a communication system 10 according to an embodiment of the present disclosure. As illustrated in Fig. 1, the communication system 10 according to the embodiment includes a communication carrier network (first network) provided by a business operator (e.g., a communication carrier) that provides a network connection service, and an external network (second network) connected to the communication carrier network, such as the Internet.

[0016] The communication carrier network accommodates a user terminal 11 and provides a network connection service to the user terminal 11. As shown in Fig. 1, the communication carrier network is provided with an authentication server 12, an IP address issuance server 13, and a conversion device 14 according to the present disclosure. An external network is provided with a server 15 that provides an application (OTT (Over The Top) application) executed on the user terminal 11.

[0017] The user terminal 11 communicates with the server 15 and executes applications provided by the server 15. As shown in FIG.

[0018] The storage unit 111 includes at least one semiconductor memory, at least one magnetic memory, at least one optical memory, or any combination thereof. The semiconductor memory may be, for example, a random access memory (RAM), a read-only memory (ROM), or a flash memory. The RAM may be, for example, a static random access memory (SRAM) or a dynamic random access memory (DRAM). The ROM may be, for example, an electrically erasable programmable read-only memory (EEPROM). The flash memory may be, for example, a solid-state drive (SSD). The magnetic memory may be, for example, a hard disk drive (HDD). The storage unit 111 functions as, for example, a main storage device, an auxiliary storage device, or a cache memory. The storage unit 111 stores information used in the operation of the user terminal 11 and information obtained by the operation of the user terminal 11. For example, the storage unit 111 stores specific information of the user terminal 11 (information that can uniquely identify the user terminal 11). The unique information is, for example, SIM (Subscriber Identity Module) information, MAC (Media Access Control) address, digital certificate, and the like.

[0019] The communication unit 112 includes at least one communication module. The communication module is, for example, a module compatible with a LAN communication standard such as Ethernet (registered trademark). The communication unit 112 communicates with the authentication server 12, the IP address issuance server 13, and the conversion device 14. The communication unit 112 also communicates with the server 15 via an encrypted communication path (for example, TLS (Transport Layer Security) communication). The communication unit 112 receives information used in the operation of the user terminal 11 and transmits information obtained by the operation of the user terminal 11.

[0020] The control unit 113 includes at least one processor, at least one programmable circuit, at least one dedicated circuit, or any combination thereof. The processor is a general-purpose processor such as a central processing unit (CPU) or a graphics processing unit (GPU), or a dedicated processor specialized for a specific process. The programmable circuit is, for example, a field-programmable gate array (FPGA). The dedicated circuit is, for example, an application-specific integrated circuit (ASIC).

[0021] The control unit 113 controls each unit of the user terminal 11 and executes processes related to the operation of the user terminal 11. For example, the control unit 113 executes an application (OTT application) provided by the server 15 by transmitting and receiving data to and from the server 15 via the conversion device 14. The control unit 113 also acquires connection source information (first connection source information) for the user terminal to connect to a communication carrier network (first network), such as an IP address assigned to a communication interface of the user terminal 11. The control unit 113 also acquires connection source information (second connection source information) for the server 15 to communicate with the server 15 to execute the application, such as a port number used by an application executed on the user terminal 11. The control unit 113 notifies the server 15 of the acquired connection source information (first connection source information and second connection source information) via an encrypted communication path (e.g., TLS communication).

[0022] The authentication server 12 performs connection authentication when the user terminal 11 connects to the communication carrier network. The authentication server 12 performs connection authentication using unique information of the user terminal 11 (SIM / USIM (Universal Subscriber Identity Module) information, MAC address, digital certificate, etc.). The authentication server 12 outputs the authentication result to the IP address issuance server 13.

[0023] When the authentication server 12 authenticates the user terminal 11 for connection to the communication carrier network, the IP address assignment server 13 assigns an IP address (first connection source information) for connecting to the communication carrier network to the user terminal.

[0024] Since the authentication server 12 and the IP address issuing server 13 are not directly related to the present disclosure, a description of their configurations will be omitted.

[0025] The conversion device 14 transmits and receives data (packets) between the user terminal 11 and the server 15 so that the user terminal 11 can execute an application provided by the server 15. The conversion device 14 converts the connection source information of the user terminal 11 based on a predetermined conversion rule and transmits the converted information to the server 15. The conversion device 14 includes a storage unit 141, a communication unit 142, and a control unit 143.

[0026] Like the storage unit 111, the storage unit 141 includes at least one semiconductor memory, at least one magnetic memory, at least one optical memory, or any combination thereof. The storage unit 141 functions as, for example, a main storage device, an auxiliary storage device, or a cache memory. The storage unit 141 stores information used in the operation of the conversion device 14 and information obtained by the operation of the conversion device 14. For example, the storage unit 141 stores a conversion rule (NAPT (Network Address Port Translation) rule) for converting the connection source information of the user terminal 11. The conversion rule is a rule predetermined between the server 15 and the conversion device 14 (between the service provider and the telecommunications carrier). That is, the storage unit 141 is provided in an external network (second network) connected to the telecommunications carrier network (first network), and stores a conversion rule predetermined between the server 15 that provides an application executed on the user terminal 11 and the conversion device 14.

[0027] FIG. 2 is a diagram illustrating an example of the configuration of the conversion rule.

[0028] As shown in FIG. 2 , the conversion rule includes a destination address and a conversion algorithm. The destination address is an address indicating the destination of a packet sent from the user terminal 11, and is the address of the server 15 that provides an application executed on the user terminal 11. The packet from the user terminal 11 includes the user terminal's connection source information (the IP address of the user terminal 11 (first connection source information) and the port number of the user terminal 11 used to communicate with the server 15 so that the user terminal 11 can execute an application provided by the server 15 (second connection information)). The conversion algorithm converts the connection source information of the user terminal 11. It is desirable that the conversion algorithm be unidirectional so that the original text cannot be inferred from the conversion result. Using such an algorithm makes it difficult to derive the connection source information before conversion from only the converted connection source information. The conversion rule shown in FIG. 2 allows a conversion rule to be set for each server when multiple servers 15 are provided.

[0029] As shown in FIG. 2 , the conversion rule may further include a destination port. By including the destination port in the conversion rule, a conversion rule can be set for each destination port. The conversion rule may also include key information. The key information is information about an encryption key used when converting the connection source information using a keyed hash function, RSA encryption, or the like. By converting the connection source information using the key information, even if a pair of specific pre-conversion connection source information and converted connection source information is stolen, it becomes difficult to derive valid converted connection source information from any pre-conversion connection source information.

[0030] 1 , the communication unit 142 includes at least one communication module, similar to the communication unit 112. The communication unit 142 communicates with the user terminal 11, the authentication server 12, and the server 15. The communication unit 142 receives information used in the operation of the conversion device 14, and transmits information obtained by the operation of the conversion device 14.

[0031] Like the control unit 113, the control unit 143 includes at least one processor, at least one programmable circuit, at least one dedicated circuit, or any combination thereof. The control unit 143 executes processing related to the operation of the conversion device 14 while controlling each unit of the conversion device 14. For example, the control unit 143 converts first connection source information for the user terminal 11 to connect to the communication carrier network (first network) and second connection source information used for communication with the server 15 so that the user terminal 11 can execute an application provided by the server 15, based on the conversion rule stored in the storage unit 141, and transmits the converted connection source information to the server 15.

[0032] The server 15 establishes a communication connection with the user terminal 11 via the conversion device 14, and provides an application to be executed on the user terminal 11. The server 15 includes a storage unit 151, a communication unit 152, and a control unit 153.

[0033] Like the storage unit 111, the storage unit 151 includes at least one semiconductor memory, at least one magnetic memory, at least one optical memory, or any combination thereof. The storage unit 151 functions, for example, as a main storage device, an auxiliary storage device, or a cache memory. The storage unit 151 stores information used in the operation of the server 15 and information obtained by the operation of the server 15. For example, like the storage unit 141, the storage unit 151 stores a conversion rule for converting the connection source information of the user terminal 11. As described above, the conversion rule is a rule determined in advance between the server 15 and the conversion device 14.

[0034] The communication unit 152 includes at least one communication module, similar to the communication unit 112. The communication unit 152 communicates with the authentication server 12 and the conversion device 14. The communication unit 152 receives information used in the operation of the server 15 and transmits information obtained by the operation of the server 15.

[0035] Like the control unit 113, the control unit 153 includes at least one processor, at least one programmable circuit, at least one dedicated circuit, or any combination thereof. The control unit 153 executes processes related to the operation of the server 15 while controlling each unit of the server 15. For example, the control unit 153 determines, based on the conversion rule stored in the storage unit 151, whether the connection source information (first connection source information and second connection source information) notified from the user terminal 11 matches the converted connection source information transmitted from the conversion device 14. If the control unit 153 determines that the connection source information notified from the user terminal 11 matches the converted connection source information transmitted from the conversion device 14, the control unit 153 identifies the user terminal 11 as a terminal authenticated by the communications carrier and as a terminal executing an application provided by the server 15.

[0036] The functions of the user terminal 11, the conversion device 14, and the server 15 are realized by executing a program according to this embodiment on a processor serving as the control units 113, 143, and 153. That is, the functions of the user terminal 11, the conversion device 14, and the server 15 are realized by software. The program causes a computer to execute the operations of the user terminal 11, the conversion device 14, or the server 15, thereby causing the computer to function as the user terminal 11, the conversion device 14, or the server 15. That is, the computer functions as the user terminal 11, the conversion device 14, or the server 15 by executing the operations of the user terminal 11 in accordance with the program.

[0037] The program can be stored in a non-transitory computer-readable medium. Examples of the non-transitory computer-readable medium include a flash memory, a magnetic recording device, an optical disk, a magneto-optical recording medium, and a ROM. The program can be distributed by selling, transferring, or lending a portable medium, such as a Secure Digital (SD) card, a Digital Versatile Disc (DVD), or a Compact Disc Read Only Memory (CD-ROM), on which the program is stored. The program can also be distributed by storing the program in a server's storage and transferring it from the server to another computer. The program can also be provided as a program product.

[0038] A computer temporarily stores a program stored on a portable medium or transferred from a server in its main storage device. The computer then reads the program stored in the main storage device with a processor and executes processing in accordance with the read program. The computer may also read the program directly from the portable medium and execute processing in accordance with the program. The computer may also execute processing in accordance with the received program each time a program is transferred from the server to the computer. Processing may also be executed by a so-called ASP (Application Service Provider) type service that realizes functions by issuing execution instructions and obtaining results without transferring a program from the server to the computer. A program is information used for processing by an electronic computer and includes anything equivalent to a program. For example, data that is not a direct instruction to a computer but has properties that define computer processing falls under the category of "something equivalent to a program."

[0039] Some or all of the functions of the user terminal 11, the conversion device 14, and the server 15 may be realized by a programmable circuit or a dedicated circuit as the control units 113, 143, and 153. In other words, some or all of the functions of the user terminal 11, the conversion device 14, and the server 15 may be realized by hardware.

[0040] Next, the operation of each device in the communication system 10 according to this embodiment will be described.

[0041] As described above, the conversion device 14 and the server 15 store conversion rules for converting the IP address (first connection source information) assigned to the user terminal 11 by the communications carrier (IP address assigning server 13) and the port number (second connection source information) used for communication with the server 15 so that the user terminal 11 can execute an application provided by the server 15. The conversion rules are rules determined in advance between the conversion device 14 and the server 15 (between the communications carrier and the service provider). As described with reference to FIG. 2, the conversion rules include at least a destination address, which is the address of the server 15, and a conversion algorithm. The conversion rules may also include at least one of a destination port and key information.

[0042] When the user terminal 11 connects to the communication carrier network, the authentication server 12 performs connection authentication of the user terminal 11. The authentication server 12 performs connection authentication of the user terminal 11 based on the unique information of the user terminal 11 stored in the user terminal 11.

[0043] When the authentication server 12 authenticates the user terminal 11 for connection to the carrier network, the IP address assignment server 13 assigns an IP address, which is a private address, to the user terminal 11. For communication between the user terminal 11 and the carrier network, a session (e.g., a PDU (Protocol Data Unit) session) is established based on the authentication. This makes it possible to prevent impersonation by other terminals, such as IP spoofing.

[0044] When an application provided by server 15 is executed on user terminal 11, user terminal 11 notifies server 15 of the connection source information of user terminal 11 (IP address (first connection source information) and port number (second connection source information)) through application-level communication.

[0045] Packets transmitted and received between the user terminal 11 and the server 15 in association with the execution of an application are relayed by the conversion device 14 via a data communication path established between the user terminal 11 and the communication carrier network. When relaying, the conversion device 14 converts the connection source information of the user terminal 11 contained in the packet based on a predetermined conversion rule, and transmits the packet including the converted connection source information to the server 15. The conversion of the connection source information by the conversion device 14 will be described in detail below.

[0046] Based on the stored conversion rules, server 15 determines whether the first connection source information and second connection source information notified by user terminal 11 match the converted connection source information sent from conversion device 14. If server 15 determines that the first connection source information and second connection source information notified by user terminal 11 match the converted connection source information, server 15 determines that data transmission and reception has been authenticated by the communications carrier network and is being performed with user terminal 11 executing an application provided by server 15.

[0047] Next, a description will be given of the conversion of connection source information by the conversion device 14. Fig. 3 is a flowchart showing an example of the operation of the conversion device 14, and is a diagram for explaining the conversion method executed by the conversion device 14.

[0048] When the conversion device 14 receives a packet from the user terminal 11 (step S11), it determines whether the sender of the packet is a legitimate sender (step S12). The conversion device 14 determines whether the sender of the packet is a legitimate sender by, for example, packet filtering based on the sender address of the packet or applying a security policy that prevents IP spoofing.

[0049] If it is determined that the sender of the packet is not a legitimate sender (step S12: No), the conversion device 14 discards the packet (step S13) and ends the process.

[0050] If the conversion device 14 determines that the sender of the packet is valid (step S12: Yes), the conversion device 14 checks the destination address of the packet (step S14), and then determines whether a conversion rule corresponding to the destination address of the packet is stored (step S15).

[0051] If a conversion rule corresponding to the destination address of the packet is stored (step S15: Yes), the conversion device 14 converts the connection source information (IP address and port number) contained in the packet based on the conversion rule corresponding to the destination address of the packet (step S16).

[0052] If no conversion rule corresponding to the destination address of the packet is stored (step S15: No), the conversion device 14 determines whether there is a default conversion rule that is predetermined to be applied commonly to multiple servers 15 (step S17).

[0053] If it is determined that a default conversion rule exists (step S17: Yes), the conversion device 14 converts the connection source information (IP address and port number) included in the packet based on the default conversion rule (step S18).

[0054] After the process of step S16 or step S18, the conversion device 14 transmits a packet including the connection source information converted based on the conversion rule to the server 15 (step S19).

[0055] If it is determined that there is no default conversion rule (step S17: No), the conversion device 14 proceeds to the process of step S19. That is, the conversion device 14 transmits the packet to the server 15 as is without converting the connection source information included in the packet.

[0056] 4 is a diagram showing an example of conversion of connection source information by the conversion device 14. While an example in which the IP address is IPv6 is shown in FIG. 4, the present disclosure is not limited to this. As shown in FIG. 4, the conversion device 14 converts the portion of the IP address excluding the network portion that identifies the communication carrier network that accommodates the user terminal 1, and the port number.

[0057] The value converted based on the conversion rule may be larger than the variable bits in the converted source bits (the sum of the address space that the communication carrier can use for the converted IP address, the IPv6 interface ID, and the port number space that can be used after conversion). In this case, the conversion device 14 may extract bits by bit masking or shifting the value obtained by conversion to derive the converted source information.

[0058] The conversion device 14 (control unit 143) may store the converted connection source information in the storage unit 141 in association with the pre-conversion connection source information (IP address and port number). That is, the control unit 143 may store the converted connection source information obtained by converting the first connection source information and the second connection source information in association with the pre-conversion first connection source information and second connection source information in the storage unit 141. This makes it possible to detect a collision of conversion results, in which the converted connection source information overlaps between pairs of different source IP addresses and port numbers.

[0059] If the conversion results for different pairs of source IP addresses and port numbers collide, the conversion device 14 may retry converting the source information. In this case, the conversion device 14 may use a method for avoiding the collision. The method is predetermined between the conversion device 14 and the server 15 (the communication carrier and the service provider), and is stored in the storage units 141 and 151 in association with the conversion rule.

[0060] One method for avoiding collisions of converted connection source information is to convert the conversion result (converted connection source information) obtained by converting connection source information based on a conversion rule again based on the same conversion rule if the conversion result collides with other converted connection source information.

[0061] Another method for avoiding collisions of converted connection source information is to increment / decrement the conversion result by a fixed value when the conversion result (converted connection source information) obtained by converting connection source information based on conversion rules collides with other converted connection source information.

[0062] If retrying the conversion of the connection source information is permitted when a collision occurs in the conversion results, the server 15 may retry matching the converted connection source information with the connection source information notified from the user terminal 11 the same number of times as the number of retries of the conversion of the connection source information. If the number of matching retries reaches a predetermined upper limit, the server 15 determines that the matching has failed. By setting an upper limit on the number of matching retries, vulnerability to denial-of-service attacks can be avoided.

[0063] In cases where there are multiple edge devices in a telecommunications carrier network and the edge devices function as translation devices 14 in the networks they accommodate, the private address ranges of the multiple edge devices may overlap. In this case, if connection source information is converted using a uniform conversion rule, the conversion results may overlap for each edge device with overlapping private address ranges. In contrast, if the conversion devices 14 are not cascaded, the address range owned by the telecommunications carrier can be divided and assigned to each of the multiple edge devices, and each edge device can share a conversion rule, thereby avoiding collisions between conversion results that occur between edge devices.

[0064] As described above, the conversion device 14 according to this embodiment includes a storage unit 141 and a control unit 143. The storage unit 141 is provided in an external network (second network) connected to a communications carrier network (first network), and stores a conversion rule that is predetermined between the conversion device 14 and a server 15 that provides an application executed on the user terminal 11. The control unit 143 converts, based on the conversion rule, first connection source information used by the user terminal 11 to connect to the communications carrier network and second connection source information used by the user terminal 11 to communicate with the server 15 to execute the application, and transmits the converted connection source information to the server 15.

[0065] The server 15 according to this embodiment also includes a storage unit 151 and a control unit 153. The storage unit 151 stores the same conversion rules as those of the storage unit 141. The control unit 153 determines, based on the conversion rules, whether the first connection source information and second connection source information notified from the user terminal 11 match the converted connection source information transmitted from the conversion device 14.

[0066] By comparing the connection source information of the user terminal 11 before conversion with the connection source information after conversion by the conversion device 14 based on a conversion rule predetermined between the conversion device 14 and the server 15, the server 15 can identify that the user terminal 11 is a terminal that has been authenticated for connection to the communications carrier network, and that the terminal that executes the application provided by the server 15 and the terminal that sends and receives data with the server 15 are the same terminal.

[0067] Furthermore, in real-time communication applications, the user terminal 11 can notify the server 15 of U-plane information as connection source information, thereby improving the reliability of U-plane connections without the need to exchange U-plane in-band authentication information.

[0068] Furthermore, according to the present disclosure, it is possible to quickly identify the user terminal 11 without requiring input from the user.

[0069] Furthermore, according to the present disclosure, communication costs can be reduced because communication between the server 15 and the authentication server 12 of the communication carrier network is not required to identify the user terminal 11. Furthermore, there is no need to consider the risk of congestion occurring and delaying re-authentication when multiple re-authentications occur simultaneously due to a failure of the server 15 or the like.

[0070] Since the server 15 does not need to manage a token for each session as information related to the identification of the user terminal 11, the execution of the server 15 can be simplified. Also, since it is difficult for a terminal on an external network to steal the connection source information of the user terminal 11, it is difficult for a terminal outside the telecommunications carrier network to spoof the user terminal 11. Furthermore, by using the connection source information of the user terminal 11, it is difficult for another terminal within the telecommunications carrier network that has IP spoofing countermeasures in place to spoof the user terminal 11.

[0071] Furthermore, in an operating system (OS) running on a general terminal, if an application in another process attempts to bind to a port used by another application, an error is output. Therefore, by using a port number as connection source information, it becomes difficult for a malicious application on the user terminal 11 to spoof the port.

[0072] Therefore, according to the present disclosure, it is possible to easily and quickly identify that a user terminal connected to a communications carrier network is the same as a user terminal executing an application provided by a server located in an external network.

[0073] The following additional notes are provided regarding the above-described embodiments.

[0074] [Supplementary Item 1] A conversion device provided in a first network that accommodates user terminals, comprising: a storage unit; and a control unit, wherein the storage unit is provided in a second network connected to the first network and is configured to store a conversion rule that is predetermined between the conversion device and a server that provides an application to be executed on the user terminal, and the control unit is configured to convert first connection source information for the user terminal to connect to the first network and second connection source information that the user terminal uses to communicate with the server to execute the application based on the conversion rule, and to transmit the converted connection source information to the server.

[0075] [Supplementary Item 2] In the conversion device described in Supplementary Item 1, the control unit stores converted connection source information obtained by converting the first connection source information and the second connection source information in the storage unit, in association with the first connection source information and the second connection source information before conversion.

[0076] [Supplementary Item 3] A server provided in a second network connected to a first network accommodating user terminals, providing an application to be executed by the user terminals, the server comprising: a memory unit and a control unit; a conversion device provided in the first network; the conversion device converting first connection source information for the user terminal to connect to the first network and second connection source information used by the user terminal to communicate with the server to execute the application based on a conversion rule predetermined between the conversion device and the server, and transmitting the converted connection source information to the server; the memory unit configured to store the conversion rule; and the control unit configured to determine, based on the conversion rule, whether the first connection source information and the second connection source information notified from the user terminal match the converted connection source information transmitted from the conversion device.

[0077] [Supplementary Item 4] A conversion method executed by a conversion device provided in a first network that accommodates a user terminal, the conversion method comprising: storing a conversion rule that is predetermined between the conversion device and a server provided in a second network that connects to the first network and that provides an application to be executed by the user terminal; converting first connection source information for the user terminal to connect to the first network and second connection source information that the user terminal uses to communicate with the server to execute the application based on the conversion rule; and transmitting the converted connection source information to the server.

[0078] [Supplementary Item 5] A method for identifying a user terminal, which is provided in a second network connected to a first network that accommodates user terminals and is executed by a server that provides an application to be executed by the user terminal, comprising: a conversion device provided in the first network; the conversion device converts first connection source information for the user terminal to connect to the first network and second connection source information used by the user terminal to communicate with the server to execute the application based on a conversion rule predetermined between the conversion device and the server; transmits the converted connection source information to the server; stores the conversion rule; and determines, based on the conversion rule, whether the first connection source information and second connection source information notified from the user terminal match the converted connection source information transmitted from the conversion device.

[0079] [Supplementary Item 6] A non-transitory storage medium storing a program executable by a computer, the non-transitory storage medium storing the program causing the computer to function as the conversion device according to Supplementary Item 1 or 2.

[0080] [Supplementary Item 7] A non-transitory storage medium storing a program executable by a computer, the non-transitory storage medium storing a program that causes the computer to function as the server described in Supplementary Item 3.

[0081] Although the above-described embodiments have been described as typical examples, it will be apparent to those skilled in the art that many modifications and substitutions can be made within the spirit and scope of the present disclosure. Therefore, the present invention should not be interpreted as being limited by the above-described embodiments, and various modifications and alterations are possible without departing from the scope of the claims. For example, multiple building blocks shown in the block diagrams of the embodiments can be combined into one, or one building block can be divided.

[0082] REFERENCE SIGNS LIST 10 Communication network 11 User terminal 12 Authentication server 13 IP address issuing server 14 Conversion device 15 Server 111, 141, 151 Storage unit 112, 142, 152 Communication unit 113, 143, 153 Control unit

Claims

1. A conversion device provided in a first network that accommodates user terminals, the conversion device comprising: a memory unit provided in a second network connected to the first network that stores a conversion rule that is predetermined between the conversion device and a server that provides an application executed on the user terminal; and a control unit that converts, based on the conversion rule, first connection source information used by the user terminal to connect to the first network and second connection source information used by the user terminal to communicate with the server to execute the application, and transmits the converted connection source information to the server.

2. A conversion device according to claim 1, wherein the control unit stores converted connection source information obtained by converting the first connection source information and the second connection source information in the storage unit in association with the first connection source information and the second connection source information before conversion.

3. A server provided on a second network connected to a first network accommodating user terminals, for providing applications executed by the user terminals, wherein the first network is provided with a conversion device, the conversion device converts first connection source information for the user terminal to connect to the first network and second connection source information used by the user terminal to communicate with the server to execute the application based on a conversion rule predetermined between the conversion device and the server, and transmits the converted connection source information to the server, the server is equipped with: a memory unit that stores the conversion rule; and a control unit that determines, based on the conversion rule, whether the first connection source information and second connection source information notified from the user terminal match the converted connection source information transmitted from the conversion device.

Images