JP7582678B2 - COMMUNICATION CONTROL DEVICE, COMMUNICATION CONTROL SYSTEM, COMMUNICATION CONTROL METHOD, AND PROGRAM - Google Patents

Description

This disclosure relates to a communication control device, a communication control system, a communication control method, and a program, and in particular to a communication control device, a communication control system, a communication control method, and a program in a NAPT-using environment of a layer 3 network.

The standard specifications for communication control devices stipulate IP packet communication specifications in Layer 3 (network layer) of the Open Systems Interconnection reference model (OSI reference model). In addition, NAPT (Network Address Port Translation) is known as a general address translation technology for communicating between a global network and a private network (see, for example, Patent Document 1).

JP 2006-180362 A

In environments where a large number of endpoints are processed under NAPT, problems can occur due to port number exhaustion, and to avoid this, it is necessary to restrict the network configuration.

In view of the above-mentioned problems, the objective of the present disclosure is to provide a communication control device, a communication control system, a communication control method, and a program that realize the creation of a network environment in which a large number of endpoints can be appropriately processed in a NAPT-using environment.

A communication control system according to an embodiment of the present disclosure includes:
a first communication control unit connected to the private network and having a first global address;
a second communication control unit connected to the private network and having a second global address different from the first global address.
The first communication control unit is
When a set of a private address and a pre-translation port number included in a received IP packet as source information is determined to be a new combination based on a first translation table used for NAPT conversion in a network layer of the OSI reference model, the first translation table associating a private address and a pre-translation port number with a global address and a post-translation port number, determining whether or not the number of port numbers corresponding to the first global address and available for the NAPT conversion is equal to or less than a predetermined threshold;
If the number of port numbers available for the NAPT conversion is equal to or less than the threshold,
registering the set included as source information in the received IP packet and the second global address in the first conversion table in association with each other;
The received IP packet is transferred to the second communication control unit.

A communication control device according to an aspect of the present disclosure includes:
When a set of a private address and a pre-translation port number included as source information in a received IP packet is determined to be a new combination based on a conversion table that associates a set of a private address and a pre-translation port number with a set of a global address and a post-translation port number, and that is used for NAPT conversion in the network layer of the OSI reference model, the device determines whether or not the number of port numbers that correspond to its own global address and are available for the NAPT conversion is equal to or less than a predetermined threshold value;
If the number of port numbers available for the NAPT conversion is equal to or less than the threshold,
registering the set included as source information in the received IP packet in the conversion table in association with a global address of another communication control device;
The received IP packet is transferred to the other communication control unit.

A communication control method according to one aspect of the present disclosure includes:
When a set of a private address and a pre-translation port number included as source information in a received IP packet is determined to be a new combination based on a conversion table that associates a set of a private address and a pre-translation port number with a set of a global address and a post-translation port number, and that is used for NAPT conversion in the network layer of the OSI reference model, the device determines whether or not the number of port numbers that correspond to its own global address and are available for the NAPT conversion is equal to or less than a predetermined threshold value;
If the number of port numbers available for the NAPT conversion is equal to or less than the threshold,
registering the set included as source information in the received IP packet in the conversion table in association with a global address of another communication control device;
The received IP packet is transferred to the other communication control unit.

A program according to one aspect of the present disclosure includes:
On the computer,
a process of determining whether the number of port numbers corresponding to a global address owned by the device and available for the NAPT conversion is equal to or less than a predetermined threshold value when a set of a private address and a pre-translation port number included in a received IP packet as source information is determined to be a new combination based on a conversion table that associates a set of a private address and a pre-translation port number with a set of a global address and a post-translation port number and that is used for the NAPT conversion in the network layer of the OSI reference model;
If the number of port numbers available for the NAPT conversion is equal to or less than the threshold,
registering the set included as source information in the received IP packet in the conversion table in association with a global address of another communication control device;
The other communication control device is caused to execute a process of forwarding the received IP packet.

This disclosure provides a communication control device, a communication control system, a communication control method, and a program that realize the creation of a network environment in which a large number of endpoints can be appropriately processed in a NAPT-using environment.

1 is a block diagram showing a configuration of a system according to a first embodiment. FIG. 4 is a diagram illustrating an example of a data structure of a first conversion table according to the first embodiment. 5 is a flowchart showing a flow of a communication control method by a first communication control unit according to the first embodiment. 5 is a flowchart showing a flow of a communication control method by a first communication control unit according to the first embodiment. 5 is a flowchart showing a flow of a communication control method by a first communication control unit according to the first embodiment. FIG. 11 is a block diagram showing a configuration of a system according to a second embodiment. FIG. 11 is a sequence diagram showing a processing flow of the system according to the second embodiment. FIG. 11 is a sequence diagram showing a processing flow of the system according to the second embodiment. FIG. 11 is a block diagram showing a configuration of a system according to a third embodiment. FIG. 13 is a block diagram showing a configuration of a system according to a fourth embodiment. FIG. 13 is a diagram illustrating an example of a data structure of a conversion table according to the fourth embodiment. FIG. 1 illustrates an example of the configuration of a computer. FIG. 1 is a block diagram showing a configuration of a related system. FIG. 13 is a diagram illustrating an example of a data structure of an associated conversion table.

Embodiments of the present disclosure will now be described in detail with reference to the drawings. In each drawing, identical or corresponding elements are denoted by the same reference numerals, and duplicated descriptions will be omitted as necessary for clarity of explanation.

<Problems of the embodiment>
In a related technique, NAPT (Network Address Port Translation) is used in a network configuration such as a system 9 shown in Fig. 13. Fig. 13 is a block diagram showing the configuration of the related system 9.

The system 9 includes a communication control device 90, a plurality of client devices 20, and an external device 30. The communication control device 90 and the external device 30 are connected to a global network GN.

The communication control device 90 is a general communication control device that operates using NAPT. The communication control device 90 is installed in a gateway that connects a global network GN and a private network PN. A plurality of client devices 20 are connected to the private network PN. The communication control device 90 and the plurality of client devices 20 constitute a PN side system 900. A private IP address is assigned to each of the plurality of client devices 20. Hereinafter, the private IP address is simply referred to as a private address. The communication control device 90 performs address conversion using NAPT (hereinafter, sometimes referred to as NAPT conversion), enabling each of the plurality of client devices 20 to communicate with an external device 30 that exists in the global network GN.

Address conversion using NAPT will be explained with reference to FIG. 14. FIG. 14 is a diagram showing an example of the data structure of the associated conversion table T0. Address conversion using NAPT is performed according to conversion table T0. In order to convert an address converted into the system on the global network GN back into the system on the private network, the communication control device 90 needs to create a one-to-one correspondence between the information before conversion and the information after conversion.

The information before conversion is a set of the source private address and port number, and in this embodiment, this set is called an endpoint. The information after conversion is a set of a global address and a port number. Only the global address G1 assigned to the communication control device 90 is used as the global IP address after conversion. In the following, the global IP address is simply called the global address. The range of port numbers that can be used as port numbers after NAPT conversion depends on the implementation of NAPT. For example, to ensure the widest possible conversion range excluding reserved port numbers, port numbers from 1024 to 65535 are used.

In NAPT, the endpoint before conversion and the port after conversion are converted on a one-to-one basis. Therefore, if the communication control device 90 performs NAPT conversion for a large number of endpoints, there may be a shortage of ports to convert to, making it impossible to perform further NAPT conversion. If the communication control device 90 is in an environment where port numbers from 1024 to 65535 can be used, the number of convertible ports is 64,512, so if the number of endpoints exceeds this, further NAPT conversion will not be possible. Therefore, IP packets received from the endpoint shown in R0 in Figure 14 are discarded.

As an example, in the PN side system 900 of the system 9, there are 65 client devices assigned individual private addresses under one gateway router. The clients may connect to a server in the global network GN for purposes such as web conferencing, and it is necessary to generate 1000 sessions of communication with different source ports per connection. If 65 clients connect simultaneously for a company-wide conference, the total number of endpoints will be 65 x 1000 = 65000, exceeding the upper limit of 64512 for NAPT conversion. In this situation, NAPT conversion for new communication cannot be performed, and new ports cannot be used for other functions of the communication control device 90, which may cause communication failure. To avoid this situation, measures such as restricting the number of clients that connect simultaneously and limiting the network configuration are required so that available port numbers are not exhausted due to the generation of a large number of sessions.

As such, in an environment where a large number of endpoints are processed under NAPT, problems can occur due to port number exhaustion, and to avoid this, it is necessary to restrict the network configuration.

At least one of the following embodiments is intended to solve this problem.

<Embodiment 1>
The first embodiment may be described as an outline of the second to fourth embodiments described later. In the first embodiment, in a line environment in which a plurality of global addresses can be used, a communication control device capable of performing the following address conversion by NAPT on each line is used.

FIG. 1 is a block diagram showing a configuration of a system 1 according to the first embodiment.
The system 1 is a computer system for communication between a client device 20 under a private network PN and an external device 30 on a global network GN. The system 1 includes a plurality of client devices 20 and an external device 30, similar to the system 9 shown in Fig. 13, but differs in that it includes a communication control system 10 instead of a communication control device 90. The communication control system 10 may be one computer device (communication control device), or may be a computer system including a plurality of computer devices (communication control devices).

Multiple client devices 20 are connected to the private network PN. And the external device 30 is connected to the global network GN.

The communication control system 10 includes a first communication control unit 12 and a second communication control unit 14 .
The first communication control unit 12 is connected to the private network PN and the global network GN, and has a first global address G1.
The second communication control unit 14 is connected to the private network PN and the global network GN, similar to the first communication control unit 12. The second communication control unit 14 has a second global address G2 that is different from the first global address G1.

The first communication control unit 12 has normal communication control functions, including normal NAPT, in accordance with the provisions of the OSI reference model, and also has the function of operating according to the NAPT extension algorithm described below. The second communication control unit 14 has the function of operating in conjunction with the first communication control unit 12.

The first conversion table is stored in a storage device accessible to the first communication control unit 12, and the second conversion table is stored in a storage device accessible to the second communication control unit 14. The first conversion table and the second conversion table are NAPT conversion tables used by the first communication control unit 12 and the second communication control unit 14 to perform address conversion by NAPT, respectively. The above storage device may be included in the communication control system 10. In this embodiment 1, the storage devices accessible by the first communication control unit 12 and the second communication control unit 14 may be the same storage device or different storage devices. Also, in this embodiment 1, the first conversion table and the second conversion table are different tables, but they may be the same table.

Here, the first communication control unit 12 and the second communication control unit 14 each hold each other's global address and the private address of each client device 20. For example, these addresses may be stored in a storage device accessible by the first communication control unit 12 and a storage device accessible by the second communication control unit 14 by user setting. Furthermore, when the communication control system 10 includes multiple communication control units, it is determined in advance which communication control unit will use which communication control unit as a proxy when its own port number is insufficient.

Figure 2 is a diagram showing an example of the data structure of the first conversion table T1 according to the first embodiment. The first conversion table T1 associates a private address and a pre-conversion port number with a global address and a post-conversion port number in a one-to-one relationship. In the first conversion table T1, in record R1 in which the available port number is greater than a predetermined threshold, the set of the private address and the pre-conversion port number is associated with the first global address G1 and a set of the post-conversion port number that is uniquely determined based on the reception order. On the other hand, in record R2 in which the available port number is equal to or less than the predetermined threshold, the first conversion table T1 associates a set of the private address and the pre-conversion port number with the second global address G2.

In the following, a single line of record may be referred to as an entry, and the information stored in a single line of record may be collectively referred to as address conversion information.

The second conversion table basically has the same data structure. However, in the second conversion table, the first global address G1 and the second global address G2 described above are replaced with the second global address G2 and the first global address G1, respectively. Furthermore, the values of each address and port number registered may be different from those in the first conversion table.

When at least the first communication control unit 12 attempts to add a new entry to the first conversion table T1 by address conversion processing using NAPT, the subsequent processing differs depending on whether or not a port number shortage has occurred. When there is no port number shortage due to NAPT conversion, the first communication control unit 12 executes processing similar to normal NAPT conversion. That is, the first communication control unit 12 first registers the first global address G1 and the newly assigned port number in the first conversion table T1 as usual. Then, the first communication control unit 12 executes NAPT conversion and packet forwarding using NAPT as usual.

On the other hand, if a port number shortage occurs during normal NAPT conversion, the first communication control unit 12 updates the converted global address portion of the first conversion table T1 using the second global address G2 stored in advance instead of the first global address G1. The second global address G2 is the global address of the second communication control unit 14 that works in conjunction with the first communication control unit 12. Note that the value written as the converted port number may be any value.

In this way, the first communication control unit 12 employs a NAPT extension algorithm that adds extended operations to the normal NAPT operations.

Figures 3 to 5 are flowcharts showing the flow of a communication control method by the first communication control unit 12 in the first embodiment. Figures 2 to 4 show a NAPT extension algorithm that operates when the communication control device 90 receives an IP packet from the private network PN.

First, when the first communication control unit 12 receives an IP packet from one of the client devices 20 under the private network PN (S10), it refers to the first conversion table (S11). Next, the first communication control unit 12 determines whether the set of private address and pre-conversion port number included as source information in the received IP packet is a new combination based on the first conversion table T1 (S12). Specifically, the first communication control unit 12 extracts the set of private address and pre-conversion port number included as the source IP address and source port number from the header portion of the received IP packet. Then, the first communication control unit 12 determines whether the set is registered in the conversion table T1.

If the set is not registered in the conversion table T1, that is, if it is a new combination (Yes in S12), the first communication control unit 12 proceeds to S13.

In S13, it is determined whether the number of port numbers corresponding to the first global address G1 and available for NAPT conversion is equal to or less than a predetermined threshold. The port numbers corresponding to the first global address G1 are port numbers that can be combined with the first global address G1. The threshold may be 0 or may be greater than 0. In the latter case, it is possible to prevent the consumption of more port numbers than that in the former case while leaving some room for available port numbers. Therefore, it is possible to reduce the possibility that other functions that use port numbers will be affected by a shortage of port numbers more than in the former case.

If the number of port numbers available for NAPT conversion is equal to or less than a predetermined threshold (Yes in S13), the first communication control unit 12 registers the set included in the IP packet as source information in the first conversion table T1 in association with the second global address G2 (S14). The first communication control unit 12 then transfers the packet being processed, i.e., the received IP packet, to the second communication control unit 14 with which it is linked (S15). At this time, the first communication control unit 12 transfers the IP packet while maintaining all the source information, destination information, and data information of layers 3 and above of the packet to be processed without rewriting them. If the second communication control unit 14 is a device separate from the first communication control unit 12, the transfer to the second communication control unit 14 is realized by specifying the MAC address (Media Access Control address) corresponding to the second communication control unit 14 as the destination of layer 2 and transmitting the packet via the private network PN.

The forwarded IP packet is acquired by the second communication control unit 14. The second communication control unit 14 applies normal NAPT conversion processing to the received IP packet, and transmits the IP packet with the converted source information to the device corresponding to the destination information, that is, the external device 30 on the global network GN.

On the other hand, if the number of port numbers available for NAPT conversion is greater than the predetermined threshold (No in S13), the communication control system 10 proceeds to S16 to S19 (flow A). Flow A is a normal NAPT conversion process. In S16, the first communication control unit 12 first assigns one available port number as a converted port number to the set included in the received IP packet as source information. Next, the first communication control unit 12 associates the set included in the received IP packet as source information with the set of the first global address G1 and the converted port number (converted set) and registers them in the first conversion table T1 (S17). Next, the first communication control unit 12 converts the set included in the received IP packet as source information to the converted set (S18; NAPT conversion). Note that conversion means replacement. The processes shown in S17 and S18 may be performed in parallel, or the process shown in S17 may be performed after S18. Finally, the first communication control unit 12 transmits the IP packet with the converted source information to the device corresponding to the destination information, that is, the external device 30 on the global network GN (S19).

If the set included as source information in the received IP packet is registered in conversion table T1, that is, if it is not a new combination (No in S12), the first communication control unit 12 proceeds to S20 to S24 (Flow B).

In S20, the first communication control unit 12 reads out, in the first conversion table T1, a set of a global address and a converted port number associated with a set included as source information in the received IP packet. Next, if the global address included in the read set is the first global address G1 (Yes in S21), the first communication control unit 12 proceeds to S22.

In S22, the first communication control unit 12 executes normal NAPT conversion processing. That is, the first communication control unit 12 converts the set included in the source information of the received IP packet to the read set. The first communication control unit 12 then transmits the IP packet with the converted source information to the external device 30 corresponding to the destination information (S23).

If the global address included in the read set is the second global address G2 (No in S21), the first communication control unit 12 transfers the IP packet to the second communication control unit 14 (S24), similar to S15.

When communication to the global network GN occurs again from an endpoint to which the NAPT extension algorithm has been applied, the endpoint is unaware of the NAPT extension algorithm and therefore sends an IP packet to the first communication control unit 12. In this case, the first communication control unit 12 can determine that the destination address corresponding to the source information of the received IP packet is that of the second communication control unit 14 by referring to the first conversion table T1. Therefore, the first communication control unit 12 transfers the IP packet to the second communication control unit 14 in the same manner as S24 in FIG. 5.

As described above, according to the first embodiment, if the first communication control unit 12 experiences a shortage of NAPT port numbers, the IP packet is transferred to the second communication control unit 14 using the above-mentioned NAPT extension algorithm, and the second communication control unit 14 performs the NAPT conversion process instead. Therefore, even if there is a shortage of port numbers, new communication can be established without causing communication failure. The above-mentioned NAPT process can be performed as long as there are free port numbers available in the second communication control unit 14. Furthermore, even if three or more communication control units are used, the same mechanism can be used to perform NAPT process instead.

This allows the upper limit on the number of endpoints that can be converted in the NAPT conversion process to be expanded according to the number of available lines. In other words, a large number of endpoints can be processed optimally in a NAPT usage environment. As a result, communication failures due to a lack of port numbers can be avoided, and the limitations of network configuration can be expanded.

In the above description, the second communication control unit 14 that receives the forwarded IP packet applies normal NAPT conversion processing, but instead, it may apply an extended NAPT conversion algorithm similar to that of the first communication control unit 12. In this case, if the second communication control unit 14 also has a shortage of port numbers, the second communication control unit 14 forwards the IP packet to another communication control unit. This forwarding destination may be the first communication control unit 12 or another communication control unit.

In the above description, the first communication control unit 12 uses the NAPT extension algorithm when sending an IP packet from the client device 20 to the external device 30, but a normal algorithm may be used when sending an IP packet from the external device 30 to the client device 20. That is, when the first communication control unit 12 receives an IP packet including a set of a global address and a converted port number as destination information, the first communication control unit 12 may execute the following process. First, the first communication control unit 12 may read out the set of the private address and the converted port number associated with the set included as the destination information in the first conversion table T1. Then, the first communication control unit 12 may transfer the received IP packet to the client device 20 corresponding to the read set.

<Embodiment 2>
Next, a second embodiment of the present disclosure will be described. Fig. 6 is a block diagram showing a configuration of a system 1a according to the second embodiment. In the second embodiment, the first communication control unit and the second communication control unit have a master-substitute relationship.

System 1a has a configuration basically similar to system 1, but includes a primary device 12a as an example of a first communication control unit 12, a secondary device 14a as an example of a second communication control unit 14, and a server 31 as an example of an external device 30.

The primary device 12a and secondary device 14a are both computer devices capable of running NAPT. The same private network PN exists under both devices. Multiple client devices 20-1, 20-2, and 20-3 exist within the private network PN. The number of client devices 20 is not limited to this. The multiple client devices 20 attempt to communicate with a server 31 that exists on a global network GN, and attempt to generate multiple sessions. The multiple client devices 20 use the primary device 12a as a default route, and when communicating with the server 31, they first go through the primary device 12a. In other words, when the client device 20 and the server 31 communicate, the primary device 12a receives IP packets related to the communication in priority over the secondary device 14a.

The primary device 12a and secondary device 14a can implement the same NAPT extension algorithm as in embodiment 1.

7 and 8 are sequence diagrams showing the flow of processing in the system according to the second embodiment.
FIG. 7 shows the flow of processing by the system when the set of source information is new and there is no shortage of port numbers.

When the client device 20-1 attempts to establish a new session with the server 31, the client device 20-1 sends an IP packet to the main device 12a requesting the server 31 to establish a session (S100). The sent IP packet includes the private address P1 and the port number p1 as source information.

In this case, since the set of source information is new and there is no shortage of port numbers, the main device 12a that receives the IP packet processes the received IP packet according to the normal NAPT conversion process.

At this time, the primary device 12a first executes the registration process of the first conversion table T1 shown in S16 to S17 of FIG. 4 (S101). The primary device 12a then executes the NAPT conversion process shown in S18 of FIG. 4 (S102). The primary device 12a then transmits the IP packet with the converted source information to the server 31 (S103). The transmitted IP packet includes the global address G1 and port number p11 as source information.

The server 31 that receives the IP packet responds to the primary device 12a corresponding to the global address G1 using a response packet that includes the global address G1 and port number p11 as destination information (S104). The primary device 12a executes a NAPT conversion process using the first conversion table T1 (S105). That is, the primary device 12a reads out the set of the private address P1 and port number p1 that is associated with the set included in the destination information in the first conversion table T1. The primary device 12a then converts the set of destination information to the read set, and sends the converted response packet to the corresponding endpoint (client device 20-1) (S106).

Each time the client device 20 attempts to generate a new session, the processes shown in S100 to S106 may be executed.

Then, assume that the client device 20-1, which has once been registered in the first conversion table T1, subsequently sends an IP packet to the primary device 12a in the same session with the server 31 (S110). In this case, the primary device 12a executes a NAPT conversion process using the first conversion table T1 (S111), and sends the IP packet with the converted source information to the server 31 (S112).

Next, we will explain what happens when the above process is repeated and all available port numbers in the main device 12a are used up.

Figure 8 shows the flow of system processing when the set of sender information is new and there is a shortage of port numbers.

When the client device 20-2 attempts to establish a new session with the server 31, the client device 20-2 sends an IP packet to the main device 12a requesting the server 31 to establish a session (S120). The sent IP packet includes the private address P2 and the port number p2 as source information.

In this case, since the set of source information is new and there is a shortage of port numbers, the main device 12a that receives the IP packet processes the received IP packet according to the NAPT extension algorithm described above.

At this time, the primary device 12a first executes the registration process of the first conversion table T1 shown in S11 to S14 in FIG. 3 (S121). At this time, the primary device 12a uses the global address G2 of the secondary device 14a as the global address to be registered. Then, the primary device 12a transfers the received IP packet to the secondary device 14a without changing the source information, similar to S15 in FIG. 3 (S122). At this time, the primary device 12a does not need to share the first conversion table T1 with the secondary device 14a.

The secondary device 14a receives the IP packet at the private network PN side interface. The secondary device 14a that receives the IP packet executes normal NAPT processing similar to S101 to S102 in FIG. 7. Specifically, in order to apply normal NAPT conversion processing to the IP packet, the secondary device 14a assigns one available port number as a converted port number and additionally registers address conversion information in the second conversion table T2 (S123). The address conversion information is information that associates a set of a private address and a pre-conversion port number included in the source information with a set of a second global address G2 and a converted port number. Next, the secondary device 14a converts the set of the private address and the pre-conversion port number included in the source information into a set of a second global address G2 and a converted port number (S124). Then, the secondary device 14a transmits the NAPT-converted IP packet to a device corresponding to the destination information, that is, the server 31 (S125). The source information of the sent IP packet includes a set of the second global address G2 and port number p21.

The server 31 recognizes the source of the communication as the secondary device 14a, and so sends the response from the server 31 to the secondary device 14a (S126). The secondary device 14a converts the response packet from the server 31 using normal NAPT conversion processing (S127), and sends the response packet to the endpoint (client device 20-2) that corresponds to the converted destination information (S128).

When the client device 20-2 communicates with the server 31 again, the IP packet is sent to the primary device 12a along the default route (S130). The primary device 12a transfers the received IP packet to the secondary device 14a according to the NAPT extension algorithm. The secondary device 14a performs NAPT conversion on the IP packet according to the second conversion table T2 (S132), and sends the IP packet with the converted source information to the server 31 (S133).

In this way, even if the port numbers in the main device 12a run out, the IP packets can be transferred to the secondary device 14a to perform the NAPT conversion process, thereby establishing a new address conversion between the client devices 20 and the server 31 and establishing a session.

<Effects of the Second Embodiment>
In the related NAPT environment, the upper limit of the number of ports available for NAPT conversion is 64512, and therefore the upper limit of the number of endpoints that can be processed by NAPT is also 64512. However, according to the second embodiment, it is possible to perform NAPT conversion on a number of endpoints that exceeds the above-mentioned upper limit.

In the second embodiment, the number of port numbers available for NAPT can be virtually doubled by performing NAPT conversion processing using the port numbers of both the primary device 12a and the secondary device 14a. By increasing the number of devices that function as global addresses and communication control units, the number of port numbers that can be virtually expanded can be further increased. Furthermore, since there is no need to share conversion tables between devices, management of the conversion tables is simple even if the number of devices is increased. Therefore, the number of devices can be easily increased.

In this second embodiment, the number of port numbers available for NAPT is expanded, which prevents failure of the NAPT conversion process due to a lack of port numbers and suppresses communication failures. In addition, since the number of endpoints that can be processed increases, restrictions on network configuration can be relaxed and a larger-scale network can be constructed.

<Embodiment 3>
Next, a third embodiment of the present disclosure will be described. In the third embodiment, a plurality of communication control units included in a communication control system are load-balanced or made redundant, and a default route is not determined.

Figure 9 is a block diagram showing the configuration of system 1b according to embodiment 3. System 1b according to embodiment 3 has a configuration basically similar to system 1a according to embodiment 2, but differs in that it includes a first communication control device 12b, a second communication control device 14b, and a third communication control device 16b instead of the main device 12a and the secondary device 14a. Note that the number of communication control devices is not limited to three, and may be two, or four or more.

In this embodiment 3, the administrator of system 1b pre-sets for each communication control device a proxy device in case of a shortage of port numbers. For example, the first communication control device 12b, the second communication control device 14b, and the third communication control device 16b are set to use the second communication control device 14b, the third communication control device 16b, and the first communication control device 12b as proxy devices, respectively, in the event of a shortage of port numbers. When there are two communication control devices, the two communication control devices may be set to be each other's proxy devices.

Note that communication between the client devices 20 and the server 31 is load-balanced or made redundant by the first communication control device 12b, the second communication control device 14b, and the third communication control device 16b. In this embodiment 3, the default route of the client devices 20 is not limited to one communication control device, and any of the three communication control devices can be the next hop for communication sent from the client devices 20.

When the first communication control device 12b, the second communication control device 14b, and the third communication control device 16b run out of port numbers, they forward IP packets to the proxy destination device according to the NAPT extension algorithm described above. Then, the NAPT conversion process is performed in the proxy destination device.

For example, if a port number shortage occurs in the first communication control device 12b, the IP packet can be transferred to the second communication control device 14b according to the NAPT extension algorithm, and the second communication control device 14b can perform NAPT conversion processing. At this time, if the port number shortage has been exhausted in the second communication control device 14b, the second communication control device 14b can further transfer the IP packet to the third communication control device 16b, and have the NAPT conversion processing performed.

If port number congestion occurs in all communication control devices included in the communication control system 10, a loop occurs in which transfer to the proxy device using the NAPT extension algorithm is repeated. To prevent this, when the number of IP packet transfers between multiple communication control devices reaches a predetermined number, one of the multiple communication control devices may discard the IP packet. Specifically, when a communication control device transfers an IP packet to a proxy device, it subtracts the TTL (Time to live) field of the IP packet to be transferred. This makes it possible to eliminate the IP packet when the transfer of the IP packet has been repeated a predetermined number of times.

According to the third embodiment, even if it is unknown which communication control device will experience a port number shortage, if a port number shortage occurs in one communication control device, the port numbers can be compensated for by another communication control device. This allows for more flexible failure prevention and network configuration.

In the above-mentioned third embodiment, the case where the communication control system 10b includes three communication control devices has been described, but the number of communication control devices is not limited to this. For example, if there are two communication control devices, the first communication control device 12b and the second communication control device 14b, the first communication control device 12b and the second communication control device 14b each serve as a proxy device for the other.

<Embodiment 4>
Next, a fourth embodiment of the present disclosure will be described. In the fourth embodiment, the NAPT extension algorithm is realized by a single device.

Figure 10 is a block diagram showing the configuration of system 1c according to embodiment 4. System 1c according to embodiment 4 has a configuration basically similar to system 1a according to embodiment 2. However, system 1c includes a standalone communication control device 10c instead of communication control system 10a.

The communication control device 10c is connected to the global network GN via multiple interfaces, and different global addresses G1 and G2 are assigned to each interface. When the client device 20 communicates with the server 31, the global address G1 is selected as the destination of the default route.

In other words, the communication control device 10c can be considered to have a first communication control unit 12c having a first interface to which a global address G1 is assigned, and a second communication control unit 14c having a second interface to which a global address G2 of a different line is assigned. The communication control device 10c has a conversion table T3, which is an integration of the first conversion table T1 and the second conversion table T2, stored in a storage device or is in a state where it can be referenced.

Figure 11 is a diagram showing an example of the data structure of the conversion table T3 according to the fourth embodiment. In the conversion table T3, in record R2, which is recorded when the port number corresponding to the global address G1 is insufficient, in addition to the global address G2, the port number corresponding to the global address G2 is recorded as the converted address.

In this type of system 1c, the communication control device 10c executes the NAPT extension algorithm shown in Figures 3 to 5. That is, when there is an adequate number of port numbers corresponding to the global address G1, the communication control device 10c executes normal NAPT conversion processing. Specifically, when the first communication control unit 12c receives an IP packet addressed to the server 31 from a new endpoint in the group of client devices 20, it executes the processing shown in S16 to S18, using the global address G1 on the default route as the converted address. Then, in S19, the first communication control unit 12c transmits the IP packet from the global address G1 to the server 31.

On the other hand, in a situation where there is a shortage of port numbers corresponding to global address G1, the communication control device 10c executes the extended part of the algorithm. That is, the first communication control unit 12c of the communication control device 10c executes the NAPT conversion process using global address G2 instead of global address G1, and updates the conversion table T3. Next, the second communication control unit 14c of the communication control device 10c acquires the IP packet and refers to the conversion table T3. Next, the second communication control unit 14c converts the address information of the IP packet. Next, the second communication control unit 14c transmits the source information of the IP packet to the server 31 on the global network GN as the address-converted address and port number. Since this address conversion is stored in the conversion table T3 of the communication control device 10c, when the communication control device 10c receives an IP packet with the same endpoint as the source or destination, it transmits the IP packet by the normal NAPT conversion process.

According to the fourth embodiment, in an environment where one communication control device is connected to multiple external lines, the NAPT extension algorithm can be executed without preparing multiple communication control devices.

Next, the physical configuration of the communication control device included in the communication control system will be described. FIG. 12 is a diagram showing an example of the configuration of a computer that can be used as a communication control device. The computer 1000 has a processor 1010, a storage unit 1020, a ROM (Read Only Memory) 1030, a RAM (Random Access Memory) 1040, a communication interface (IF: Interface) 1050, and a user interface 1060.

The communication interface 1050 is an interface for connecting the computer 1000 to a communication network via a wired communication means or a wireless communication means. The user interface 1060 includes a display unit such as a display. The user interface 1060 also includes an input unit such as a keyboard, a mouse, and a touch panel. Note that the user interface 1060 is not essential.

The storage unit 1020 is an auxiliary storage device that can hold various types of data. The storage unit 1020 does not necessarily have to be a part of the computer 1000, but may be an external storage device or a cloud storage device connected to the computer 1000 via a network.

The ROM 1030 is a non-volatile storage device. For example, a semiconductor storage device with a relatively small capacity, such as a flash memory, is used for the ROM 1030. The programs executed by the processor 1010 can be stored in the storage unit 1020 or the ROM 1030. The storage unit 1020 or the ROM 1030 stores various programs for implementing the functions of each unit in the communication control device, for example.

The program includes instructions (or software code) that, when loaded into a computer, cause the computer to perform one or more functions described in the embodiments. The program may be stored on a non-transitory computer-readable medium or a tangible storage medium. By way of example and not limitation, computer-readable media or tangible storage media include random-access memory (RAM), read-only memory (ROM), flash memory, solid-state drive (SSD) or other memory technology, CD-ROM, digital versatile disc (DVD), Blu-ray (registered trademark) disk or other optical disk storage, magnetic cassette, magnetic tape, magnetic disk storage or other magnetic storage device. The program may be transmitted on a transitory computer-readable medium or communication medium. By way of example and not limitation, a transitory computer-readable medium or communication medium includes electrical, optical, acoustic, or other forms of propagated signals.

RAM 1040 is a volatile storage device. Various semiconductor memory devices such as DRAM (Dynamic Random Access Memory) or SRAM (Static Random Access Memory) are used for RAM 1040. RAM 1040 can be used as an internal buffer for temporarily storing data, etc. Processor 1010 expands a program stored in storage unit 1020 or ROM 1030 into RAM 1040 and executes it. Processor 1010 may be a CPU (Central Processing Unit) or a GPU (Graphics Processing Unit). The processor 1010 executes a program to realize the functions of each unit in the communication control device. Processor 1010 may have an internal buffer for temporarily storing data, etc.

The present invention is not limited to the above embodiment, and can be modified as appropriate without departing from the spirit and scope of the invention.

A part or all of the above-described embodiments can be described as, but is not limited to, the following supplementary notes.
(Appendix 1)
a first communication control unit connected to the private network and having a first global address;
a second communication control unit connected to the private network and having a second global address different from the first global address;
The first communication control unit is
When a set of a private address and a pre-translation port number included in a received IP packet as source information is determined to be a new combination based on a first translation table used for NAPT (Network Address Port Translation) translation in the network layer of the OSI reference model, the first translation table associating a private address and a pre-translation port number with a global address and a post-translation port number, the method determines whether the number of port numbers corresponding to the first global address and available for the NAPT translation is equal to or less than a predetermined threshold value;
If the number of port numbers available for the NAPT conversion is equal to or less than the threshold,
registering the set included as source information in the received IP packet and the second global address in the first conversion table in association with each other;
The communication control system transfers the received IP packet to the second communication control unit.
(Appendix 2)
The first communication control unit is
If the number of port numbers available for the NAPT conversion is greater than the threshold,
Allocating one available port number as a post-translation port number to the set included in the received IP packet as source information;
converting the set included in the received IP packet as source information into a set of the first global address and the converted port number;
registering the set included as source information in the received IP packet and the converted set in the first conversion table in association with each other;
The communication control system according to claim 1, further comprising: transmitting the IP packet, the source information of which has been converted, to a destination device.
(Appendix 3)
The first communication control unit is
When the set included in the received IP packet as source information is not determined to be a new combination based on the first conversion table, a set of a global address and a converted port number associated with the set included in the received IP packet as source information is read out from the first conversion table;
If the global address included in the read set is the first global address,
converting the set included in the received IP packet as source information into the read set;
Transmitting the IP packet with the converted source information to a destination device;
3. The communication control system according to claim 1, further comprising: a second global address included in the set that has been read out; a second global address included in the set that has been read out;
(Appendix 4)
When an IP packet including a set of a global address and a post-translation port number as destination information is received, a set of a private address and a post-translation port number associated with the set included in the received IP packet as destination information is read from the first translation table;
The communication control system according to any one of claims 1 to 3, further comprising: forwarding the received IP packet to a client device associated with the read set.
(Appendix 5)
The communication control system according to any one of claims 1 to 4, wherein the first communication control unit receives IP packets related to the communication in priority to the second communication control unit when a client device under the private network communicates with a device in an external network.
(Appendix 6)
The communication control system according to any one of claims 1 to 4, wherein the first communication control unit and the second communication control unit are made redundant.
(Appendix 7)
The second communication control unit is
when a set of a private address and a pre-conversion port number included as source information in the received IP packet is determined to be a new combination based on a second conversion table used for NAPT conversion by the second communication control unit, the second conversion table associating a private address and a pre-conversion port number with a global address and a post-conversion port number, determining whether or not the number of port numbers corresponding to the second global address and available for the NAPT conversion is equal to or less than a predetermined second threshold value;
If the number of port numbers available for the NAPT conversion is greater than the second threshold,
Allocating one available port number as a post-translation port number to the set included in the received IP packet as source information;
converting the set included in the received IP packet as source information into a set of the second global address and the converted port number;
registering the set included as source information in the received IP packet and the converted set in the second conversion table in association with each other;
Transmitting the IP packet with the converted source information to a destination device;
If the number of port numbers available for the NAPT conversion is equal to or less than the second threshold,
registering the set included as source information in the received IP packet and the first global address in the second conversion table in association with each other;
The communication control system according to any one of claims 1 to 6, further comprising: a first communication control unit that receives the IP packet and transmits the IP packet to the first communication control unit.
(Appendix 8)
The communication control system according to claim 7, wherein when the number of times the IP packet is transferred between a plurality of communication control devices becomes equal to or greater than a predetermined number of times, any one of the plurality of communication control devices discards the IP packet.
(Appendix 9)
When a set of a private address and a pre-translation port number included as source information in a received IP packet is determined to be a new combination based on a conversion table that associates a set of a private address and a pre-translation port number with a set of a global address and a post-translation port number, and that is used for NAPT (Network Address Port Translation) conversion in the network layer of the OSI reference model, the device determines whether the number of port numbers corresponding to its own global address and available for the NAPT conversion is equal to or less than a predetermined threshold value;
If the number of port numbers available for the NAPT conversion is equal to or less than the threshold,
registering the set included as source information in the received IP packet in the conversion table in association with a global address of another communication control device;
The communication control device transfers the received IP packet to the other communication control device.
(Appendix 10)
If the number of port numbers available for the NAPT conversion is greater than the threshold,
Allocating one available port number as a post-translation port number to the set included in the received IP packet as source information;
converting the set included as source information in the received IP packet into a set of the global address and the converted port number that the IP packet has;
registering the set included in the received IP packet as source information and the converted set in the conversion table in association with each other;
The communication control device according to claim 9, further comprising: a receiving unit configured to receive the IP packet from the receiving unit;
(Appendix 11)
When a set of a private address and a pre-translation port number included as source information in a received IP packet is determined to be a new combination based on a conversion table that associates a set of a private address and a pre-translation port number with a set of a global address and a post-translation port number, and that is used for NAPT (Network Address Port Translation) conversion in the network layer of the OSI reference model, the device determines whether the number of port numbers corresponding to its own global address and available for the NAPT conversion is equal to or less than a predetermined threshold value;
If the number of port numbers available for the NAPT conversion is equal to or less than the threshold,
registering the set included as source information in the received IP packet in the conversion table in association with a global address of another communication control device;
and transferring the received IP packet to the other communication control device.
(Appendix 12)
On the computer,
a process of determining whether the number of port numbers corresponding to the global address owned by the device and available for the NAPT conversion is equal to or less than a predetermined threshold value when the set of private address and pre-translation port number included in the received IP packet as source information is determined to be a new combination based on a conversion table that associates the set of private address and pre-translation port number with a set of global address and post-translation port number, the conversion table being used for NAPT conversion in the network layer of the OSI reference model;
If the number of port numbers available for the NAPT conversion is equal to or less than the threshold,
registering the set included as source information in the received IP packet in the conversion table in association with a global address of another communication control device;
and a program for causing the other communication control device to execute a process of forwarding the received IP packet.

1, 1a, 1b, 1c System 9 System 10, 10a, 10b Communication control system 10c Communication control device (communication control system)
12, 12c First communication control unit 12a Main device (first communication control unit)
12b First communication control device (first communication control unit)
14, 14c Second communication control unit 14b Second communication control device (second communication control unit)
14a Subsystem device (second communication control unit)
16b Third communication control device 90 Communication control device 20 Client device 30 External device 31 Server 1000 Computer 1010 Processor 1020 Storage unit 1030 ROM
1040 RAM
1050 Communication interface (IF)
1060 User Interface (IF)
G1, G2 Global address GN Global network PN Private network

Claims (10)

a first communication control unit connected to the private network and having a first global address;
a second communication control unit connected to the private network and having a second global address different from the first global address;
The first communication control unit is
When a set of a private address and a pre-translation port number included in a received IP packet as source information is determined to be a new combination based on a first translation table used for NAPT (Network Address Port Translation) translation in the network layer of the OSI reference model, the first translation table associating a private address and a pre-translation port number with a global address and a post-translation port number, the method determines whether the number of port numbers corresponding to the first global address and available for the NAPT translation is equal to or less than a predetermined threshold value;
If the number of port numbers available for the NAPT conversion is equal to or less than the threshold,
registering the set included as source information in the received IP packet and the second global address in the first conversion table in association with each other;
Transferring the received IP packet to the second communication control unit;
When a client device under the private network communicates with a device on an external network, the client device receives IP packets relating to the communication in priority over the second communication control unit. The first communication control unit is
If the number of port numbers available for the NAPT conversion is greater than the threshold,
Allocating one available port number as a post-translation port number to the set included in the received IP packet as source information;
converting the set included in the received IP packet as source information into a set of the first global address and the converted port number;
registering the set included as source information in the received IP packet and the converted set in the first conversion table in association with each other;
The communication control system according to claim 1 , further comprising: transmitting the IP packet, the source information of which has been converted, to a destination device. The first communication control unit is
When the set included in the received IP packet as source information is not determined to be a new combination based on the first conversion table, a set of a global address and a converted port number associated with the set included in the received IP packet as source information is read out from the first conversion table;
If the global address included in the read set is the first global address,
converting the set included in the received IP packet as source information into the read set;
Transmitting the IP packet with the converted source information to a destination device;
3 . The communication control system according to claim 1 , wherein when a global address included in the read set is the second global address, the received IP packet is transferred to the second communication control unit. 4 . When an IP packet including a set of a global address and a post-translation port number as destination information is received, a set of a private address and a post-translation port number associated with the set included in the received IP packet as destination information is read from the first translation table;
The communication control system according to claim 1 , further comprising: a communication control unit that transfers the received IP packet to a client device associated with the read set. The second communication control unit is
when a set of a private address and a pre-conversion port number included as source information in the received IP packet is determined to be a new combination based on a second conversion table used for NAPT conversion by the second communication control unit, the second conversion table associating a private address and a pre-conversion port number with a global address and a post-conversion port number, determining whether or not the number of port numbers corresponding to the second global address and available for the NAPT conversion is equal to or less than a predetermined second threshold value;
If the number of port numbers available for the NAPT conversion is greater than the second threshold,
Allocating one available port number as a post-translation port number to the set included in the received IP packet as source information;
converting the set included in the received IP packet as source information into a set of the second global address and the converted port number;
registering the set included as source information in the received IP packet and the converted set in the second conversion table in association with each other;
Transmitting the IP packet with the converted source information to a destination device;
If the number of port numbers available for the NAPT conversion is equal to or less than the second threshold,
registering the set included as source information in the received IP packet and the first global address in the second conversion table in association with each other;
The communication control system according to claim 1 , further comprising: a first communication control unit that transfers the received IP packet to the first communication control unit. 6. The communication control system according to claim 5, wherein when the number of times the IP packet is transferred between a plurality of communication control devices reaches or exceeds a predetermined number of times, any one of the plurality of communication control devices discards the IP packet. When a set of a private address and a pre-translation port number included as source information in a received IP packet is determined to be a new combination based on a conversion table that associates a set of a private address and a pre-translation port number with a set of a global address and a post-translation port number, and that is used for NAPT (Network Address Port Translation) conversion in the network layer of the OSI reference model, the device determines whether the number of port numbers corresponding to its own global address and available for the NAPT conversion is equal to or less than a predetermined threshold value;
If the number of port numbers available for the NAPT conversion is equal to or less than the threshold,
registering the set included as source information in the received IP packet in the conversion table in association with a global address of another communication control device connected to the private network ;
Transferring the received IP packet to the other communication control device;
a communication control device which, when a client device under the private network communicates with a device on an external network, receives IP packets relating to the communication in priority over the other communication control devices; If the number of port numbers available for the NAPT conversion is greater than the threshold,
Allocating one available port number as a post-translation port number to the set included in the received IP packet as source information;
converting the set included as source information in the received IP packet into a set of the global address and the converted port number that the IP packet has;
registering the set included in the received IP packet as source information and the converted set in the conversion table in association with each other;
The communication control device according to claim 7 , wherein the received IP packet is transmitted to a destination device. When a set of a private address and a pre-translation port number included as source information in a received IP packet is determined to be a new combination based on a conversion table that associates a set of a private address and a pre-translation port number with a set of a global address and a post-translation port number, and that is used for NAPT (Network Address Port Translation) conversion in the network layer of the OSI reference model, the device determines whether the number of port numbers corresponding to its own global address and available for the NAPT conversion is equal to or less than a predetermined threshold value;
If the number of port numbers available for the NAPT conversion is equal to or less than the threshold,
registering the set included as source information in the received IP packet in the conversion table in association with a global address of another communication control device connected to the private network ;
Transferring the received IP packet to the other communication control device;
When a client device under the private network communicates with a device on an external network, the client device receives IP packets related to the communication in priority over the other communication control devices. On the computer,
a process of determining whether the number of port numbers corresponding to the global address owned by the device and available for the NAPT conversion is equal to or less than a predetermined threshold value when the set of private address and pre-translation port number included in the received IP packet as source information is determined to be a new combination based on a conversion table that associates the set of private address and pre-translation port number with a set of global address and post-translation port number, the conversion table being used for NAPT conversion in the network layer of the OSI reference model;
If the number of port numbers available for the NAPT conversion is equal to or less than the threshold,
registering the set included as source information in the received IP packet in the conversion table in association with a global address of another communication control device connected to the private network ;
A process of transferring the received IP packet to the other communication control device;
When a client device under the private network communicates with a device of an external network, the client device receives IP packets related to the communication in priority to the other communication control devices;
A program for executing the above.

Images