JP2004304281A - Address management method, management device, and program for voice communication gate device - Google Patents

Abstract

An address management method of a voice communication gate device capable of realizing VoIP communication with high security is provided.
A gate device requests a new address request from a management device via a public telephone network when the device is activated. The management device M receives the request and transmits a new address to the gate device A via the public telephone network 1, and the gate device A registers the new address inside. Further, the management device M periodically transmits the current address and the changed address of the gate device A to the gate device A via the public telephone network 1, and the gate device A receives the current address and the changed address from the management device M instead of the current address. Register the changed address internally. As a result, the address of the gate device A is changed periodically, and security is ensured.
[Selection diagram] Fig. 1

Description

[0001]
TECHNICAL FIELD OF THE INVENTION
The present invention relates to a voice communication gate device used for performing voice communication using an IP network such as the Internet, and more particularly to an address management method, a management device, and a program for a voice communication gate device with improved security. .
[0002]
[Prior art]
In recent years, VoIP (Voice over IP) that enables voice communication in an IP network such as the Internet has been spreading. FIG. 4 is a block diagram showing a configuration of a voice communication system which implements a voice communication method using VoIP (Japanese Patent Application No. 2002-31337) previously filed by the applicant of the present invention. In the system shown in this figure, a public telephone network 1 transmitting a call control signal and an IP network 2 transmitting a VoIP bearer signal (voice signal) are used as networks. The public telephone network 1 accommodates a user's telephone as in the past, but is connected to SP-less exchanges 3 and 4, which process only call control signals and do not control a speech path (SP). In terms of signal control, the exchanges 3 and 4 have the same Q.Q. 931, an ISUP (ISDN User Part) protocol is processed between exchanges.
[0003]
The gate devices 5 and 6 are devices installed on the user side, and the internal configuration of the gate device 5 is shown in FIG. In FIG. The 931 controller 11 communicates with the SP-less exchange 3 in Q.931. 931 protocol is terminated, and {circle around (1)} Q.11 linked with SIP Proxy12. 931-SIP protocol conversion, (2) telephone number and private address conversion with reference to the telephone number-private address conversion table 13, and (3) F / W (firewall) 14 control.
[0004]
The SIP Proxy 12 terminates the SIP protocol with the VoIP telephone 7 (FIG. 4). 931 controller 11 and the Q.931 Call control according to the 931 protocol is performed. F / W14 is Q.W. According to an instruction from the 931 controller 11, opening and closing of ports and conversion between private addresses and addresses of the IP network 2 are performed. The address translation has a NAPT (Network Address Port Translation) function (or an IP masquerade function) that can map n private addresses to one IP network address.
[0005]
By the way, since the gate device in the above-described system is generally installed at a user's house or the like, the gate device is always activated and connected to the Managed-IP network, and the IP address of the Managed-IP network is assigned to the gate device. Have been. If this IP address is fixed, malicious persons connected to the Managed-IP network can directly specify each other's IP addresses by modifying the gate device, etc. The possibility of performing direct communication increases.
In addition, if the Service-to-Self can obtain the IP address of a third party through a packet monitor or the like, a Dos attack on the third party becomes possible. In the voice communication method disclosed in Japanese Patent Application No. 2002-31337, since the port of the gate device is normally closed and the port is opened only for talking, the risk of Dos attack can be avoided to some extent, but further improvement in security is desired. It is.
Note that Patent Documents 1 to 3 are known as conventional techniques.
[0006]
[Patent Document 1]
JP-A-6-70354 [Patent Document 2]
JP-A-11-53669 [Patent Document 3]
JP 2000-270026 A
[Problems to be solved by the invention]
The present invention has been made in view of the above circumstances, and an object of the present invention is to provide an address management device in a network, and to periodically change the IP address of a voice communication gate device from the management device, thereby improving security. It is an object of the present invention to provide an address management method, a management device, and a program for a voice communication gate device capable of realizing high VoIP communication.
[0008]
[Means for Solving the Problems]
SUMMARY OF THE INVENTION The present invention has been made to solve the above-mentioned problems, and the invention according to claim 1 is connected to an IP network, connected to a gate device connected to a public telephone network, and connected to a public telephone network. An address management system for a voice communication gate device having a management device for managing an IP address of the gate device, wherein the gate device requests a new address request from the management device via a public telephone network at the time of startup. Receiving the request, transmitting a new address to the gate device via a public telephone network, and internally registering the new address received by the gate device from the management device, The management device is notified via the telephone network, and the management device registers the telephone number and the new address of the gate device internally. An address management method of voice communication gate device to.
[0009]
According to a second aspect of the present invention, in the address management method of the voice communication gate device according to the first aspect, when the management device receives a request from the gate device, the management device stores a telephone number associated with the request and an internal number. The authentication of the gate device is performed by comparing the telephone number of the gate device stored in advance with the telephone number of the gate device.
According to a third aspect of the present invention, in the address management method for the voice communication gate device according to the first or second aspect, when the gate device receives a new address from the management device, the gate device notifies the new address. The authentication of the management device is performed by collating the telephone number according to the above with the telephone number of the management device stored in advance therein.
[0010]
According to a fourth aspect of the present invention, there is provided a voice device having a gate device connected to an IP network and connected to a public telephone network, and a management device connected to the public telephone network and managing an IP address of the gate device. In the address management system for a communication gate device, the management device periodically transmits the current address and the changed address of the gate device to the gate device via a public telephone network, and the gate device replaces the current address. Registering the changed address received from the management device internally, and notifying the registration to the management device via a public telephone network, and the management device stores the telephone number of the gate device and the changed address. An address management method for a voice communication gate device, wherein the address is registered internally.
[0011]
According to a fifth aspect of the present invention, in the address management method of the voice communication gate device according to the fourth aspect, when the gate device receives the changed address from the management device, the telephone number according to the changed address notification is received. And a telephone number of the management apparatus stored in advance therein to authenticate the management apparatus.
[0012]
The invention according to claim 6 is an address management device for a voice communication gate device that is connected to an IP network and manages an IP address of the gate device connected to a public telephone network. Receiving means for receiving a new address request transmitted from the device via the public telephone network; and receiving the new address request and transmitting the new address stored in the internal storage unit to the gate device via the public telephone network. New address transmitting means for transmitting, and changed address transmitting means for periodically reading an address registered in advance in the storage unit and transmitting the converted address to the gate device via a public telephone network as a converted address. An address management device for a voice communication gate device.
[0013]
According to a seventh aspect of the present invention, in the address management device of the voice communication gate device according to the sixth aspect, when a new address request is received from the gate device, a telephone number associated with the request is stored in advance therein. The authentication of the gate device is performed by collating with the telephone number of the gate device.
[0014]
The invention according to claim 8 is a program used in an address management device of a voice communication gate device that is connected to an IP network and manages an IP address of a gate device connected to a public telephone network. Receiving a new address request transmitted from the gate device via the public telephone network at the time of activation of the gate device, receiving the new address request, and changing the new address stored in the internal storage unit to the public. A new address transmission process for transmitting to the gate device via the telephone network, and a change for periodically reading an address previously registered in the storage unit and transmitting the converted address to the gate device via the public telephone network as a converted address. This is a program for executing post-address transmission processing.
[0015]
According to a ninth aspect of the present invention, in the program according to the eighth aspect, when a new address request is received from the gate device, the telephone number associated with the request and the gate device stored in advance therein are stored. It is characterized by having a process of performing authentication of the gate device by collating with a telephone number.
[0016]
BEST MODE FOR CARRYING OUT THE INVENTION
Hereinafter, embodiments of the present invention will be described with reference to the drawings. FIG. 1 is a block diagram showing a configuration of a voice communication system to which an address management method according to an embodiment of the present invention is applied. The management system shown in this figure is a system configured by applying the address management method of the present invention to the voice communication system shown in FIG.
[0017]
In the figure, the management device M includes a controller 21, an SNMP manager 22, a F / W (NAPT) 23, a DNS (Domain Name Server) 24, and a DHCP (Dynamic host configuration protocol) server 28. The controller 21 communicates a Q.I. 931 protocol is terminated and {circle around (1)} Q. 931-SNMP (Simple Network Management Protocol) protocol conversion and (2) F / W 23 control. The manager 22 performs an instruction to change the IP address of the gate device A in cooperation with the controller 21, and manages the change of the IP address of the gate device A in cooperation with the DHCP server 28 and the DNS 24. To change the IP address, SNMP, which is a device management protocol, is used internally.
[0018]
Here, SNMP is a protocol used for remote management of devices in an IP network, and virtual management data called MIB (Management Information Base) is provided in each managed device, and this is provided to a management server as a manager. Performs remote management of the device by acquiring and operating. In this case, the function of processing the MIB of the management target device is called an agent. The MIB is standardized according to the device type, and special data is extended for each device vendor. SNMP has the advantage that many products can be managed and device management can be realized at low cost. In this embodiment, by using the standard protocol in this way, it is possible to reduce the system cost by using commercially available SNMP, DHCP server, and DNS-mounted products.
[0019]
The F / W (NAPT) 23 opens and closes a port and converts between a private address and an address on the IP network 2 side according to an instruction from the controller 21. The address translation has a NAPT function (or IP masquerade function) in which n private addresses can be mapped to one IP network address. The DNS 24 manages a correspondence table between the telephone number of the user and the IP address of the gate device. The DHCP server 28 manages the IP address of each gate device in order to issue and change a new IP address.
[0020]
Further, the gate device A has Q.O. A 931 controller 11, a SIP Proxy 12, a F / W 14 are provided, and an SNMP agent 26 is provided.
[0021]
Next, the operation of the above-described system will be described with reference to the sequence diagrams of FIGS.
FIG. 2 shows a sequence of address acquisition from the gate device A to the manager 22 of the management device M in order to newly acquire an IP address when the gate device A is activated. FIG. 3 shows a sequence of address change from the manager 22 of the management device M to the agent 26 of the gate device A in order to further improve security after the new acquisition of the IP address in FIG.
[0022]
First, the symbols used in FIGS. 2 and 3 will be described.
AM: Private IP address of the manager 22 of the management device M AC: Private IP address of the controller 21 of the management device M GA: New IP address of the gate device A
GC: IP address after change of gate device A AA: Private IP address of agent 26 of gate device A # A1: Phone number of gate device A # M1: Phone number of management device M "": SNMP signal []: DHCP Signal ｛｝: DNS signal <>: Q. 931 signal []: internal signal unique to this embodiment
Next, the sequence for issuing a new address in FIG. 2 will be described with reference to STEP1 to STEP13 below.
STBP1: When the gate device A is activated, the agent 26 sends "TRAP" information including a command [New] for giving a new address to the Q.25. 931 to the controller 11.
STBP2: Q. The 931CC converts “TRAP”, [New], and Cid, which is the value of the Ca11-ID for identifying a session, into facility information in <REGISTER> of a line non-corresponding UUI (UUI; User-User information). And sends it to the SP-less exchange 25. Here, Cid is information for uniquely identifying a communication session for address acquisition, and uses # A1 which is the telephone number of the gate device A.
[0024]
STEP3: The SP-less exchange 25 transmits <FACILITY> to the management device M via the common channel signaling network SS # 7 network. 931 Returns <REL COMP> to the controller 11.
STEP 4: The controller 21 of the management apparatus M receiving <FACILITY> registers the calling number # A1 of the gate apparatus A in advance in the management apparatus M in order to confirm whether the request is a valid new address delivery request. It is checked whether the telephone number of the gate device A is present. If the collation is OK, “TRAP” including [New] and # A1 is transmitted to the address AM of the manager 22. The manager 22 sends [DISCOVER] including # A1 to the DHCP server 28 from # A1 included in “TRAP”. Next, the manager 22 receives [OFFER] including the GA of the gate device A and # A1 from the DHCP server as a response, and newly assigns the controller 21 with the GA of the gate device A (# A1). SET Request ”.
[0025]
STEP 5: After receiving the “SET Request” from the manager 22, the controller 21 of the management device M stores the GA of the gate device A, the “SET Request” including [New], and the Cid in the <RHGISTBR> of the line non-corresponding UUI. And sends it to the SP-less exchange 25.
STEP 6: The SP-less exchange 25 transmits <FACILITY> to the gate device A via the common channel signaling network SS # 7 network, and if the transmission is correct, the controller 21 of the management device M transmits <REL COMP>. Reply.
[0026]
STEP7: Q. of the gate device A receiving the <FACILITY> The 931 controller 11 uses the telephone number of the management apparatus M registered in advance in its own gate apparatus A in order to check whether the request is a valid management apparatus M or not. Check if there is. Then, if the collation is OK, “SET Request” including GA and [New] is transmitted to the address AA of the agent 26.
STEP8: The agent 26 transmits [New] is transmitted to the firmware 14 via the 931 controller 11 to newly register the GA.
[0027]
STEP 9: The F / W 14 registers the GA in the gate device A as a new address, [Registration completion notification OK] is returned to the address AA of the agent 26 via the 931 controller 21.
STEP 10: The agent 26 transmits A “GET Response” including GA and [New] is transmitted to the 931 controller 11. Q. The 931 controller 11 sets “GET Response” and Cid in facility information or the like in <RBGISTBR> of the line non-corresponding UUI, and sends it to the SP-less exchange 25.
[0028]
STEP11: The SP-less exchange 25 transmits <FACILITY> to the management device M via the common channel signaling network SS # 7 network. 931 Returns <REL COMP> to the controller 11.
STEP12: The controller 21 of the management apparatus M having received the <FACILITY> confirms the facility information, and transmits "GET Response" to the address AM of the manager 22. The manager 22 checks # A1 and GA included in the "GET Response", sends "REQUEST" including # A1 and GA to the DHCP server 28, and notifies the DHCP server 28 that the GA has been properly paid.
[0029]
STBP13: The DHCP server 28 that has received [REQUEST] sends out {NSUPDATE} including # A1 and GA to the DNS 24 that manages the telephone number and IP address, and registers # A1 and GA of the gate device A. When the registration is completed, the DNS 24 returns a completion OK to the DHCP server 28. The DHCP server 28 that has received the OK returns an ACK to the manager 22.
STBP 14: The manager 22 receives ACK from the DHCP server 28, and the sequence is completed.
[0030]
Next, the sequence of the address change in FIG. 3 will be described in the following STEP1 to STEP12.
STEP1: The manager 22 of the management device M transmits {NSLOOKUP} to the DNS 24 to change the IP address of the gate device A, and acquires the address information of the gate device A from the DNS 24. This change shall be made periodically, and the cycle shall be as short as possible for security.
STEP 2: The manager 22 sends [DISCOVBR] including # A1 to the DHCP server 28, receives the changed address GC of the gate device A, and [OFFBR] including # A1 from the DHCP server 28, and A “SET Request” including a command [Renew], # A1, GA, and GC for changing from the GA of the gate device A (# A1) to the GC is transmitted to the address AC.
[0031]
STBP3: After receiving the “SET Request” from the manager 22, the controller 21 of the management device M transmits [Renew], the GA of the gate device A, the “SET Request” including the changed GC, and the Cid of the line non-corresponding UUI. It is set in the facility information in <REGISTER> and transmitted to the SP-less exchange 25.
STEP 4: The SP-less exchange 25 transmits <FACILITY> to the gate device A via the common channel signaling network SS # 7 network, and if the transmission is correct, the controller 21 of the management device M transmits <REL COMP>. Reply.
[0032]
STEP5: Q. of the gate device A receiving <FACILITY> The 931 controller 11 checks the calling number # M1 of the management device M against the telephone number of the management device M registered in the own gate device A in advance to check whether the request is from the management device M. If the verification is OK, the facility information is confirmed, and “SET Request” including GA and GC is transmitted to the address AA of the agent 26.
(Step 6) The agent 26 [Renew] is transmitted to the 931 controller 11 to change from GA to GC.
[0033]
STEP7; The 931 controller 11 monitors the idle / busy status of all the channels, and transmits [Renew] to the F / W 14 when all the channels are in the unused state, and issues an instruction to change from GA to GC. put out. When the change has been completed, the F.W. The completion OK is returned to the address AA of the agent 26 via the 931 controller 11.
STEP8: The agent 26 transmits A [GET Response] including [Renew], the old GA, and the new GC is transmitted to the 931 controller 11. Q. The 931 controller 11 sets [GET Response] including [Renew], GA, GC and Cid in facility information in <REGISTER> of the line non-corresponding UUI, and transmits the same to the SP-less exchange 25.
[0034]
STEP 9: The SP-less exchange 25 transmits <FACILITY> to the management device M via the common channel signaling network SS # 7 network. 931 Returns <RBL COMP> to the controller 21.
STEP 10: The controller 21 of the management apparatus M that has received the <FACILITY> checks the facility information, and transmits “GET Response” to the address AM of the manager 22. The manager confirms # A1 included in the “GET Response”, sends [REQUEST] including # A1 and GC to the DHCP server 28, and notifies the DHCP server 28 that the GC has been properly paid out.
[0035]
STEP11: The DHCP server 28 receiving [RBQUEST] sends out {NUPDATE} including # A1 and GC to the DNS 24 which manages the telephone number and the IP address, and the gate device A changes # A1 from GA to GC. Register that it has become. When the registration is completed, the DNS 24 returns a completion OK to the DHCP server 28. The DHCP server 28 that has received the OK returns an ACK to the manager 22.
STEP 12: The manager 22 transmits [RELEASE] including the old GA to the DHCP server 28, and informs that the GA is not normally used. After releasing the GA by the DHCP server 28, the manager 22 receives ACK from the DHCP server 28, and the sequence is completed.
[0036]
After the execution of the above-described sequence, the IP address is changed in order to suppress a false address change (for example, performing an unauthorized communication by pretending to change the IP address without actually changing the IP address) by modifying the gate device A. It is necessary to confirm whether or not has been changed correctly, but this can be realized by applying the sequence shown in Japanese Patent Application No. 2003-38256 "Management method of voice communication gate device" after the above sequence is completed. The above sequence is merely an example of the operation, and there may be variations in the elder brother of the IP address. For this reason, changes within a range that does not depart from the gist of the present invention are possible.
[0037]
The above is the details of the embodiment of the present invention. If the IP address is fixed as in the conventional device, malicious parties connected to the Managed-IP network directly specify each other's IP address by modifying the gate device, etc. The possibility of performing unauthorized direct communication under control increases. If the Service-to-Self can obtain the IP address of a third party, a Dos attack against a third party is also possible. However, in the above-described embodiment, the IP address of the gate device is set to Q.4. The security problem described above is solved by periodically changing the route in the 931 route, and VoIP communication with higher security can be performed.
[0038]
[Explanation of effects]
As described above, according to the present invention, secure and reliable IP address setting and periodic change can be realized for the voice communication gate device, and an effect that VoIP communication with high security can be obtained is obtained.
[Brief description of the drawings]
FIG. 1 is a block diagram showing a configuration of a system to which an address management method for a voice communication gate device according to an embodiment of the present invention is applied.
FIG. 2 is a sequence diagram for explaining the operation of the embodiment.
FIG. 3 is a sequence diagram for explaining the operation of the embodiment.
FIG. 4 is a block diagram illustrating a configuration example of a VoIP communication system.
FIG. 5 is a block diagram showing details of a gate device 5 in FIG. 4;
[Explanation of symbols]
1 public telephone network 2 IP network 7 VoIP telephone 11 Q. 931 Controller 12: SIP Proxy
14 ... F / W
21 Controller 22 Manager 23 F / W
24 ... DNS
26 agent 28 DHCP server A gate device M management device

Claims (9)

An address management system for a voice communication gate device, comprising: a gate device connected to an IP network and connected to a public telephone network; and a management device connected to the public telephone network and managing an IP address of the gate device.
The gate device, at the time of activation, requests a new address request to the management device via a public telephone network,
The management device receives the request, transmits a new address to the gate device via a public telephone network,
The gate device registers a new address received from the management device internally, and notifies the management device of the registration via a public telephone network,
The address management method for a voice communication gate device, wherein the management device registers the telephone number of the gate device and the new address therein. The management device, upon receiving a request from the gate device, performs authentication of the gate device by comparing the telephone number of the request with the telephone number of the gate device stored in advance therein. 2. The address management method for a voice communication gate device according to claim 1, wherein: When the gate device receives a new address from the management device, the gate device authenticates the management device by comparing the telephone number of the notification of the new address with the telephone number of the management device stored in advance therein. 3. The address management method for a voice communication gate device according to claim 1, wherein the address management is performed. An address management system for a voice communication gate device, comprising: a gate device connected to an IP network and connected to a public telephone network; and a management device connected to the public telephone network and managing an IP address of the gate device.
The management device periodically transmits the current address and the changed address of the gate device to the gate device via a public telephone network,
The gate device, instead of the current address, internally registers the changed address received from the management device, and notifies the management device of the registration via a public telephone network,
An address management method for a voice communication gate device, wherein the management device registers therein the telephone number of the gate device and the changed address. Upon receiving the changed address from the management device, the gate device authenticates the management device by comparing the telephone number associated with the changed address notification with the telephone number of the management device stored in advance therein. 5. The address management method for a voice communication gate device according to claim 4, wherein: An address management device for a voice communication gate device connected to an IP network and managing an IP address of a gate device connected to a public telephone network,
Receiving means for receiving a new address request transmitted from the gate device via a public telephone network at the time of activation of the gate device,
New address transmitting means for receiving the new address request and transmitting a new address stored in an internal storage unit to the gate device via a public telephone network;
A post-change address transmitting means for periodically reading an address registered in advance in the storage unit and transmitting the converted address to the gate device via a public telephone network as a post-conversion address;
An address management device for a voice communication gate device, comprising: When a new address request is received from the gate device, the telephone number of the request is compared with the telephone number of the gate device stored in advance therein to authenticate the gate device. The address management device for a voice communication gate device according to claim 6. A program used in an address management device of a voice communication gate device that is connected to an IP network and manages an IP address of a gate device connected to a public telephone network,
On the computer,
A receiving process of receiving a new address request transmitted from the gate device via a public telephone network when the gate device is activated,
A new address transmission process of receiving the new address request and transmitting a new address stored in an internal storage unit to the gate device via a public telephone network;
A post-change address transmission process of periodically reading an address registered in advance in the storage unit and transmitting the converted address to the gate device via the public telephone network as a converted address;
The program to execute. When receiving a request for a new address from the gate device, a process of verifying the gate device by comparing the telephone number of the request with the telephone number of the gate device stored in advance therein is provided. The program according to claim 8, wherein:

Images