JP5307264B2 - Communications system - Google Patents

Description

  The present invention relates to a communication data control technique.

In order to control communication data, a communication device such as a firewall (hereinafter referred to as FW) or an L3 switch is introduced. In particular, when constructing a communication system in which a plurality of tenants (such as companies) are connected, a large communication device having a large number of connection ports and high processing capacity has been introduced to control communication data transmitted from a large number of terminals. The Depending on the number of terminals connected to the communication system, the number of servers to be connected and the required processing capacity are different, so that the scale of necessary communication devices is different.
Although the number of tenants is small at the beginning of the construction of the communication system, the number of tenants may gradually increase. In this case, a large communication device is unnecessary at the beginning of the construction of the communication system, but a large communication device is necessary when the number of tenants increases. However, it takes time to replace a communication device once installed with another communication device, and the communication device installed at first may be wasted, so it is common to introduce a large communication device from the beginning. Is.

Japanese translation of PCT publication No. 2004-503011 JP 2010-287116 A

Despite the small number of connected tenants, introducing a large communication device is costly. In addition, when a new tenant is connected to the communication device, it is necessary to change the setting of the communication device. However, as the number of tenants connected to the communication device increases, the setting change operation increases and the workload is reduced. large.
An object of the present invention is to flexibly support the number of connected tenants and the like.

A communication system according to the present invention includes:
A communication system in which a plurality of communication devices that limit data to be passed are mesh-connected,
Each communication device
Storing a rule of communication data passed by the own communication device as a self-passing rule, and a passing rule storage unit for storing the rule of another communication device that passes the communication data passed by the own communication device as another passing rule;
A rule receiving unit for receiving the rule of a newly connected new communication device as a new passing rule;
When the rule receiving unit receives a new passing rule, a rule determining unit that determines whether or not the self-passing rule stored in the passing rule storage unit passes communication data that passes through the new passing rule;
When the rule determining unit determines that the self-passing rule passes, a rule transmitting unit that transmits the new passing rule to another connected communication device;
With
The said passage rule memory | storage part memorize | stores the said new passage rule as another passage rule, when the said rule determination part determines with making it pass.

The rule transmission unit is a communication device in which the own communication device is directly connected to the new communication device, and when the rule determination unit determines that the own passage rule passes, the passage rule storage unit stores The self-passing rule and the other passing rule are transmitted to the new communication device.

The rule determination unit determines whether or not the other passing rule of each connected other communication device passes the communication data to be passed by the new passing rule,
The rule transmission unit transmits the new passage rule only to other communication devices determined to be passed by the rule determination unit among other connected communication devices.

The rule defines a group that allows the communication data to pass through;
The communication system further includes:
A data receiver for receiving communication data from the connected device;
A data determination unit that determines whether or not a group to which a transmission source device of communication data received by the data reception unit belongs is a group that the self-passing rule determines to pass communication data;
When the data determination unit determines that the group is determined to pass, the data determination unit includes a data transmission unit that transmits the communication data to a transmission destination and transmits the communication data to another connected communication device.

The data transmission unit transmits identification data of a group to which the transmission source device belongs to the communication data, and then transmits the communication data to another communication device.

The data transmission unit of the communication device that has received communication data from a connected device has communication data in which the first group to which the transmission source device belongs and the second group to which the transmission destination device belongs are different from each other. When received, the communication data is transmitted to another communication device having a rule determined to pass both the first group and the second group,
The data transmission unit of the communication device having a rule that determines that both groups are allowed to pass the communication data in which the first group to which the transmission source device belongs and the second group to which the transmission destination device belongs are differently communicated. When the communication data is received from the device, the communication data is transmitted to the other communication device connected to the transmission destination.

When there are a plurality of other communication devices connected, the data transmission unit divides the communication data into a plurality of child communication data, and transmits each child communication data to a different other communication device. And

  The communication system according to the present invention is configured by mesh-connecting a plurality of communication devices. Therefore, when the number of tenants increases, the scale can be increased by connecting a new communication device. Therefore, it is not necessary to introduce a large communication device when the number of connected tenants is small, and the cost burden is small. Further, when a new communication device is connected, the passing rules of the communication device are sequentially copied to other communication devices. Therefore, only the setting relating to the communication device needs to be performed, and the workload is small.

1 is a configuration diagram of a communication system 100 according to Embodiment 1. FIG. 1 is a conceptual diagram of a network system configured by a communication system 100 according to Embodiment 1. FIG. 1 is a configuration diagram of a communication device 10 according to Embodiment 1. FIG. The figure which shows the range which the passage rule memory | storage part 11 memorize | stores another passage rule. 3 is a flowchart showing an operation of the communication system 100 when a communication device 10 is newly connected to the communication system 100 according to the first embodiment. 3 is a flowchart showing processing at the time of transmission of communication data in the communication system 100 according to the first embodiment. The figure which shows the passage rule in the case of determining whether to let communication data pass by the combination of the kind of service and a company. The conceptual diagram of the network system which the communication system 100 comprises when a passage rule is prescribed | regulated as shown in FIG. The figure which shows the passage rule which concerns on Embodiment 2. FIG. The conceptual diagram of the network system which the communication system 100 comprises when a passage rule is prescribed | regulated as shown in FIG. 9 is a flowchart showing processing at the time of transmission of communication data in the communication system 100 according to the second embodiment. FIG. 10 is a diagram showing a communication data transfer route according to the third embodiment. The figure which shows an example of the hardware constitutions of the communication apparatus.

Embodiment 1 FIG.
FIG. 1 is a configuration diagram of a communication system 100 according to the first embodiment.
In the communication system 100, a plurality of communication devices 10 are mesh-connected (multipoint connection network connection). Here, 25 communication devices 10 from ID011 to ID055 are mesh-connected. In addition, here, the communication devices 10 arranged on the top, bottom, left, and right are connected to each other. For example, the communication device 10 of ID022 is connected to the upper ID021, the lower ID023, the left ID012, and the right ID032. For simplicity, it is assumed that the communication devices 10 arranged vertically and horizontally are connected to each other. However, even if the communication devices 10 arranged obliquely are connected to each other, the communication devices 10 at remote positions are connected to each other. It may be connected.
Some of the communication devices 10 are connected to a server 20-25 and a terminal 30-32. The server 20 is a mail server for company A, the server 21 is a web server for company A, the server 22 is a mail server for company B, and the server 23 is a web server for company B. Yes, the server 24 is a mail server for company C, and the server 25 is a web server for company C. The terminal 30 is a company A terminal, the terminal 31 is a company B terminal, and the terminal 32 is a company C terminal.
Each communication device 10 is assigned to one of the companies (an example of a group). Some communication apparatuses 10 are assigned to a plurality of companies. Specifically, the communication device 10 included in the partial system 40 is assigned to the company A, the communication device 10 included in the partial system 41 is assigned to the company B, and the communication included in the partial system 42. The device 10 is assigned to company C. Communication devices 10 included in a plurality of partial systems are assigned to a plurality of companies.

FIG. 2 is a conceptual diagram of a network system configured by the communication system 100 according to the first embodiment.
The communication system 100 constitutes three network systems, partial systems 40, 41, and 42. In the example of FIG. 1, these three network systems are partly physically shared, but are virtually separated as a whole, and form different security layers.
That is, the communication data flowing through the partial system 40 does not flow through the partial systems 41 and 42, the communication data flowing through the partial system 41 does not flow through the partial systems 40 and 42, and the communication data flowing through the partial system 42 does not flow. The partial systems 40 and 41 do not flow.

FIG. 3 is a configuration diagram of the communication apparatus 10 according to the first embodiment.
The communication device 10 includes a passage rule storage unit 11, a rule reception unit 12, a rule determination unit 13, a rule transmission unit 14, a data reception unit 15, a data determination unit 16, and a data transmission unit 17.

The passage rule storage unit 11 is a storage device that stores passage rules of communication data that the communication device 10 passes. The passing rule storage unit 11 stores the passing rule of itself (own communication device 10) as the own passing rule, and stores the passing rule of other communication device 10 (other communication device 10) as the other passing rule.
Here, if the same company is specified as the transmission source and destination of communication data, and the transmission rule is the terminal and server of the company to which the transmission source and destination are assigned, communication Data shall be passed.

FIG. 4 is a diagram illustrating a range in which the passage rule storage unit 11 stores other passage rules. In FIG. 4, the range stored in the passage rule storage unit 11 included in the communication device 10 with ID0053 is shown as an example.
The range in which the other pass rule is stored is a range through which communication data that passes through the own pass rule can pass. That is, the rule of the communication device 10 to which the company to which it is assigned is assigned is stored as the other pass rule. In the example of FIG. 4, since the communication device 10 with ID0053 is assigned to the company A, the rules of the other communication devices 10 assigned to the company A are stored as other passing rules.

FIG. 5 is a flowchart showing the operation of the communication system 100 when the communication device 10 (new communication device 10) is newly connected to the communication system 100 according to the first embodiment.
Before the new communication device 10 is connected to the communication system 100, the new communication device 10 is assigned an ID and is assigned to any company by an administrator or the like. In the passage rule storage unit 11 included in the new communication device 10, the same company is specified as the transmission source and the transmission destination of the communication data, and the transmission source and the transmission destination are the terminal and server of the assigned company. If it is, a rule (new passage rule) for passing communication data is stored.
The new communication device 10 is installed together with the new terminal in accordance with the installation timing of the new terminal, and is connected to the new terminal.

(S11: Authentication process)
The rule receiving unit 12 of the communication device 10 to which the new communication device 10 is connected receives the new passage rule from the new communication device 10. Then, the rule determination unit 13 of the communication apparatus 10 determines whether or not the own passing rule passes the communication data that is passed by the new passing rule.
If it is determined that the self-passing rule passes, the new communication device 10 is authenticated (YES in S11), and the process proceeds to S12. On the other hand, if it is determined that the self-passing rule does not pass, the new communication device 10 is not authenticated (NO in S11), and the process is terminated.

(S12: Rule exchange process)
The passage rule storage unit 11 of the communication device 10 that has received the new passage rule stores the received new passage rule as another passage rule.
Further, the rule transmission unit 14 of the communication device 10 to which the new communication device 10 is connected transmits the rules (the own passage rule and the other passage rules) stored in the passage rule storage unit 11 to the new communication device 10. Then, the passage rule storage unit 11 of the new communication device 10 stores the received rule as another passage rule.

(S13: Connection device determination process)
The rule determination unit 13 of the communication device 10 that has received the new passage rule determines whether there is another directly connected communication device 10 other than the transmission source of the new passage rule.
If it is determined that there is another communication device 10 (YES in S13), the process proceeds to S14. On the other hand, if it is determined that there is no other communication device 10 (NO in S13), the process is terminated.

(S14: Rule transmission process)
The rule transmission unit 14 that has received the new passage rule transmits the new passage rule to the directly connected other communication device 10.

(S15: Rule determination process)
The other communication device 10 that has received the new passage rule determines whether or not the communication data to be passed according to the new passage rule passes through the own passage rule.
If it is determined that the self-passing rule passes (YES in S15), the process proceeds to S16. On the other hand, if it is determined that the self-passing rule does not pass (NO in S15), the process is terminated.

(S16: Rule storage process)
The passage rule storage unit 11 of the other communication device 10 that has received the new passage rule stores the new passage rule as the other passage rule.
Then, the process returns to S13, and the rule determination unit 13 of the other communication device 10 that has received the new passage rule determines whether there is another communication device 10 that is directly connected.

For example, the operation when the communication device 10 with ID061 is connected as the new communication device 10 together with the new terminal to the communication device 10 with ID051 shown in FIG. 1 is as follows.
It is assumed that the communication device 10 with ID 061 is assigned to company A. Further, the passage rule storage unit 11 of the communication device 10 of ID061 has the company A designated as the transmission source and transmission destination of the communication data, and the transmission source and transmission destination are the terminal and server of the company A. Stores a passage rule (new passage rule) for passing communication data.

First, the communication device 10 of ID051 receives the new passage rule from the communication device 10 of ID061, and determines whether or not the communication data to be passed by the new passage rule is passed by the own passage rule (S11). Here, since the communication device 10 of ID051 belongs to the company A and the own passage rule passes (YES in S11), the received new passage rule is stored as the other passage rule, and the communication device 10 of ID061 The passing rule stored in the communication device 10 of ID051 is stored as another passing rule (S12).
Next, the communication device 10 of ID051 determines whether there is a directly connected communication device 10 other than the communication device 10 of ID061 (S13). Here, since the communication device 10 of ID041 and ID052 is connected (YES in S13), the communication device 10 of ID051 transmits a new passage rule to the communication device 10 of ID041 and ID052 (S14). Then, the communication device 10 of ID041 and ID052 determines whether or not the self-passing rule passes the communication data that is passed by the new passing rule (S15). Here, since the communication devices 10 of ID041 and ID052 all belong to the company A and the own passage rule passes (YES in S15), the received new passage rule is stored as the other passage rule (S16).

Next, each of the communication devices 10 of ID041 and ID052 determines whether there is a directly connected communication device 10 other than the communication device 10 of ID051 (S13).
Here, the communication device 10 of ID041 and ID042 is connected to the communication device 10 of ID041, and the communication device 10 of ID042 and ID053 is connected to the communication device 10 of ID052 (YES in S13). Therefore, the communication device 10 of ID041 transmits a new passage rule to the communication device 10 of ID031 and ID042, and the communication device 10 of ID052 transmits the new passage rule to the communication device 10 of ID042 and ID053 (S14).
Then, the communication device 10 of ID031, ID042, and ID053 determines whether or not the communication data to be passed according to the new passage rule passes through the own passage rule (S15). Since the communication device 10 of ID042 receives the new passage rule from the two communication devices 10 of ID041 and ID052, either one may be discarded. Here, since all the communication devices 10 of ID031, ID042, and ID053 allow the self-passing rule to pass (YES in S15), the received new passing rule is stored as another passing rule (S16).

Next, each of the communication devices 10 of ID031, ID042, and ID053 determines whether there is a directly connected communication device 10 other than the communication device 10 that is the transmission source of the new passage rule (S13). The communication device 10 that is the transmission source of the new passage rule is the communication device 10 of ID041 if it is the communication device 10 of ID031, and the communication device 10 of ID041 and ID052 if it is the communication device 10 of ID042. The communication device 10 with ID053 is the communication device 10 with ID052.
Here, the communication device 10 of ID021, ID032 is connected to the communication device 10 of ID031, the communication device 10 of ID032, ID043 is connected to the communication device 10 of ID042, and the communication device 10 of ID053. Is connected to the communication device 10 of ID043 and ID054. Therefore, the communication device 10 of ID031 transmits the new passage rule to the communication device 10 of ID021, ID032, the communication device 10 of ID042 transmits the new passage rule to the communication device 10 of ID032, ID043, and the communication device of ID053. 10 transmits the new passage rule to the communication device 10 of ID043 and ID054 (S14).
Then, the communication devices 10 of ID021, ID032, ID043, and ID054 determine whether or not the communication data that is passed by the new passage rule is passed by the own passage rule (S15). In addition, since the communication device 10 of ID032 and ID043 receives the new passage rule from the plurality of communication devices 10, only one may be left and the others may be discarded. Here, the communication device 10 of ID021, ID032, and ID043 stores the received new passage rule as another passage rule because the own passage rule passes (YES in S15) (S16). On the other hand, the communication device 10 with ID 054 does not pass the self-passing rule (NO in S15), so the received new passing rule is not stored, and the process for the communication device 10 with ID 054 ends.

The new passage rule is stored in all the communication devices 10 belonging to the partial system 40 by repeating the above processing until the processing for all the communication devices 10 is completed.
In other words, by performing the processing shown in FIG. 5, the communication data that is passed by the new passage rule is stored in the communication device 10 that similarly passes the communication data, and the communication data that is passed by the new passage rule is the same. The passage rule of the communication device 10 to be passed through is stored in the new communication device 10.

FIG. 6 is a flowchart showing processing at the time of transmission of communication data in the communication system 100 according to the first embodiment.
(S21: Data reception processing)
The data receiving unit 15 of the communication device 10 to which the terminal is directly connected receives communication data from the terminal.

(S22: Data determination process)
The data determination unit 16 of the communication device 10 to which the terminal is directly connected (entrance communication device 10) determines whether or not the self-passing rule passes the communication data. That is, in the data determination unit 16, the same company is specified as the transmission source and the transmission destination of the communication data, and the transmission source and the transmission destination are the company terminal and server assigned to the own communication device 10. It is determined whether or not.
If it is determined to pass (YES in S22), the process proceeds to S23. On the other hand, if it is determined not to pass (NO in S22), the communication data is discarded and the process is terminated.

(S23: Reconfiguration process)
The data transmission unit 17 of the entrance communication device 10 adds the company ID to which the transmission destination server is assigned and the company ID to which the transmission source terminal is assigned to the communication data to reconfigure the communication data.

(S24: Data transmission processing)
The data transmission unit 17 of the entrance communication device 10 performs routing to the destination server, and transmits the reconfigured communication data to the next communication device 10 according to the routing. At this time, the data transmission unit 17 also transmits the route information obtained by the routing together with the communication data.
In the routing, a route that passes only the communication device 10 that passes the communication data received in S21 is specified based on the other pass rule.

(S25: Data transfer process)
The communication device 10 that has received the communication data transmits the communication data to the next communication device 10 in accordance with the route information.
By repeating S25, the communication data finally reaches the destination server.

For example, the operation when the terminal 30 connected to the communication device 10 with the ID 053 shown in FIG. 1 transmits communication data to the server 21 is as follows.
First, the communication device 10 with ID 053 receives communication data from the terminal 30 whose transmission source is the terminal 30 and whose transmission destination is the server 21 (S21). Then, the communication device 10 with ID 053 determines whether or not the self-passing rule allows communication data to pass (S22). Here, the transmission source and the transmission destination are the same company A, and the self-passing rule of the communication device 10 with ID 053 is to pass the communication data of the transmission source and transmission destination company A (YES in S22). Reconfiguration is performed (S23).

Then, the communication device 10 of ID053 performs routing (here, it is assumed that the route of ID053, ID052, ID042, ID032, ID022, ID012, and the server 21 is obtained as a result of routing), and the communication device 10 of the next ID052 is obtained. The communication data is transmitted to (S24).
Then, according to the routing result, the communication data is transmitted in the order of ID052, ID042, ID032, ID022, and ID012, and finally the communication data is transmitted to the server 21 (S25).

By performing the processing shown in FIG. 6, the communication data determined to be passed by the entrance communication device 10 is sent to the destination server, and the communication data determined not to be passed by the entrance communication device 10 is the communication system. It is discarded without flowing through 100.
In S23 of the flowchart shown in FIG. 6, the data transmission unit 17 of the communication device 10 at the entrance adds the company ID to which the transmission destination server is assigned and the company ID to which the transmission source terminal is assigned to the communication data. The communication data is reconstructed. However, the processing of S23 may be configured to be performed by all the communication devices 10. At that time, the company ID is overwritten each time in each communication device 10. In addition, the communication data may be configured by adding, to the communication data, a company ID to which a transmission destination server is assigned to communication data and a company ID to which a transmission source terminal is assigned.

As described above, the communication system 100 according to Embodiment 1 is configured by mesh-connecting a plurality of communication devices 10, and the communication device 10 at the entrance determines whether or not communication data is allowed to pass. Therefore, when the number of connected terminals increases and the processing load increases, it is possible to cope with the problem by increasing the number of communication devices 10.
Therefore, at the time of system construction, it is possible to configure the communication system 100 with a small number of communication devices 10 and add the communication devices 10 as the number of tenants (number of terminals) increases. Thereby, it is possible to cope with an increase in the number of tenants (number of terminals) while suppressing the initial cost of the system.

In addition, in the communication system 100, when a communication device 10 is added, if a new passage rule is set for the communication device 10 to be added, the communication device 10 is automatically copied to other necessary communication devices 10. Therefore, the complicated setting work that tends to occur in a large FW or the like is not necessary, and only the minimum setting work needs to be performed, so that the work load related to the setting can be reduced.
In addition, the other passing rule of the other communication apparatus 10 which similarly passes the communication data which each communication apparatus 10 passes by a self-passing rule is memorize | stored. Therefore, when communication data is received, routing to the transmission destination becomes possible.

Since only the communication data of the company to which each communication device 10 is assigned is passed, the network for each company can be physically separated, and conversely, the network is physically shared between the companies and virtually separated. You can also.
As a result, it is possible to flexibly cope with increasing security and reducing costs.

Moreover, in the communication system 100, it is automatically copied to the other communication apparatus 10 which requires a passage rule. Therefore, if one communication device 10 fails, the communication device 10 that has failed in another communication device 10 can be replaced. Therefore, it is possible to recover from a temporary failure by simply reconnecting the cable.
If the communication device 10 at the entrance breaks down, the company ID assigned to the destination server and the company ID assigned to the source terminal described in S23 are added to the communication data, and the communication data is changed. The reconfiguration process is performed by the communication device 10 at a new entrance connected to the terminal. The communication device 10 can determine whether the device connected by the port to which the cable is connected is a terminal or another communication device 10. Therefore, by confirming whether or not to execute the process of S23 by confirming the port position, any communication device 10 can be replaced with the communication device 10 at the entrance.
Also, some communication devices 10 can have a redundant configuration. Depending on the communication device 10 that has failed, the communication system 100 as a whole may not be affected.
In general, compared to a large FW, etc., a small FW is a general-purpose product, and is a stable product that is less likely to cause a failure. Therefore, the frequency of failure occurrence can be reduced.

In addition, a plurality of company terminals are connected to the communication system 100. Generally, in each company, a private address is assigned to a terminal instead of a global address as an IP address, and the IP address may overlap between companies. However, in the communication system 100, the communication device 10 at the entrance reconfigures the communication data in S23 and assigns a company ID to the communication data. Therefore, even if IP addresses are duplicated between companies, it is possible to uniquely identify a terminal.
For example, in FIG. 1, the communication device 10 of ID021, ID022, ID031, and ID032 allows both company A and B communication data to pass through. Here, it is assumed that the same IP address is assigned to the terminal 30 connected to ID052 and the terminal 31 connected to ID021. In this case, the communication device 10 of ID021, ID022, ID031, and ID032 specifies whether the communication data is transmitted from the terminal 30 connected to ID052 or the terminal 31 connected to ID021 only with the IP address. Can not. However, the communication device 10 at the entrance reconfigures the communication data and assigns a company ID to the communication data, so that it can be specified from which communication data is transmitted.

In S11 shown in FIG. 5, a new passage rule is received from the new communication device 10, and the new communication device 10 is authenticated based on the received new passage rule. However, in this case, an unauthorized communication device 10 may be connected.
Therefore, when setting a new passing rule or the like in the new communication device 10, a secret key in the public key cryptosystem is also set, and the new communication device 10 creates a signature based on the secret key at the time of authentication and is connected. Transmit to the communication device 10. The communication device 10 that has received the signature may verify the signature with the public key corresponding to the secret key, and may perform authentication based on the new passage rule when the signature is confirmed.

  In the process shown in FIG. 6, it is determined whether or not communication data is allowed to pass only by the communication device 10 at the entrance. However, it may be determined whether or not the communication data is passed by each communication device 10 through which the communication data passes.

  In the above description, whether or not to allow communication data to pass is determined by the communication data transmission source and transmission destination companies. However, whether or not the communication data is allowed to pass may be determined based on the combination of the communication data service type and the communication data transmission source and transmission destination companies.

FIG. 7 is a diagram illustrating a passing rule when determining whether or not to allow communication data to pass according to a combination of a service type and a company. In FIG. 7, the passing rules of the communication device 10 of ID021, ID022, ID031, and ID032 are shown as an example.
It is assumed that the communication devices 10 of ID021, ID022, ID031, and ID032 belong to companies A and B. For this reason, the passing rules include companies A and B as companies to be passed. Here, in the passing rule, for company A, mail and web are passed as services, and for company B, only the web is passed as services.
That is, the communication data transmission source and transmission destination are company A and the service is mail or web, and the communication data transmission source and transmission destination are company B and the service is web. It is stipulated that data be passed.
As described above, it is possible to control communication data more finely by determining whether or not to allow communication data to pass through depending on the combination of service type and company.

FIG. 8 is a conceptual diagram of a network system configured by the communication system 100 when passing rules are defined as shown in FIG.
The communication system 100 constitutes three network systems, partial systems 40, 41, and 42. The partial systems 40, 41, and 42 are further divided into network systems that are virtually separated for each service.

  In addition, the passing rule transmission process described in FIG. 5 and the communication data transmission process described in FIG. 6 are performed asynchronously. Further, although the passage rule and the communication data are communicated within one cable, the data may include identification information, and the passage rule may be communicated with priority over the communication data. With such a configuration, priority is given to the control between the communication devices 10.

Embodiment 2. FIG.
In the first embodiment, the condition that the communication data is allowed to pass is that the same company is specified as the transmission source and the transmission destination of the communication data. However, there may be a case where communication data is transmitted across companies. In the second embodiment, a process for transmitting communication data across companies will be described.
The communication system 100 according to the second embodiment will be described focusing on differences from the communication system 100 according to the first embodiment.

FIG. 9 is a diagram illustrating a passing rule according to the second embodiment. In FIG. 9, the passing rule of the communication device 10 with ID 043 is shown as an example.
The communication device 10 with ID 043 is assumed to belong to companies A and C. Therefore, the passage rules include companies A and C as companies to be passed. Here, in the passage rule, both companies A and C are allowed to pass mail and web as services. That is, when the transmission source of communication data is company A or company C and the service is mail or web, the communication data is allowed to pass.
Further, regarding the web in the rules of Company A, Company C is defined as a tunnel destination. The tunnel destination indicates a company to which communication data is transferred. That is, when the transmission source of the communication data is the company A and the service is the web, the communication data can be transferred to the server of the company C.

FIG. 10 is a conceptual diagram of a network system that the communication system 100 configures when passing rules are defined as shown in FIG.
The communication system 100 constitutes three network systems, partial systems 40, 41, and 42. The partial systems 40, 41, and 42 are further divided into network systems that are virtually separated for each service.
The communication device 10 with ID 043 forms a path from the web service layer of the partial system 40 (company A) to the web service layer of the partial system 42 (company C). Using this path, communication data can flow from the web service layer of the partial system 40 to the web service layer of the partial system 42.

FIG. 11 is a flowchart showing processing at the time of transmission of communication data in the communication system 100 according to the second embodiment.
(S31: Data reception processing)
The data receiving unit 15 of the communication device 10 to which the terminal is directly connected receives communication data from the terminal. Here, it is assumed that the company (hereinafter referred to as the first group) to which the communication data transmission source terminal belongs is different from the company to which the communication data transmission destination server (hereinafter referred to as the second group) belongs.

(S32: Data determination process)
The data determination unit 16 of the communication device 10 at the entrance determines whether or not the self-passing rule allows communication data to pass. That is, the data determination unit 16 determines whether or not the transmission source is a company terminal assigned to the communication apparatus 10.
If it is determined to pass (YES in S32), the process proceeds to S33. On the other hand, if it is determined not to pass (NO in S32), the communication data is discarded and the process is terminated.

(S33: Reconfiguration process)
The data transmission unit 17 of the entrance communication device 10 adds the company ID to which the transmission destination server is assigned and the company ID to which the transmission source terminal is assigned to the communication data to reconfigure the communication data.

(S34: Data transmission processing)
The data transmission unit 17 of the communication device 10 at the entrance performs routing to the relay communication device 10 that transfers the service specified by the communication data from the first group to the second group, and the next communication device 10 follows the routing. Send the reconfigured communication data to. At this time, the data transmission unit 17 also transmits the route information obtained by the routing together with the communication data.
In the routing, a route that passes only the communication device 10 that passes communication data having the first group as a transmission source is specified based on the other passage rule.

(S35: Data transfer process)
The communication device 10 that has received the communication data transmits the communication data to the next communication device 10 in accordance with the route information.
By repeating S35, the communication data finally arrives at the relay communication device 10.

(S36: Data relay processing)
The data transmission unit 17 of the relay communication device 10 performs routing to the destination server and transmits communication data to the next communication device 10. The data transmission unit 17 also transmits the route information obtained by routing together with the communication data.
In the routing, a route that passes only the communication device 10 that passes the communication data with the second group as the transmission source is specified based on the other passage rule.

(S37: Data transfer process)
The communication device 10 that has received the communication data transmits the communication data to the next communication device 10 in accordance with the route information.
By repeating S37, the communication data finally reaches the destination server.

For example, the operation when the terminal 30 connected to the communication device 10 with ID 052 shown in FIG. 1 transmits communication data to the server 25 (web server) of the company C is as follows.
First, the communication device 10 with ID 052 receives communication data from the terminal 30 whose source is the terminal 30 and whose destination is the server 25 (S31). Then, the communication device 10 with ID 052 determines whether or not the self-passing rule allows communication data to pass (S32). Here, the self-passing rule of the communication device 10 of ID052 is to reconfigure the communication data (S33) in order to pass the communication data of company A as the transmission source (YES in S32).

Then, the communication device 10 with ID 053 performs routing to the communication device 10 with ID 043 for transferring the web service from company A to company C (here, it is assumed that the route of ID 053 and ID 043 is obtained as a result of the routing). ), The communication data is transmitted to the next communication device 10 of ID053 (S34).
Then, communication data is transmitted in the order of ID053 and ID043 according to the result of routing (S35).

The communication device 10 of ID043 performs routing to the server 25 (here, it is assumed that the route of ID044, ID045, ID035, and the server 25 is obtained as a result of routing), and communication data is transmitted to the communication device 10 of the next ID044. Transmit (S36).
Then, according to the routing result, the communication data is transmitted in the order of ID044, ID045, and ID035, and finally the communication data is transmitted to the server 25 (S37).

As described above, in the communication system 100, when communication data is transmitted across companies, the communication data is transmitted to the transmission destination via the relay communication device 10 that passes communication data from either of the two companies as a transmission source. Send.
Therefore, the terminal that transmits the communication data does not need to be particularly conscious of straddling the company, and simply specifies the transmission destination.

  In S32 shown in FIG. 11, it is determined only whether or not the self-passing rule allows communication data to pass. However, it may also be determined whether or not there is a relay communication device 10 that performs transfer from the first group to the second group for the service specified by the communication data. Even when the relay communication device 10 does not exist, the communication data may be discarded and the process may be terminated.

Further, in the process shown in FIG. 11, it is determined whether or not communication data is allowed to pass only in the communication device 10 at the entrance. However, it may be determined whether or not the communication data is passed by each communication device 10 through which the communication data passes.
In this case, in S36, the data transmission unit 17 of the relay communication device 10 temporarily replaces the transmission source of the communication data with the transmission destination company. Thereby, the communication data can pass through the communication device 10 passing from the relay communication device 10 to the destination server. When replacing the transmission source of communication data, the original transmission source is left in the communication data. Thereby, for example, the transmission destination of the reply data from the server can be the original transmission source.

  In the above description, for example, when the terminal 30 of the company A transmits communication data to the server 21 of the company A, the communication data passes only through the communication device 10 of the partial system 40 of the company A. However, it is also possible to virtually connect the two communication devices 10 of the partial system 40 of the company A via the communication devices 10 of other companies by applying the above-described concept of straddling companies.

Embodiment 3 FIG.
In the third embodiment, a method for efficiently transmitting communication data to a transmission destination in the communication system 100 described in the first and second embodiments will be described.

In the first embodiment, routing to the transmission destination server is performed in S24 of FIG. 6, and the reconfigured communication data is transmitted to the next communication device 10 according to the routing. In the first embodiment, it has been described that one route is specified by routing.
However, there may be a plurality of routes from the communication device 10 at the entrance to the destination server. Therefore, the traffic of each route is distributed by dividing the data and flowing it to each route.

FIG. 12 is a diagram showing a transfer route of communication data according to the third embodiment. In FIG. 12, a case where communication data is transmitted from the terminal 30 connected to the communication device 10 with ID 053 to the server 21 is shown as an example.
6 are executed from S21 to S23, and the routing from the communication device 10 of ID053 to the server 21 is performed in S24. Here, it is assumed that the route R1 of ID053, ID052, ID042, ID032, ID022, ID021, and the server 21 and the route R2 of ID053, ID052, ID051, ID041, ID031, ID021, ID011, ID012, and the server 21 are specified. That is, it is assumed that two routes R1 and R2 branching with ID052 are specified.
In this case, the entire communication data is transmitted from the communication device 10 with ID 053 to the communication device 10 with ID 052. The communication device 10 of ID052 divides the communication data into two, one is transmitted to ID042 (route R1), and the other is transmitted to ID051 (route R2). The communication data transmitted to ID042 reaches the server 21 through the route R1, and the communication data transmitted to ID051 reaches the server 21 through the route R2.

  As described above, in the communication system 100 according to the third embodiment, when there are a plurality of routes to the transmission destination, the communication data is divided and sent to each route. Thereby, the load concerning each communication device 10 can be distributed.

  Note that the communication device 10 may specify a free route whose traffic is equal to or less than a predetermined value among a plurality of routes to the transmission destination. If there are a plurality of specified routes, the communication data is divided and sent to each route. If only one route is specified, all the communication data is supplied to that route. If there is no route whose traffic is less than a predetermined value, one route with the least traffic may be specified.

  Further, the communication data may be divided so that the data amount becomes equal, or the data amount may be adjusted according to the traffic of each route.

Next, the hardware configuration of the communication device 10 and the communication server 20 in the embodiment will be described.
FIG. 13 is a diagram illustrating an example of a hardware configuration of the communication device 10.
As illustrated in FIG. 13, the communication device 10 includes a CPU 911 (also referred to as a central processing unit, a central processing unit, a processing unit, an arithmetic unit, a microprocessor, a microcomputer, and a processor) that executes a program. The CPU 911 is connected to the ROM 913, the RAM 914, the LCD 901 (Liquid Crystal Display), the keyboard 902 (K / B), the communication board 915, and the magnetic disk device 920 via the bus 912, and controls these hardware devices.

  In the ROM 913 and the like, an operating system 921 (OS), a window system 922, a program group 923, and a file group 924 are stored. The programs in the program group 923 are executed by the CPU 911, the operating system 921, and the window system 922.

The program group 923 includes “rule receiving unit 12”, “rule determining unit 13”, “rule transmitting unit 14”, “data receiving unit 15”, “data determining unit 16”, “data transmitting unit 17” in the above description. Software, programs and other programs that execute the functions described as “etc.” are stored. The program is read and executed by the CPU 911.
In the file group 924, information such as “passing rules” and “communication data”, data, signal values, variable values, and parameters in the above description are stored as items of “file” and “database”. The “file” and “database” are stored in a recording medium such as a disk or a memory. Information, data, signal values, variable values, and parameters stored in a storage medium such as a disk or memory are read out to the main memory or cache memory by the CPU 911 via a read / write circuit, and extracted, searched, referenced, compared, and calculated. Used for the operation of the CPU 911 such as calculation / processing / output / printing / display. Information, data, signal values, variable values, and parameters are temporarily stored in the main memory, cache memory, and buffer memory during the operation of the CPU 911 for extraction, search, reference, comparison, calculation, calculation, processing, output, printing, and display. Is remembered.

In the above description, the arrows in the flowchart mainly indicate input / output of data and signals, and the data and signal values are recorded in a memory of the RAM 914, other recording media such as an optical disk, and an IC chip. Data and signals are transmitted online by a bus 912, signal lines, cables, other transmission media, and radio waves.
In addition, what is described as “to part” in the above description may be “to circuit”, “to device”, “to device”, “to means”, and “to function”. It may be “step”, “˜procedure”, “˜processing”. In addition, what is described as “˜device” may be “˜circuit”, “˜device”, “˜means”, “˜function”, and “˜step”, “˜procedure”, “ ~ Process ". Furthermore, what is described as “to process” may be “to step”. That is, what is described as “˜unit” may be realized by firmware stored in the ROM 913. Alternatively, it may be implemented only by software, or only by hardware such as elements, devices, substrates, and wirings, by a combination of software and hardware, or by a combination of firmware. Firmware and software are stored in a recording medium such as ROM 913 as a program. The program is read by the CPU 911 and executed by the CPU 911. That is, the program causes a computer or the like to function as the “˜unit” described above. Alternatively, the computer or the like is caused to execute the procedures and methods of “to part” described above.

  DESCRIPTION OF SYMBOLS 10 Communication apparatus, 11 Pass rule memory | storage part, 12 Rule receiving part, 13 Rule determination part, 14 Rule transmission part, 15 Data reception part, 16 Data determination part, 17 Data transmission part, 20-25 Server, 30-32 terminal, 100 Communication system.

Claims (7)

A communication system in which a plurality of communication devices that limit data to be passed are mesh-connected,
Each communication device
Storing a rule of communication data passed by the own communication device as a self-passing rule, and a passing rule storage unit for storing the rule of another communication device that passes the communication data passed by the own communication device as another passing rule;
A rule receiving unit for receiving the rule of a newly connected new communication device as a new passing rule;
When the rule receiving unit receives a new passing rule, a rule determining unit that determines whether or not the self-passing rule stored in the passing rule storage unit passes communication data that passes through the new passing rule;
When the rule determining unit determines that the self-passing rule passes, a rule transmitting unit that transmits the new passing rule to another connected communication device;
With
The communication system according to claim 1, wherein the passage rule storage unit stores the new passage rule as another passage rule when the rule determination unit determines that the passage is allowed to pass. The rule transmission unit is a communication device in which the own communication device is directly connected to the new communication device, and when the rule determination unit determines that the own passage rule passes, the passage rule storage unit stores The communication system according to claim 1, wherein the self-passing rule and the other passing rule are transmitted to the new communication device. The rule determination unit determines whether or not the other passing rule of each connected other communication device passes the communication data to be passed by the new passing rule,
The said rule transmission part transmits the said new passage rule only to the other communication apparatus which the said rule determination part determined to pass among the other communication apparatuses connected, The Claim 1 or 2 characterized by the above-mentioned. Communications system. The rule defines a group that allows the communication data to pass through;
The communication system further includes:
A data receiver for receiving communication data from the connected device;
A data determination unit that determines whether or not a group to which a transmission source device of communication data received by the data reception unit belongs is a group that the self-passing rule determines to pass communication data;
And a data transmission unit configured to transmit the communication data to a transmission destination to another connected communication device when the data determination unit determines that the group is determined to pass. The communication system according to any one of 1 to 3. The communication system according to claim 4, wherein the data transmission unit transmits the communication data to another communication device after adding identification information of a group to which the transmission source device belongs to the communication data. . The data transmission unit of the communication device that has received communication data from a connected device has communication data in which the first group to which the transmission source device belongs and the second group to which the transmission destination device belongs are different from each other. When received, the communication data is transmitted to another communication device having a rule determined to pass both the first group and the second group,
The data transmission unit of the communication device having a rule that determines that both groups are allowed to pass the communication data in which the first group to which the transmission source device belongs and the second group to which the transmission destination device belongs are differently communicated. 6. The communication system according to claim 4, wherein, when received from an apparatus, the communication data is transmitted to a destination other than the communication data. When there are a plurality of other communication devices connected, the data transmission unit divides the communication data into a plurality of child communication data, and transmits each child communication data to a different other communication device. A communication system according to any one of claims 4 to 6.

Images