JP2013026730A - Communication system - Google Patents

Abstract

PROBLEM TO BE SOLVED: To provide a communication system capable of reducing a communication cost for polling communication under a DNS environment.
A device communication server 4 transmits a communication request with a specific client device 1 to a DNS server 2, and the DNS server 2 that has received the communication request specifies access information for accessing the device communication server 4. The client device 1 transmits an inquiry signal including specific information for specifying its own terminal, and the DNS server 2 that has received the inquiry signal includes the specific information included in the inquiry signal. When the access information associated with the corresponding client device 1 is stored, the access information is transmitted to the client device 1 that is the transmission source of the inquiry signal, and the client device 1 sends the access information to the device communication server 4 based on the access information. to access.
[Selection] Figure 1

Description

  The present invention relates to a communication system.

  Generally, when a device communication server transmits data to a client device connected to a network via a NAT router or a firewall, polling from the client device to the device communication server is necessary.

  When performing polling, the client device performs name resolution by DNS (Domain Name System) in order to convert the domain name of the device communication server that is the connection destination into an IP address. Then, the client device can obtain an IP address converted from the FQDN from the DNS by inquiring the DNS of a fully qualified domain name (FQDN) in which a unique server name is added to the domain name owned by the operator. In such a DNS, hierarchical distributed management including a DNS content server and a DNS cache server is performed.

  In DNS, a DNS cache server caches an IP address once acquired by a client device for a set cache holding period (cache TTL (Time To Live)). Therefore, the DNS content server does not always perform name resolution in response to an inquiry from a client device. However, in the case of device communication, the FQDN may be updated. In such a case, the DNS content server performs name resolution every time an inquiry is made from a client device.

  After acquiring the IP address of the device communication server as described above, the client device polls the device communication server using the acquired IP address.

JP-A-2004-280717 Japanese Patent Laid-Open No. 2007-172048

  In the conventional communication system described above, every time polling from the client device to the device communication server occurs, both communication for name resolution by DNS and communication for polling occur, so the communication load increases. It was. Therefore, communication costs such as line costs, computer resources on the server side and client device side are required.

  The present invention has been made in view of the above reasons, and an object of the present invention is to provide a communication system capable of reducing the communication cost for polling communication in a DNS environment.

  The communication system of the present invention includes a device communication server, a DNS server, the device communication server, and a client device connected to the DNS server via a network, and the device communication server is a specific client. The DNS server that has transmitted a communication request with a device to the DNS server and received the communication request stores access information for accessing the device communication server in association with the specific client device, and the client device Transmits an inquiry signal including specific information for specifying its own terminal, and the DNS server that has received the inquiry signal transmits the inquiry signal associated with the client device corresponding to the specific information included in the inquiry signal. If access information is stored, the inquiry signal is sent. Transmits the said access information to the client device as a source, the client device is characterized in that access to the device communication server based on the access information.

  In the present invention, the DNS server receives the communication request, associates the access information with the specific client device, and stores it for a content holding period, and the client device acquires the DNS content server. A DNS cache server that stores the access information in association with the client device that has acquired the access information for a cache retention period, and the client device has the content retention time length of the cache retention period. When the time length of the period is shorter, the inquiry signal is transmitted to the DNS cache server, and the DNS cache server does not store the access information associated with the client device that is the transmission source of the inquiry signal. When the inquiry signal is transmitted to the DNS content server, and the time length of the cache retention period is longer than the time length of the content retention period, the client device may transmit the inquiry signal to the DNS content server. preferable.

  In this invention, it is preferable that the client device generates the specific information with a different data sequence every time the inquiry signal is transmitted.

  In the present invention, the client device generates the specific information by hashing a data string including at least a device ID assigned in advance to the terminal and an encryption key acquired from the device communication server. It is preferable to acquire a new encryption key from the device communication server after transmitting the inquiry signal including specific information.

  In the present invention, when the DNS server receives the communication request, the DNS server stores the access information in association with the specific client device, and the access information acquired by the client device. A DNS cache server that stores information over a cache retention period in association with the acquired client device, and the cache retention period of the DNS cache server is shorter than a cycle in which the client device transmits the inquiry signal. The client device transmits the inquiry signal to the DNS cache server, and the DNS cache server stores the access information associated with the client device that is the transmission source of the inquiry signal. If not, the inquiry signal is transmitted to the DNS content server, and if the client device does not receive the access information corresponding to the inquiry signal, it is based on the access information of the device communication server held in advance. It is preferable to access the device communication server.

  As described above, according to the present invention, communication for name resolution by DNS can also serve as a polling function, so that it is possible to reduce the communication cost for polling communication in a DNS environment. .

1 is a block diagram illustrating a configuration of a communication system according to a first embodiment. It is a table figure which shows the structure of the apparatus information table of a client apparatus same as the above. It is a table figure which shows the structure of the apparatus information table of an apparatus communication server same as the above. It is a table figure which shows the structure of content information same as the above. It is a table figure which shows the structure of cache information same as the above. It is a sequence diagram which shows polling communication same as the above. It is a table figure which shows content information same as the above. It is a table figure which shows cache information same as the above. It is a sequence diagram which shows a negative cache production | generation process same as the above. It is a table figure which shows the structure of the apparatus information table of the client apparatus of Embodiment 3. It is a table figure which shows the structure of the apparatus information table of an apparatus communication server same as the above.

  Hereinafter, embodiments of the present invention will be described with reference to the drawings.

(Embodiment 1)
FIG. 1 shows a configuration of a communication system according to the present embodiment. A home network NT1 is constructed at a customer's home, and a client device 1 and a DNS cache server 2B are connected to the home network NT1. The home network NT1 is connected to the external network NT2, which is a wide area network including the Internet, via the NAT router 3. A DNS content server 2A and a device communication server 4 are connected to the external network NT2, and the DNS content server 2A and the device communication server 4 constitute a center server CS. Further, the DNS content server 2A and the DNS cache server 2B constitute a DNS server 2.

  First, the client device 1 includes devices to be monitored and controlled, and includes a data acquisition unit 11, a DNS client unit 12, and a device information table 13. The data acquisition unit 11 has a function of acquiring data related to monitoring / control from the device communication server 4, and the DNS client unit 12 makes a DNS inquiry (hereinafter referred to as inquiry) to the DNS server 2, and the DNS Communicate for name resolution. The DNS client unit 12 can acquire the IP address converted from the FQDN from the DNS server 2 by transmitting the FQDN (Fully Qualified Domain Name) of the device communication server 4 to the DNS server 2. This FQDN corresponds to the inquiry signal of the present invention. Then, the data acquisition unit 11 accesses the device communication server 4 using the acquired IP address, and acquires data destined for the own terminal from the device communication server 4. Furthermore, as shown in FIG. 2, the device information table 13 stores a device ID assigned in advance to the client device 1.

  The DNS cache server 2B has a cache function for an inquiry from the client device 1, and includes a cache information holding unit 22 that stores cache information. Note that the DNS cache server 2B may be installed outside the customer's home and in a location close to the client device 1 in terms of the network.

  The DNS content server 2 </ b> A includes a content information holding unit 21 that stores content information related to a subdomain delegated by a domain manager.

  The device communication server 4 stores data to be transmitted to the client device 1 in the data holding unit 41. Furthermore, the device communication server 4 includes a device information table 42 (see FIG. 3) that stores device IDs for each client device 1, and a communication unit 43 that performs network communication between the client device 1 and the DNS content server 2A. . Note that the device ID for each client device 1 is stored in the device information table 42 when the client device 1 connected to the home network NT1 transmits the device ID of its own terminal to the device communication server 4.

  The DNS server 2 of this system has a distributed database function composed of a DNS content server 2A and a DNS cache server 2B.

  The DNS content server 2A stores the content information [FQDN, IP address, content holding period] shown in FIG. This IP address corresponds to the access information of the present invention. For example, when the server holds the “example.jp” domain, “12.34.56.78” is set as the IP address corresponding to the FQDN “polling1.example.jp” in the content information. Has been. When there is an inquiry about the IP address corresponding to the FQDN “polling1.example.jp”, the DNS content server 2A returns the IP address “12.34.56.78” (forward lookup). Since the forward lookup data is often changed, a content holding period (content TTL (Time To Live)) indicating the valid period of the IP address is set for each content information (see FIG. 4).

  The DNS cache server 2B stores the cache information [FQDN, IP address, cache retention period] shown in FIG. This IP address corresponds to the access information of the present invention. Usually, the client device 1 makes an initial inquiry to the DNS cache server 2B. In the DNS cache server 2B, when the IP address corresponding to the inquiry FQDN is not held in the cache information holding unit 22, or the cache holding period (cache TTL) of the held cache data has passed. In this case, an inquiry is made to the DNS content server 2A. The DNS cache server 2B acquires an IP address corresponding to the FQDN of the inquiry from the DNS content server 2A and transmits it to the client device 1 that is the inquiry source. Further, when the IP address corresponding to the inquired FQDN is acquired from the DNS content server 2A, these data are stored in the cache information together with the cache retention period (expiration date) as shown in FIG. The DNS cache server 2B returns the IP address in the cache information holding unit 22 to the client device 1 when an inquiry about the IP address corresponding to the same FQDN is received from the client device 1 within the cache holding period. In FIG. 5, the expiration date (time) holding the cache information is used as the cache holding period.

  Further, the DNS cache server 2B may not be able to obtain content information from the DNS content server 2A. In this case, the DNS cache server 2B holds the inquired FQDN in the cache information together with the cache holding period at the time of negative caching set in advance for the entire domain (see FIG. 5). As described above, a negative cache period is set for an inquiry by FQDN for which an IP address cannot be obtained, so that an invalid inquiry does not occur in the DNS content server 2A. In this system, the time length of the negative cache period is set to be shorter than the inquiry transmission cycle by the client device 1 (for example, 10 seconds).

  In such a communication system, since the NAT router 3 exists, data cannot be transmitted from the device communication server 4 to the client device 1 without performing polling communication by the client device 1. That is, when the device communication server 4 transmits data to the client device 1 connected to the network via the NAT router 3, polling communication by the client device 1 is necessary.

  Hereinafter, polling communication of this system will be described using the communication sequence of FIG.

  First, when the device communication server 4 wants to transmit data to the client device 1 assigned with the device ID “12345-00001”, the device communication server 4 transmits a communication request including the device ID “12345-00001” to the DNS content server 2A. (S1). Specifically, the communication request is generated including the FQDN of the device communication server 4, the IP address that is the access destination of the client device 1, and the data of the content holding period. In the host name of FQDN, the device ID of the client device 1 that is the target of the communication request is set.

  Then, the DNS content server 2A that has received the communication request stores the content information shown in FIG. 7 in the content information holding unit 21 (S2). The content information includes data of the FQDN of the device communication server 4, the IP address that is the access destination of the client device 1, and the content holding period.

  Then, the client device 1 generates an inquiry using the FQDN “12345-00001.example.jp” including the device ID of the own terminal (S3), and makes this inquiry to the DNS cache server 2B (S4). In this case, since there is no cache information associated with the device ID of the inquiring client device 1 in the cache information holding unit 22 of the DNS cache server 2B (S5), the DNS cache server 2B sends the information to the DNS content server 2A. A similar inquiry is made (S6). This inquiry cycle T1 is set to a certain period (for example, 10 seconds).

  The content information holding unit 21 of the DNS content server 2A stores an IP address corresponding to the FQDN “12345-00001.example.jp” (see FIG. 7). That is, the content information associated with the device ID of the client device 1 as the inquiry source is stored (S7). Therefore, the DNS content server 2A returns the IP address “12.34.56.78” of this content information to the DNS cache server 2B (S8).

  As shown in FIG. 8, the DNS cache server 2B generates cache information in which the IP address “12.34.56.78” is associated with the FQDN “12345-00001.example.jp”, and the cache information holding unit 22 (S9). Further, the DNS cache server 2B returns the IP address “12.34.56.78” to the client device 1 (S10).

  In response to the transmission of the communication request, the client device 1 having received the IP address response recognizes that communication with the device communication server 4 is necessary (S11), and accesses the returned IP address (S12). . The device communication server 4 accessed from the client device 1 performs authentication using the device ID of the client device 1, and then transmits the data stored in the data storage unit 41 to the client device 1 (S13, S14). The client device 1 receives data from the device communication server 4 (S15).

  Thereafter, when the inquiry using the FQDN “12345-00001.example.jp” is within the cache holding period T2, the DNS cache server 2B refers to the cache information holding unit 22 and sends an IP address to the client device 1. Returns the address.

  After the device communication server 4 transmits data to the client device 1, the DNS content server 2 </ b> A deletes content information corresponding to the transmitted data from the content information holding unit 21. Therefore, the client device 1 can recognize that communication with the device communication server 4 is unnecessary because there is no response of the IP address corresponding to the subsequent inquiry.

  Here, it is desirable to set the time length of the cache holding period T2 to be equal to or shorter than the time length of the content holding period.

  Next, the negative cache in the polling communication of this system will be described using the communication sequence of FIG.

  First, the client device 1 generates an inquiry using the FQDN “12345-00001.example.jp” including the device ID of its own terminal (S21), and makes this inquiry to the DNS cache server 2B (S22). In this case, since there is no cache information associated with the device ID of the inquiring client device 1 in the cache information holding unit 22 of the DNS cache server 2B (S23), the DNS cache server 2B sends the information to the DNS content server 2A. A similar inquiry is made (S24). This inquiry cycle T11 is performed at regular intervals (for example, every 10 seconds).

  Content information associated with the device ID of the inquiry-source client device 1 is not stored in the content information holding unit 21 of the DNS content server 2A (S25). Therefore, the DNS content server 2A notifies the DNS cache server 2B that there is no content information (S26). The DNS cache server 2B notified of the absence of the content information causes the cache information holding unit 22 to correspond to the FQDN used for the inquiry by the client device 1 in the cache holding period T12 in the negative cache (negative cache period T12). Is set (S27). Further, the DNS cache server 2B notifies the client device 1 that there is no content information (S28), and the client device 1 recognizes that there is no content information corresponding to the inquiry, and accesses the device communication server 4. Not performed (S29).

  Then, the client device 1 again generates a query using the FQDN “12345-00001.example.jp” including the device ID of its own terminal (S30), and makes this query to the DNS cache server 2B again (S31). ). In this case, a negative cache period T12 is set in the cache information holding unit 22 of the DNS cache server 2B corresponding to the FQDN used for the inquiry (S32). Then, the DNS cache server 2B notifies the client device 1 that there is no content information in response to the inquiry again within the negative cache period T12 (S33). The client device 1 recognizes that there is no content information corresponding to the inquiry, and does not access the device communication server 4 (S34).

  As described above, the client device 1 can know whether or not the data to the own terminal exists in the device communication server 4 by using the inquiry to the DNS server 2. The client device 1 accesses the device communication server 4 when the device communication server 4 has data for the own terminal. When the device communication server 4 has no data for the own terminal, the client device 1 The server 4 is not accessed. Further, the client device 1 does not access the device communication server 4 even during the negative cache period.

  Therefore, in this system, since communication for name resolution by DNS can also serve as a polling function, communication costs for polling communication can be reduced without performing unnecessary communication in a DNS environment. .

  When the client device 1 acquires the IP address of the device communication server 4 from the DNS server 2 and accesses the acquired IP address, the attacker may craft the cache information and connect to a different server. is there. Therefore, the information returned in response to the inquiry from the client device 1 indicates only that connection to the device communication server 4 is necessary, and the client device 1 retains the device communication server 4 held in advance in its own terminal. It may be configured to access the IP address.

  Instead of the NAT router 3, a network device having a firewall function may be provided.

(Embodiment 2)
The communication system of the present embodiment has a configuration in which the time length of the cache holding period of the DNS cache server 2B can be changed by an instruction from the outside. In addition, the same code | symbol is attached | subjected to the structure similar to Embodiment 1, and description is abbreviate | omitted.

  In general, the service provider manages the content retention period in the DNS content server 2A and the cache retention period in the DNS cache server 2B. When the cache retention period is longer than the content retention period, the client device 1 may make a useless inquiry based on the cache information even though the content retention period has passed and the content information has been deleted. Therefore, it is desirable to set the time length of the cache retention period to be equal to or less than the time length of the content retention period.

  However, there is a case where a router device (for example, NAT router 3) installed in the customer's home has the function of the DNS cache server 2B. The DNS cache server 2B composed of router devices may have a lower limit on the time length of the cache retention period. Due to this lower limit of the cache retention period, when the service provider sets a short content retention period, there is a possibility that the time length of the cache retention period cannot be set equal to or less than the time length of the content retention period. Therefore, when the time length of the cache holding period is longer than the time length of the content holding period, the client device 1 according to the present embodiment does not make a query to the DNS cache server 2B but directly makes a query to the DNS content server 2A.

  Specifically, the client device 1 transmits a signal indicating the activation to the device communication server 4 when the own terminal is activated. The device communication server 4 registers the content information set in the short content holding period in the DNS content server 2A. This is because the DNS cache server 2B used by the client device 1 sets a lower limit constraint on the cache retention period and detects whether the time length of the cache retention period is longer than the time length of the content retention period. is there.

  Then, the service provider instructs the DNS cache server 2B to set a cache retention time shorter than the content retention period of the DNS content server 2A.

  Next, the client device 1 acquires an IP address and accesses the device communication server 4 in response to an inquiry at regular intervals. Then, when the content holding period has passed and the content information has been deleted from the DNS content server 2A, the device communication server 4 determines that the cache holding period is long if there is an access based on the content information from the client device 1. Is determined to be affected by the lower bound constraint. In other words, the time length of the cache retention period is set to be equal to or less than the time length of the content retention period. Longer than the period.

  Therefore, when the device communication server 4 determines that the cache retention period is affected by the lower limit constraint, the device communication server 4 stops querying the DNS cache server 2B from the client device 1 and directly queries the DNS content server 2A. Instruct to do.

  Therefore, when the cache retention period of the DNS cache server 2B is affected by the lower limit constraint, the client device 1 performs polling without being affected by the DNS cache server 2B by directly inquiring the DNS content server 2A. Can do.

(Embodiment 3)
The communication system according to the present embodiment performs communication using an encryption key. The same components as those in the first embodiment are denoted by the same reference numerals, and description thereof is omitted.

  As shown in FIG. 10, the device information table 13 of the client device 1 according to the present embodiment includes a device ID assigned to the client device 1 in advance, an encryption key acquired by the client device 1 from the device communication server 4, and Is stored. This encryption key has a valid period, and the client device 1 also holds the valid period information of the encryption key.

  This encryption key is a random value, set to a different value for each client device 1 by the device communication server 4, and the device communication server 4 notifies the client device 1 of the encryption key, whereby the device information table. An encryption key is stored in 13.

  Then, the FQDN used by the client device 1 for the inquiry to the DNS server 2 is a result of hashing a character string (data string) composed of the device ID and encryption key of the client device 1 and the validity period of the encryption key. Becomes the host name.

  Further, the device information table 42 of the device communication server 4 stores a device ID and an encryption key for each client device 1 as shown in FIG. This encryption key is set with a validity period, and the device communication server 4 also holds the validity period information of the encryption key.

  If the device communication server 4 wants to transmit data to the client device 1 assigned the device ID “12345-00001”, the device communication server 4 transmits a communication request to the DNS content server 2A. This communication request is generated including the FQDN of the device communication server 4, the IP address that is the access destination of the client device 1, and each data of the content holding period. The FQDN included in the communication request is obtained by using the same hash function as that of the client device 1 to convert the device ID and encryption key of the data transmission destination client device 1 and a character string (data sequence) composed of the validity period of the encryption key. The hashed result is the host name.

  For example, it is assumed that the device ID “12345-00001”, the encryption key “akjasdkje”, the validity period of the encryption key “March 14, 2011, 18:30:10 to 19 seconds” and the hash function sha are used. In this case, the host name of the FQDN is obtained by sha (1234500001akjasdkje2011103418301) = “b7543dfe53e1043a481367cfac581a7a88a2a79c”. Therefore, the FQDN is “b7543dfe53e1043a481367cfac581a7a88a2a79c.example.jp”.

  The device communication server 4 updates the encryption key for each inquiry cycle of the client device 1, and the client device 1 obtains an encryption key that is different for each inquiry cycle from the device communication server 4. Therefore, it becomes difficult for the encryption key to leak, and it becomes difficult for the attacker to guess the FQDN used by the client device 1 for the next inquiry. That is, it becomes difficult for an attacker to eavesdrop on polling communication and notify the client device 1 of a fake IP address.

(Embodiment 4)
In the first to third embodiments, when the FQDN associated with its own terminal is stored in the content information of the DNS content server 2A, the client device 1 acquires the IP address from the DNS content server 2A, and the device communication server 4 Communicate with. However, there is a possibility that communication between the client device 1 and the device communication server 4 becomes impossible if the update of the FQDN of the content information is not correctly reflected due to a failure in the DNS content server 2A.

  Therefore, in the present embodiment, the cache holding time of the DNS cache server 2B is made shorter than the inquiry cycle of the client terminal 1. That is, the DNS cache server 2B updates the cache information at a cycle shorter than the inquiry cycle of the client device 1. That is, the timing at which the cache information becomes invalid can be advanced.

  The client terminal 1 of this embodiment holds an IP address for accessing the device communication server 4 in advance. Therefore, the client terminal 1 can directly transmit an inquiry signal to the device communication server 4 when the FQDN associated with the self terminal is not stored in the content information of the DNS content server 2A. Thus, when a failure occurs in the DNS server 2, the client terminal 1 can directly connect to the device communication server to construct a system that is resistant to the failure.

  Other configurations are the same as those in the first to third embodiments, and a description thereof will be omitted.

1 Client Device 2 DNS Server 2A DNS Content Server 2B DNS Cache Server 3 NAT Router 4 Device Communication Server NT1 Home Network NT2 External Network

Claims (5)

A device communication server, a DNS server, and the device communication server and a client device connected to the DNS server via a network;
The device communication server transmits a communication request with the specific client device to the DNS server,
The DNS server that has received the communication request stores access information for accessing the device communication server in association with the specific client device,
The client device transmits an inquiry signal including identification information for identifying the own terminal,
When the DNS server that has received the inquiry signal stores the access information associated with the client device corresponding to the specific information included in the inquiry signal, the DNS server that is the transmission source of the inquiry signal Sending the access information to the device,
The client device accesses the device communication server based on the access information. The DNS server receives the communication request, associates the access information with the specific client device, and stores the access information acquired by the client device in association with a DNS content server that stores the content for a content holding period. A DNS cache server that stores the access information in association with the client device that acquired the access information for a cache retention period,
The client device is
When the time length of the cache holding period is shorter than the time length of the content holding period, the inquiry signal is transmitted to the DNS cache server, and the DNS cache server sends the inquiry signal to the client device that is the transmission source of the inquiry signal. If the associated access information is not stored, send the inquiry signal to the DNS content server;
The communication system according to claim 1, wherein when the time length of the cache holding period is longer than the time length of the content holding period, the client device transmits the inquiry signal to the DNS content server.   The communication system according to claim 1, wherein the client device generates the specific information with a different data sequence every time the inquiry signal is transmitted.   The client device generates the specific information by hashing a data string including at least a device ID assigned in advance to the own terminal and an encryption key acquired from the device communication server, and includes the specific information. The communication system according to claim 3, wherein a new encryption key is acquired from the device communication server after transmitting the inquiry signal. The DNS server acquires the access information by receiving the communication request, the DNS content server storing the access information in association with the specific client device, and the access information acquired by the client device. A DNS cache server that is stored in association with the client device for a cache retention period;
The cache retention period of the DNS cache server is shorter than a period in which the client device transmits the inquiry signal,
The client device transmits the inquiry signal to the DNS cache server, and the DNS cache server does not store the access information associated with the client device that is the transmission source of the inquiry signal, Sending the inquiry signal to the DNS content server;
The client device, when not receiving the access information corresponding to the inquiry signal, accesses the device communication server based on the access information of the device communication server held in advance. The communication system according to any one of 1 to 4.

Images