JPH11355302A - Ip address converter and its conversion method - Google Patents

Abstract

PROBLEM TO BE SOLVED: To provide an IP address converter that can transmits reversely a communication text to a destination that has transmitted the text via a proxy server. SOLUTION: A proxy server 2 is provided with an IP address cross reference management table 10 that selects a virtual IP address as a tentative address for an IP address of a communication terminal in response to a 1st connection request signal addressed to a server from the communication terminal and stores the IP address of the communication terminal and the virtual IP address in cross reference and with an IP address conversion means 20 that sends the virtual IP address to the server with the 1st connection request signal in place of the IP address of the communication terminal, references the IP address cross reference management table 10 in response to a 2nd connection request signal to the virtual IP address from the server so as to acquire the IP address corresponding to the virtual IP address and conversely sends the 2nd connection request signal to the communication terminal.

Description

DETAILED DESCRIPTION OF THE INVENTION

[0001]

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to an apparatus and method for converting an IP address at the time of communication connection via a proxy server. The present invention relates to an IP address conversion device and a conversion method for use in a required reverse communication connection.

[0002]

2. Description of the Related Art Conventionally, when a communication connection is connected via a proxy server, an already connected communication connection is used to access a connection source terminal from a connection destination AP server.

An example is disclosed in Japanese Patent Application Laid-Open No. 8-314835. The remote control system described in this publication performs remote control by using a connection from a service-receiving device to a service device via a firewall. The firewall also has a proxy server function, and the address of the service-receiving device is hidden from the service device. Here, in order for the service device to access the serviced device, a connection already connected from the serviced device to the service device is used.

[0004] When the prior art relating to the communication connection via the proxy server is retrospectively examined from past patent applications other than the above-mentioned Japanese Patent Application Laid-Open No. 8-314835, first, Japanese Patent Application Laid-Open No. 9-34814 discloses that When recognizing that a failure has occurred in the device, the communication processing unit and the switching control unit switch the IP address of the information processing device on the IP address conversion table to the IP address of the spare information processing device, and continue the communication process. Techniques are disclosed.

Next, in Japanese Patent Application Laid-Open No. 9-244976,
For a specific user terminal, the IP address of the unique starting point is managed. For a message sent from the user terminal at an IP address other than the IP address of the starting point, the message is transmitted from an unauthorized user terminal. There is disclosed a technology that regards access as a rejection.

[0006] Further, in Japanese Patent Application Laid-Open No. 9-321805,
When transmitting a packet by designating the IP address of an external wide area network from within a LAN type network, a temporary IP address is obtained by terminal type dial-up connection means, and thereafter, when transmitting to the wide area network,
There is disclosed a technique of converting an IP address in a packet into the above-mentioned temporary IP address, and converting the IP address into an IP address in the LAN type network when transmitting to the LAN type network.

[0007]

However, starting with the technique disclosed in Japanese Patent Application Laid-Open No. 8-314835 described above as a conventional technique, a connection is established from a connection destination service apparatus to a connection destination service apparatus. There is a problem that connection is not possible. The reason is that the conventional remote operation system does not originally consider connecting a connection from a connection destination to a connection source.

The technique disclosed in the above-mentioned Japanese Patent Application Laid-Open No. 9-34814 is a means for switching to the IP address of a spare information processing apparatus when a failure occurs in the information processing apparatus of the communication partner. Remember the communication connection,
It is not a technique for reusing connections in the reverse direction.

Further, the technique disclosed in Japanese Patent Application Laid-Open No. 9-244976 is a technique for storing a communication connection with a specific user terminal, but it is a technique for rejecting access from an unauthorized user terminal. It is a technology that is used, and again is not a technology that is reused for connection in the reverse direction.

[0010] Further, in Japanese Patent Application Laid-Open No. 9-321805, even though the technique is to switch the IP address specified in the packet between the LAN type network and the external wide area network, the past communication connection is still stored. It is not a technology for reusing connections in the reverse direction.

An object of the present invention relates to an IP address conversion method performed by a proxy server, and more particularly, to an IP address conversion method capable of reversely transmitting a message transmitted to a destination transmitted through a firewall having a proxy server function. An object of the present invention is to provide an address translation method.

[0012]

SUMMARY OF THE INVENTION In order to solve the above-mentioned problems, an IP address translation apparatus and a translation method thereof according to the present invention are described in US Pat.
The P address correspondence management table and the IP address correspondence management table are constituted by a pair of an IP address of the communication terminal and a virtual IP address selected as a pseudonym for the IP address, and a first connection request signal from the communication terminal to the server. In response, the virtual IP address is selected as a pseudonym for the IP address of the communication terminal, and the IP address of the communication terminal is associated with the virtual IP address and stored in the IP address correspondence management table, The virtual terminal transmits the virtual IP address together with the first connection request signal to the server in place of the IP address of the communication terminal, and conversely responds to a second connection request signal for the virtual IP address from the server. The IP address corresponding to the virtual IP address with reference to the IP address correspondence management table. It acquires the scan, characterized in that it comprises a means for transmitting the second connection request signal addressed to the communication terminal.

[0013] Further, the IP address correspondence management table is provided in a storage area to be exclusively used in the proxy server, and it is possible to deny external access to the proxy server. .

Further, the communication terminal includes a communication terminal, a server, and a proxy server unit connected to the communication terminal and the server. The proxy server unit responds to a first connection request signal addressed to the server from the communication terminal. Selecting a virtual IP address as a pseudonym for the IP address of the communication terminal, storing the IP address of the communication terminal and the virtual IP address in association with each other, and replacing the IP address of the communication terminal with the virtual IP address. Transmitting an IP address together with the first connection request signal to the server; and conversely, in response to a second connection request signal for the virtual IP address from the server, the IP address corresponding to the virtual IP address And transmitting the second connection request signal to the communication terminal.

[0015] Further, the proxy server unit may include the IP server.
It is characterized by having an IP address correspondence management table composed of a pair of an address and the virtual IP address.

Further, the proxy server unit is constituted by a plurality of proxy servers, and the storage area of the proxy server is provided with the IP address correspondence management table.

Further, a first step of transmitting a first connection request signal from a communication terminal to a server to be connected via a proxy server, wherein the proxy server stores a pair of an IP address and a virtual IP address. And a second step of transmitting a second connection request signal from the server to the communication terminal via the proxy server.

Further, the first step includes a step of receiving a first connection request signal addressed to the server from the communication terminal, and a step of receiving the virtual IP address corresponding to the IP address.
Selecting an address, storing the pair of the IP address and the virtual IP address in the IP address correspondence management table, and transmitting the first connection request signal using the virtual IP address as a connection source IP address. Transmitting from the terminal to the server.

Further, the second step is a step of receiving the second connection request signal addressed to the communication terminal from the server, and the second connection request signal is the virtual I
Acquiring the IP address from the IP address correspondence management table in accordance with the second connection request signal, the second connection request to the communication terminal having the IP address. Transmitting a signal.

[0020]

Embodiments of the present invention will be described below in detail with reference to the accompanying drawings. FIG. 1 shows an embodiment of an IP address conversion apparatus and a conversion method in a proxy server according to the present invention. This embodiment provides a means by which a connection destination AP server can access a connection source IP address hidden by a proxy server.

Referring to FIG. 1, proxy server 2 has an IP
It has an address correspondence management table 10 and an IP address conversion means 20. The following IP address correspondence management table 10
The concept of the IP address conversion means 20 using the IP address will be described.

It is assumed that the connection source terminal (communication terminal) 1 connects the communication connections 8 and 9 to the AP server (server) 3 via the proxy server 2. The connection source terminal 1
The proxy server 2 has a P address 4 and a virtual IP address (hereinafter, virtual I
The AP server 3 has an IP address 7 (referred to as a P address) 61 to 6n (n is an integer of 1 or more). When the proxy server 2 receives the first connection request signal (not shown) for the IP address 5 through the communication connection 8, the proxy server 2 selects one appropriate virtual IP address 6k from the virtual IP addresses 61 to 6n. , The virtual IP address 6
A first connection request signal (not shown) is transmitted by the communication connection 9 to the AP server 3 using k as a connection source IP address. At this time, a pair of the connection source IP address 4 of the communication connection 8 and an appropriately selected virtual IP address 6k is stored in the IP address correspondence management table 10.

With this, if the AP server 3 transmits a second connection request signal (not shown) to the virtual IP address 6k of the proxy server 2 through the communication connection 11 thereafter, the IP address Since the IP address 4 of the connection source terminal 1 paired with the received IP address 6 k can be acquired by referring to the correspondence management table 10, the second connection is made to the IP address 4 by the communication connection 12. A request signal (not shown) can be sent.

Therefore, even if the IP address 4 of the connection source terminal 1 is hidden in the proxy server 2, the AP server 3
From the connection source terminal 1 to the connection source terminal 1 can be connected.

First, according to the first embodiment of the present invention,
A P-address translation device and its translation method will be described with reference to the drawings. FIG. 2 shows the overall configuration of the IP address translation device and its translation method.

Referring to FIG. 2, in the present embodiment, connection source terminal 1 (communication terminal)
It is assumed that the P server (server) 3 is connected by the communication connections 8 and 9.

The connection source terminal 1 has an IP address 4, and the proxy server 2 has a virtual IP address in addition to the IP addresses 5 and 60.
It has addresses 61 and 62, and the AP server 3 has an IP address 7. When the proxy server 2 receives a first connection request signal (not shown) for the IP address 5 via the communication connection 8, the proxy server 2 selects the virtual IP address 61 and uses the virtual IP address 61 as the connection source IP address.
A first connection request signal (not shown) is transmitted to the server 3 via the communication connection 9. At this time, a pair of the connection source IP address 4 of the communication connection 8 and the selected virtual IP address 61 is stored in the IP address correspondence management table 10.

Thus, if the AP server 3 transmits a second connection request signal (not shown) to the virtual IP address 61 of the proxy server 2 via the communication connection 11 thereafter, the IP address is With reference to the correspondence management table 10, the received IP address 61
Because the IP address 4 of the connection source terminal 1 paired with the IP address 4 can be acquired, a second connection request signal (not shown) can be transmitted to the IP address 4 by the communication connection 12. .

Therefore, even if the IP address 4 of the connection source terminal 1 is hidden by the proxy server 2, a communication connection from the AP server 3 to the connection source terminal 1 can be connected.

Next, the operation of the IP address translation apparatus and the translation method according to the first embodiment will be described. 3 and 4 are flowcharts showing the operation of the IP address conversion method. Referring to FIG. 2 and FIGS. 3 and 4, first, in step 31 shown in FIG. 3, the proxy server 2 issues a first connection request to the IP address 5 through the communication connection 8 to the AP server 3. Accept the signal.
In step 32, the virtual IP address 61 is selected from the virtual IP addresses 61 and 62 for the AP server 3. In step 33, the virtual IP address 61 selected here,
The connection source IP address 4 is changed to I
It is stored in the P address correspondence management table 10. Next, in step 34, a first connection request signal is transmitted by the communication connection 9 to the AP server 3 using the virtual IP address 61 as a connection source IP address.

After the steps shown in FIG. 3, the operation shown in FIG. 4 will be described below. In step 41 shown in FIG.
P server 3 has a virtual IP address 61 of proxy server 2
A second connection request signal is transmitted to the proxy server 2 via the communication connection 11. In step 42,
The IP address 4 of the connection source terminal 1 paired with the received IP address 61 can be obtained from the IP address correspondence management table 10. Thus, Step 4
At 3, a second connection request signal can be transmitted to the IP address 4 via the communication connection 12.

Therefore, even if the IP address 4 of the connection source terminal 1 is hidden by the proxy server 2, the access from the AP server 3 to the connection source terminal 1 becomes possible. The I
The P address correspondence management table can be set in a storage area that should be exclusively used by the proxy server, and can be refused from external access.

Next, according to the second embodiment of the present invention,
1 shows an overall configuration of a P-address translation device and its translation method. Referring to FIG. 5, this embodiment has the same configuration as the proxy server 2 in the first embodiment shown in FIG.
The difference is that a proxy server 2a having 1a and 62a is added.

When the proxy server 2a receives the first connection request signal (not shown) by the communication connection 9 with respect to the IP address 5a, the proxy server 2a selects the virtual IP address 61a, and uses the virtual IP address 61a as the connection source IP address. Communication connection 9 to 3 (server)
A first connection request signal (not shown) is transmitted by a.
At this time, the pair of the connection source virtual IP address 61 and the selected virtual IP address 61a is
It is stored in the P address correspondence management table 10a.

Next, the operation of the IP address translation apparatus and the translation method according to the second embodiment will be described. Referring to the flowcharts shown in FIGS. 3, 6, and 7 while referring to FIG. 5, first, in step 31 shown in FIG. 3, the proxy server 2 sends the IP address 5 from the connection source terminal (communication terminal) 1 to the IP address 5. A first connection request signal (not shown) is received by the communication connection 8 to the AP server (server) 3. In step 32, the virtual IP for the AP server 3
The virtual IP address 61 is selected from the addresses 61 and 62. In step 33, the virtual IP address 61 selected above and the connection source IP address 4 are stored in the IP address correspondence management table 10 by the communication connection 8. Further, in step 34, the virtual IP address 61 is changed to the connection source IP.
Communication connection 9 to AP server 3 as address
Transmits a first connection request signal (not shown).

Next, in step 61 shown in FIG. 6, the proxy server 2a receives a first connection request signal (not shown) for the IP address 5a through the communication connection 9 to the AP server 3. In step 62, the AP server 3
The virtual IP address 61a is selected from the virtual IP addresses 61a and 62a for the destination. In step 63, the virtual IP address 61a selected above and the connection source virtual IP address 61 through the communication connection 9 are stored in the IP address correspondence management table 10a. Then, in step 64, the virtual IP address 61a is set as the connection source IP address and the first connection is made to the AP server 3 by the communication connection 9a.
Is transmitted (not shown).

As a result, in step 71 shown in FIG. 7, the AP server 3 communicates with the virtual IP address 61a of the proxy server 2a via the communication connection 11a.
Is transmitted to the proxy server 2a. In step 72, the virtual IP address 61 of the proxy server 2 paired with the IP address 61a received from the IP address correspondence management table 10a is transmitted. Since it can be obtained, in step 73, a second connection request signal (not shown) can be transmitted to the virtual IP address 61 by the communication connection 11.

Then, in step 41 shown in FIG. 4, the proxy server 2 receives the second connection request signal (not shown). In step 42, the proxy server 2 combines the IP address 61 with the IP address 61 received from the IP address correspondence management table 10. Since it is possible to acquire the IP address 4 of the connection source terminal 1, a second connection request signal (not shown) is transmitted to the IP address 4 by the communication connection 12 in step 43. it can.

In other words, the access from the AP server 3 to the connection source terminal 1 is possible in the proxy server 2a as well as in the proxy server 2 even though the IP address 4 of the connection source terminal 1 is hidden.

In the same manner as in the present embodiment, even in a system in which three or more proxy servers intervene, by adding a relay process corresponding to the added proxy server, the relay from the AP server 3 to the connection source terminal 1 can be performed. Access becomes possible. It should be noted that the IP address correspondence management table can be set in a storage area to be exclusively used by each proxy server in the firewall, and can be refused for access from other parties.

[0041]

According to the IP address conversion apparatus and the conversion method of the present invention, even when the communication connection is connected via the proxy server, even if the IP address of the connection source terminal is hidden by the proxy server. , AP to connect to
It is possible to connect a communication connection from the server to the connection source terminal.

The reason is that the correspondence between the IP address of the connection source terminal and the virtual IP address selected by the proxy server is stored when the communication connection from the connection source terminal to the AP server is established, so that the connection destination If there is a connection request for a communication connection from the AP server to the virtual IP address, the IP address of the connection source terminal is acquired in accordance with the stored IP address correspondence, and a connection request for the communication connection is made to the connection source terminal. Can be transmitted. In addition, it is possible to eliminate the fear that the IP address to be concealed may be leaked from the tables necessary to produce the above-described effects.

[Brief description of the drawings]

FIG. 1 is a diagram showing an overall configuration of an IP address conversion system in a proxy server for illustrating the principle of the present invention.

FIG. 2 is a diagram showing an overall configuration of an IP address conversion method in a proxy server according to the first embodiment of the present invention.

FIG. 3 is a flowchart showing an operation of an IP address conversion method in the proxy server according to the first and second embodiments of the present invention.

FIG. 4 is another flowchart showing the operation of the IP address conversion method in the proxy server according to the first embodiment of the present invention.

FIG. 5 is a diagram showing an overall configuration of an IP address conversion method in a proxy server according to a second embodiment of the present invention.

FIG. 6 is another flowchart showing the operation of the IP address conversion method in the proxy server according to the second embodiment of the present invention.

FIG. 7 is another flowchart illustrating the operation of the IP address conversion method in the proxy server according to the second embodiment of the present invention.

[Explanation of symbols]

 1: Connection source terminal (communication terminal) 2, 2a: Proxy server 3: AP server (server) 4: IP address of connection source terminal 5, 60, 5a, 60a: IP address 7: IP address of AP server 8, 9 , 11, 12, 9a, 11a: communication connection 10, 10a: IP address correspondence management table 20, 20a: IP address conversion means 61, 62, 61a, 62a: virtual IP address

Claims (8)

[Claims] 1. An IP address correspondence management table, wherein the IP address correspondence management table includes an IP address of a communication terminal and a virtual IP selected as a pseudonym for the IP address.
In response to a first connection request signal from a communication terminal to a server, the communication terminal selects the virtual IP address as a pseudonym for the IP address of the communication terminal, and The virtual IP address is associated with the IP
The virtual IP address is stored in an address correspondence management table, and the virtual IP address is transmitted to the server together with the first connection request signal instead of the IP address of the communication terminal. 2 in response to the connection request signal, the IP address correspondence management table is referred to, and the I address corresponding to the virtual IP address is referred to.
An IP address conversion device, comprising: an IP address conversion means for acquiring a P address and transmitting the second connection request signal to the communication terminal. 2. The IP address correspondence management table according to claim 1, wherein
2. The IP address conversion device according to claim 1, wherein the IP address conversion device is provided in a storage area to be occupied by the proxy server, and is capable of denying external access to the proxy server. 3. A communication terminal, comprising: a server; a proxy server connected to the communication terminal and the server;
A proxy server unit configured to transmit a first address from the communication terminal to the server;
In response to the connection request signal, selects a virtual IP address as a pseudonym for the IP address of the communication terminal, stores the IP address of the communication terminal and the virtual IP address in association with each other, The virtual IP address is transmitted to the server together with the first connection request signal in place of the IP address, and conversely, the virtual IP address is transmitted in response to a second connection request signal for the virtual IP address from the server. An IP address conversion network system, comprising: acquiring the IP address corresponding to an address; and transmitting the second connection request signal to the communication terminal. 4. The IP server, wherein the proxy server unit is configured by a pair of the IP address and the virtual IP address.
4. The IP address conversion network system according to claim 3, further comprising an address correspondence management table. 5. The proxy server unit according to claim 3, wherein the proxy server unit includes a plurality of proxy servers, and the IP address correspondence management table is provided in a storage area of the proxy server. An IP address conversion network system using the proxy server described above. 6. A first step of transmitting a first connection request signal from a communication terminal to a server to be connected via a proxy server, wherein the proxy server stores a pair of an IP address and a virtual IP address. A second step of transmitting a second connection request signal from the server to the communication terminal via the proxy server, the IP address conversion method having an IP address correspondence management table. 7. The first step includes: receiving a first connection request signal addressed to the server from the communication terminal; selecting the virtual IP address corresponding to the IP address; Storing a pair of an address and the virtual IP address in the IP address correspondence management table; and transmitting the first connection request signal from the communication terminal to the server using the virtual IP address as a connection source IP address. 7. The IP address conversion method according to claim 6, comprising: 8. The method according to claim 8, wherein the second step is a step of receiving the second connection request signal addressed to the communication terminal from the server, and the second connection request signal has the virtual IP address. According to the second connection request signal,
7. The method according to claim 6, further comprising: obtaining the IP address from the IP address correspondence management table; and transmitting the second connection request signal to the communication terminal having the IP address. IP
Address translation method.