JP2005260715A - Terminal device having packet nat transparent function, and its program - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To provide a technology for allowing terminals under control of a NAT (Network Address Translation) device to communicate each other by TCP. <P>SOLUTION: The terminal device includes a function for communicating from inside of a first NAT device with other terminal device located at inside of a second NAT device. The terminal device comprises a means for transmitting a first external port number given by the first NAT device to the other terminal device, a means for receiving a second external port number given by the second NAT device from the other terminal device, a means for receiving from the other terminal device a packet having the first external port number as a transmission destination port number and including an internal port number used by application in the other terminal device as a transmission source port number, and a means for converting the transmission source port number to the second external port number and converting the transmission destination port number to an internal port number used by application in the terminal device. <P>COPYRIGHT: (C)2005,JPO&NCIPI

Description

  The present invention relates to a NAT transmission technology for communication between terminals under a NAT (Network Address Translation) device through a NAT device.

  2. Description of the Related Art NAT devices that allow access to the Internet from terminals assigned only private IP addresses by converting private IP addresses and global IP addresses to each other have become widespread.

  While NAT devices have the advantage of preventing unauthorized access from outside the NAT device to terminals under the NAT device, access to the terminals under the NAT device is restricted from outside the NAT device. However, there is a problem that peer-to-peer communication between terminals via a NAT device is not possible.

  In order to solve this problem, NAT transmission techniques such as UPnP (Universal Plug and Play) and STUN (Simple Traversal of UDP through NATs, RFC3489) have been proposed.

  Here, a method for constructing a UDP data channel between terminals under the NAT apparatus when STUN is used will be described with reference to FIG.

  In the example shown in FIG. 1, a UDP data channel is established between terminals 3 and 4 under the NAT devices 1 and 2. Further, a STUN server 5 that returns the global IP address and port number converted by the NAT device 1 to the terminal 3 is provided on the terminal 3 side, and similarly, a STUN server 6 is provided on the terminal 4 side. Information exchange between the terminals 3 and 4 is performed via the SIP proxy server 7.

  In this specification, a private IP address of a terminal under a NAT device is called an internal IP address or internal address, and a port number identified by an application used in the terminal is called an internal port number. After being converted by the NAT device, The global IP address is called an external IP address or external address, and the port number is called an external port number. In the drawings, the TCP port number may be described as a TCP port, the UDP port number as a UDP port, the transmission source as “SRC”, and the transmission destination as “DST”.

  First, the terminal 3 acquires the external IP address y and the external port number y after being converted by the NAT device 1 using the STUN server 5 (step S1). The same applies to the terminal 4 side.

  Then, the external IP address and the external port number are mutually notified by the SIP INVITE session between the terminals 3 and 4 (step S2). Thereafter, the terminal 3 transmits the UDP packet with the destination IP address as the external address b on the terminal 4 side and the destination port number as the external port number b on the terminal 4 side (step S3). The UDP packet reaches the NAT device 2 as the transmission source IP address y and the transmission source port number y, but the NAT device 2 is a table that passes the packet of the transmission source IP address y and the transmission source port number y. The UDP packet is discarded because it is not registered in the list.

  On the other hand, from the terminal 4 side, a UDP packet is transmitted with the destination IP address as y and the destination port number as y. The UDP packet arrives at the NAT device 1 as the transmission source IP address b and transmission source port number b. At this time, the transmission destination IP address b and transmission destination port number b are determined by the UDP packet passed in step S3. Since it is registered in the table of the NAT device 1, the UDP packet transmitted from the terminal 4 side passes through the NAT device 1 and reaches the terminal 3. Similarly, the subsequent UDP packet from the terminal 3 to the terminal 4 passes through the NAT device 2 and reaches the terminal 4. Subsequent UDP communications can exceed the NAT device in both directions. In this way, communication between terminals via a NAT device can be performed with UDP.

As another conventional technique related to NAT transmission, there is a technique using UDP encapsulation called IPsec NAT-Traversal (see Patent Document 1). This technology inserts a dummy UDP header (the internal port number of the transmission source and the port number of the transmission destination) after making the UDP packet IPsec at the transmission source, and the dummy UDP header is received by the NAT device on the reception side. By referring to the converted UDP header after conversion, the external port number of the transmission source is obtained, and the transmission source internal port number of the UDP header of the UDP packet converted into IPsec is converted to the external port number. It is. As a result, the application can perform UDP communication without being aware of IPsec encryption and NAT.
Japanese Patent No. 3457645

  However, according to the above prior art, UDP NAT transmission can be realized, but there is a problem that TCP NAT transmission cannot be performed.

In TCP, connection is established by exchanging sequence numbers with each other using SYN packets, SYN / ACK packets, and the like. Therefore, in the method of transmitting packets to each other independently like the method using STUN shown in FIG. 1, the NAT device may determine that normal TCP communication is not performed. There are cases where NAT transmission cannot be realized.
In addition, in the IPsec NAT-Traversal technology, it is conceivable to perform TCP NAT transmission by encapsulating TCP packets in UDP. However, in the IPsec NAT-Traversal technology, the NAT device converts it with UDP encapsulation. Therefore, the receiving side cannot determine to which external port number the source internal port number in the TCP header inside the UDP capsule should be converted. Therefore, TCP NAT transmission cannot be realized with the conventional UDP encapsulation technology of IPsec NAT-Traversal.

Further, although it is conceivable to realize NAT transmission of TCP by causing the terminal to directly act on the NAT device using UPnP, there is a problem that the NAT devices on both sides of the terminal need to support UPnP. In addition, when the terminal and the NAT device do not exist in the same subnet, or when multiple NAT devices are used, TCP NAT transmission by UPnP cannot be realized.
The present invention has been made in view of the above points, and an object of the present invention is to provide a technique that enables terminals under the control of a NAT device to perform communication by TCP.

  The above-described problem is a terminal device having a function of performing communication with another terminal device inside the second NAT device from the inside of the first NAT device. Means for transmitting a first external port number assigned by the NAT device, means for receiving a second external port number assigned by the second NAT device from the other terminal device, and a first external device Means for receiving, from the other terminal device, a packet containing a port number as a destination port number and an internal port number used by an application of the other terminal device as a source port number; and the source port number And a means for converting the destination port number into an internal port number used by an application of the terminal device. It is more resolved.

  According to the present invention, since the terminal device can know the external port number for TCP of the communication partner device, it can be used to convert the internal port number of the TCP header in the received packet. Further, the communication partner apparatus acquires the external port number for TCP notified by the terminal apparatus, and therefore can perform the same conversion. Accordingly, the terminal device can perform TCP communication with the communication partner device without being aware of the presence of the NAT device.

  The terminal device can obtain the first external port number from an external server provided outside the first NAT device. For example, the terminal device can make a dummy TCP connection to the external server, and can acquire the external port number for TCP assigned by the first NAT device from the external server.

  In addition, the terminal device includes NAT passing means for allowing a packet transmitted from the terminal device to pass through a second NAT device and reach the other terminal device.

  The NAT passing means has means for encapsulating the packet and means for transmitting the encapsulated packet to the second NAT device.

  The NAT transmission means also includes a communication partner device, and the terminal device receives, for example, a packet obtained by encapsulating a packet having a TCP header with a UDP header.

  The terminal device receives a destination address of the encapsulated packet and a destination external port number included in the UDP header from the other terminal device via a relay server, and transmits the source address included in the UDP header. The external port number can be received from the STUN device. For example, a SIP proxy server can be used as the relay server.

  According to the present invention, it is possible to perform TCP communication by a general application between terminals under the NAT device.

  Embodiments of the present invention will be described below with reference to the drawings. First, the principle of the NAT transmission technique according to the present invention will be described with reference to FIG.

  As shown in FIG. 2, an external server 10 having a function of making a TCP connection with a terminal and notifying the terminal of a TCP external port number is provided.

  First, the terminal 11 makes a (dummy) TCP connection to the external server 10. At this time, the internal port number of the transmission source in the TCP header of the TCP packet transmitted from the terminal 11 is converted into the external port number yy by the NAT device 12, but the external server 10 converts the external port number yy to the terminal. Reply to 11. Thereby, the terminal 11 acquires the transmission source external port number yy of the TCP header. Similarly, the terminal 13 acquires the external port number bb.

  Then, by using SIP or the like between the terminal 11 and the terminal 13, the acquired transmission source external port number for TCP communication is exchanged. Thereby, the terminal 11 acquires the transmission source external port number bb on the terminal 13 side, and the terminal 13 acquires the transmission source external port number yy on the terminal 11 side.

  Thereafter, the TCP packet is UDP-encapsulated, so that each terminal transmits and receives the packet through the NAT devices 12 and 14. NAT transmission in this case can be performed using the method shown in FIG. Note that FIG. 2 does not show the configuration (STUN server or the like) and sequence for NAT transmission of UDP packets.

  As illustrated in FIG. 2, when an example of transmitting a UDP-encapsulated TCP packet from the terminal 11 to the terminal 13, the terminal 11 transmits the TCP transmission source internal port number x and the TCP transmission destination. A UDP packet obtained by UDP-encapsulating a TCP packet having information including the external port number bb as a TCP header is transmitted to the terminal 13.

  Then, the terminal 13 extracts the contents of the received UDP-encapsulated packet and rewrites the internal port number x in the TCP header with the external port number yy for TCP. The internal IP address x is converted to the external IP address y by the NAT device 12, and the external IP address b is converted to the internal IP address a by the NAT device 14.

  By performing such conversion, the application on the terminal 11 or 13 side performs TCP communication with a terminal under the NAT device in the same manner as when performing TCP communication with a communication partner having a global address / port. be able to. The TCP packet inside the UDP capsule can be encrypted by IPsec as necessary.

  Next, the present embodiment will be described in more detail with reference to FIG.

  In the present embodiment, external servers 20 and 21 having functions of both the STUN server and the external server shown in FIG. 2 are provided as external servers. Moreover, the SIP proxy server 24 for performing SIP communication between the terminal 22 and the terminal 23 is provided. The terminal 22 is under the NAT device 25 and the terminal 23 is under the NAT device 26.

  First, in each of the terminal 22 and the terminal 23, an external IP address and an external port number for UDP used for UDP encapsulation are acquired from an external server (step S11). For example, the terminal 22 acquires the external IP address y and the UDP external port number y from the external server 20. The same applies to the terminal 23 side.

  Then, as described with reference to FIG. 2, the terminal 22 performs a dummy TCP connection to the external server 20 and acquires the external port number yy for TCP from the external server 20. Similarly, the terminal 23 acquires the external port number bb for TCP (step S12).

  Thereafter, each terminal notifies each other's terminals of the UDP tunnel (internal port number, external IP address, external port number) and the external port number for TCP connection between the terminals by SIP (step S13). .

  Thereafter, in the same manner as in the principle shown in FIG. 1, each terminal transmits a UDP packet having the transmission source internal port number and the transmission destination external port number as a UDP header to the partner terminal, so that the NAT transmission of the UDP packet is performed. Is performed (step S14). That is, a UDP tunnel is constructed. Thereby, in the subsequent sequence, the UDP-encapsulated packet transmitted from the terminal can reach the partner terminal through the NAT.

Since each terminal acquires a TCP destination external port number, it is possible to generate a TCP packet including the external port number in the TCP header. TCP packets generated in the terminal are encrypted by IPsec. Note that it is not necessary to perform encryption by IPsec.
In the example of FIG. 3, the terminal 23 generates a TCP packet with a TCP header including a TCP transmission source internal port number k and a transmission destination external port number yy used by its own application. The encrypted data is UDP-encapsulated and transmitted to the terminal 22 side (step S15).

  Thereafter, on the terminal 22 side, the TCP packet is extracted and decrypted, the internal port number k of the transmission source is converted into bb which is the corresponding external port number, and the external port number yy of the transmission destination is changed to the terminal 22. Is converted into the internal port number j (step S16).

  Note that the terminal 23 may notify the terminal 22 that k is used as the internal port number corresponding to the external port number bb before step S15. Further, the terminal 22 may notify the terminal 23 that j is used as the internal port number corresponding to the external port number yy.

  Data is passed to the application in the terminal 22 based on the header of the TCP packet converted in step S16. When the application sends data to the terminal 23 by TCP, a TCP packet is generated based on the information written in the socket, with the source internal port number j and destination external port number bb. And UDP-encapsulated and a UDP packet is transmitted to the terminal 23 side (step S17).

  On the terminal 23 side, as in the case of the terminal 22, the transmission source internal port number j is converted into the transmission source external port number yy, and the transmission destination external port number bb is converted into the transmission destination internal port number k (step S18). ), Data is passed to the application based on the header information.

  Accordingly, the terminal 22 and 23 applications can perform TCP communication without being aware of the NAT device.

  In the configuration shown in FIG. 3, the destination of the dummy TCP connection does not have to be an external server including the STUN server function. For example, a dummy connection dedicated server that cooperates with the SIP proxy server 24 for authentication may be used. Further, the number of external servers may be physically one, or load balancing may be performed with a plurality of servers. Further, the exchange of address / port number information between terminals can be performed using a method other than SIP.

  Each terminal holds a dummy TCP connection in order to secure an external port number for TCP communication while the terminals are TCP-connected. In addition, in order to avoid a timeout of NAT device connection retention, the terminal may transmit a TCP keep alive packet to an external server at intervals of several minutes.

  When a plurality of TCP connections are established between terminals, dummy TCP connections are performed for the number of connections. Note that only one UDP session is required for the tunnel. However, in many cases, a TCP client such as a Web browser automatically establishes a plurality of TCP connections. In such a case, the number of TCP connections cannot be known in advance. Therefore, in such a case, in the SIP INVITE session, only the establishment of the UDP tunnel is negotiated, and when the application actually opens the TCP socket, the communication stack spontaneously makes a dummy TCP connection, and through the UDP tunnel. The reserved TCP port number may be notified to the other party.

  Next, another example of TCP NAT transmission will be described step by step with reference to FIGS.

  4 to 8, the SIP servers 31 and 32 have a STUN server function. Further, the case where the terminal 33 (for example, a video apparatus) and the terminal 34 (for example, a portable terminal) communicate with each other is shown, and the terminal 33 actively performs TCP connection with the terminal 34. The terminal 33 is under the NAT device 35 and the terminal 34 is under the NAT device 36.

  As shown in FIG. 4, in step S21, each terminal establishes a signaling channel between SIP servers prior to communication between the terminals. At this time, each terminal obtains the UDP external IP address and external port number assigned by the NAT device from the SIP server.

  Subsequently, in step S22 of FIG. 5, the terminal 33 starts an INVITE session. The INVITE message includes the external IP address B and external port number b used in UDP tunnel construction and UDP encapsulation, and media information (TCP active connection in the example of FIG. 5). The terminal 34 that accepts the TCP connection makes a dummy TCP connection to the external server 37 and acquires the external port number y for TCP connection from the external server 37. Then, the terminal 33 is notified of the INVITE response message including the UDP tunnel external IP address D, the external port number d, and the TCP connection external port number y.

  In step S23 of FIG. 6, the terminals 33 and 34 send UDP packets including the acquired external IP address and external port number of the UDP transmission destination to each other, so that the UDP tunnel is passed over the NAT devices 35 and 36. Establish. In addition, in order to reserve an external port number for TCP, a dummy TCP connection to the external server 37 of the terminal 34 is maintained.

  In step S24 of FIG. 7, at the timing when the client application opens a socket for TCP communication in the terminal 33, the terminal 33 makes a dummy TCP connection to the external server 38, and the external for TCP communication returned from the external server 38 is returned. The port number x is notified to the connection destination terminal 34 through the UDP tunnel. Furthermore, the internal port numbers used by the applications of each terminal for TCP communication are exchanged with each other. That is, the terminal 33 notifies the internal port number z to the terminal 34, and the terminal 34 notifies the internal port number 80 to the terminal 33. Accordingly, the terminal 33 recognizes that the internal port number 80 of the TCP packet transmitted from the terminal 34 may be converted into the external port number y, and the terminal 34 recognizes that the internal port number of the TCP packet transmitted from the terminal 33. Recognize that z should be converted to an external port number x.

  After step S25 in FIG. 8, the data transferred from the application using the socket is UDP-encapsulated, and the port number in the TCP header is converted by the communication stack in the destination terminal. For example, as shown in FIG. 8, when a TCP packet having information including a transmission source internal port number z and a transmission destination external port number y as a TCP header is transmitted from the terminal 33 to the terminal 34 through the UDP tunnel, the terminal 34 Converts the source internal port number z to the external port number x, converts the destination external port number y to the internal port number 80, and passes the data to the application based on the converted information.

  FIG. 9 shows a configuration diagram including functional blocks of each device.

  As shown in FIG. 9, the terminal 41 relates to various applications 50 that perform TCP communication, a SIP function unit 51 for SIP communication (also referred to as a SIP stack in terms of a program group for SIP communication), and NAT transmission. It has a state table 52 and a communication function unit 53 (also referred to as a communication stack).

  The SIP function unit 51 has a session management unit 54 for SIP session management. The communication function unit 53 includes a general function for performing data communication such as TCP / IP communication, a TCP-NAT compensation function 55, an IPsec function 56, a UDP capsule processing function 57, and a UDP tunnel construction function 58. ing.

  The TCP-NAT compensation function 55 is a function for converting a port number for TCP communication. The IPsec function 56 is a function for encrypting a TCP packet generated in the communication function unit. The UDP capsule processing function 57 is a function for performing processing for inserting a UDP header into a packet for UDP encapsulation. The UDP tunnel construction function 58 is a function that constructs a UDP tunnel by performing NAT transmission by transmitting a UDP packet. The state table related to NAT transmission has correspondence information of external port numbers and internal port numbers. The application 50 causes the communication function unit 53 to execute data communication by using the socket API.

  In the example of FIG. 9, the external server 43 includes both a function unit 59 of the STUN server and a function unit 60 for dummy TCP connection. The terminal 41 obtains an external port number for UDP from the function unit 59 of the STUN server. Further, the dummy TCP connection function unit 60 performs dummy TCP connection between the terminal 41 and the external server, and reserves an external port number for TCP.

  The session management server 44 such as an SIP server has a session management unit 61 that performs session management. IP address information and port number information are exchanged between the terminal 41 and the terminal 42 via the session management server 44. The configuration of the terminal 42 is the same as the configuration of the terminal 41.

  With the above configuration, the processing described with reference to FIGS. That is, the terminals 41 and 42 acquire the transmission source external port number of each TCP header and notify the transmission source external port number to each other. The terminals 41 and 42 notify each other of the internal port number for TCP used by the application. As a result, each of the terminals 41 and 42 can record the external port number and internal port number of the communication partner terminal in the state table related to the NAT transmission in association with each other, and the TCP transmission source internal port When a UDP packet obtained by UDP-encapsulating a TCP packet having a TCP header including a number is received, the internal port number in the TCP header can be rewritten to the external port number by referring to the state table. .

  Each of the terminal and the external server is a computer having a CPU, a memory, a storage device, etc., and the functional means according to the present invention is realized by a program executed on the computer. The program can be recorded on a recording medium such as a CD-ROM or an SD card, and can be installed and used in an arbitrary computer.

  According to the configuration shown in the above-described embodiment, terminals that are under the control of both NAT devices can directly perform TCP communication using a general client application. Further, TCP communication is possible without directly acting on the NAT device as in UPnP. Furthermore, since the TCP sequence is concealed by UDP encapsulation, the TCP communication NAT transmission method described in the above embodiment is effective even for a NAT apparatus having an FW function.

  The present invention is not limited to the above-described embodiment, and various modifications and applications can be made within the scope of the claims.

It is a figure for demonstrating the construction method of the UDP data channel between the terminals under a NAT apparatus. It is a figure for demonstrating the principle of the NAT transmission technique of TCP connection which concerns on this invention. It is a figure for demonstrating embodiment of this invention. FIG. 10 is a diagram (1) for explaining another embodiment related to NAT transmission of TCP connection; It is FIG. (2) for demonstrating other embodiment regarding NAT transmission of TCP connection. It is FIG. (3) for demonstrating other embodiment regarding NAT transmission of TCP connection. It is FIG. (4) for demonstrating other embodiment regarding NAT transmission of TCP connection. It is FIG. (5) for demonstrating other embodiment regarding NAT transmission of TCP connection. It is a block diagram containing the functional block of each apparatus.

Explanation of symbols

1, 2, 12, 14, 25, 26, 35, 36 NAT device 3, 4, 11, 13, 22, 23, 33, 34, 41, 42 Terminal 5, 6 STUN server 7, 31, 32 SIP proxy server 44 Session management server 10, 20, 21, 37, 38 External server 50 Various applications 51 SIP function unit 52 Status table regarding NAT transmission 53 Communication function unit 59 STUN function unit 60 Dummy TCP connection server function unit

Claims (8)

A terminal device having a function of communicating with another terminal device inside the second NAT device from the inside of the first NAT device,
Means for transmitting a first external port number assigned by the first NAT device to the other terminal device;
Means for receiving, from the other terminal device, a second external port number assigned by a second NAT device;
Means for receiving, from the other terminal device, a packet containing the first external port number as the destination port number and including the internal port number used by the application of the other terminal device as the source port number;
Means for converting the transmission source port number into a second external port number, and converting the transmission destination port number into an internal port number used by an application of the terminal device. apparatus.   The terminal device according to claim 1, further comprising means for acquiring a first external port number from an external server provided outside the first NAT device.   The terminal device according to claim 1, further comprising NAT passing means for allowing a packet transmitted from the terminal device to pass through a second NAT device and reach the other terminal device.   4. The terminal apparatus according to claim 3, wherein the NAT passing means includes means for encapsulating a packet and means for transmitting the encapsulated packet to the second NAT apparatus.   The terminal device according to claim 1, wherein each port number is a port number for TCP communication.   The terminal device according to claim 4, wherein each port number is a port number for TCP communication, and the encapsulation is performed by adding a UDP header including an external port number for UDP communication to a packet including a TCP header. . Means for receiving the destination address of the encapsulated packet and the destination external port number included in the UDP header from the other terminal device via a relay server;
The terminal device according to claim 6, further comprising: a unit that receives an external port number of a transmission source included in the UDP header from a STUN device. A computer used to communicate with other terminal devices inside the second NAT device from inside the first NAT device,
Means for transmitting to the other terminal device a first external port number assigned by a first NAT device;
Means for receiving a second external port number assigned by a second NAT device from the other terminal device;
Means for receiving, from the other terminal device, a packet containing the first external port number as a destination port number and an internal port number used by the application of the other terminal device as a source port number;
A program that converts the transmission source port number into a second external port number and functions as means for converting the transmission destination port number into an internal port number used by an application of the computer.

Images