Secure virtual private network

• US 20050169288A1
• Filed: 03/31/2005
• Published: 08/04/2005
• Est. Priority Date: 05/22/2003
• Status: Active Grant

• Current Assignee: Fujitsu Limited
• Original Assignee: Fujitsu Limited
• Inventors: Sonoda, Toshihiro, Kamiwada, Toru, Kawai, Jun
• Granted Patent: US 7,856,023 B2
• Time in Patent Office: Days
• US Class Current: 370/401
• CPC Class Codes: H04L 61/00 Network arrangements, protocols or services for addressing or naming
• CPC Class Codes: H04L 61/2514 between local and global IP addresses
• CPC Class Codes: H04L 63/0272 Virtual private networks
• CPC Class Codes: H04L 63/0838 using one-time-passwords

Abstract

A gateway apparatus (100) is capable of connecting to an internal network (10) and an external network (50), and includes an information management unit (120) for managing a global IP address of the gateway apparatus and identification information for a device to be permitted to connect to the internal network. The information management unit transmits the global IP address and the identification information over the external network to an external apparatus. In response to a request received over the external network, the information management unit transmits a one-time password over the external network to the external apparatus. The gateway apparatus further includes: a connector unit (130) permitting the device to connect to the internal network, when it receives a URI containing the global IP address and the one-time password from the device to be permitted to connect over the external network; and an address converter unit (140) for converting between an IP address for the external network into an IP address for the internal network and converting an IP address for the internal network into an IP address for the external network.

Claims

1. A gateway apparatus capable of connecting to an internal network and an external network, comprising

an information management unit for managing a global IP address of said gateway apparatus and identification information for a device to be permitted to connect to said internal network,

said information management unit transmitting said global IP address and said identification information over said external network to an external apparatus,

said information management unit, in response to a request received over said external network, transmitting a one-time password over said external network to said external apparatus,

said gateway apparatus further comprising:

a connector unit permitting said device to connect to said internal network, when it receives a URI containing said global IP address and said one-time password from said device to be permitted to connect over said external network; and

an address converter unit for converting between an IP address for said external network into an IP address for the said internal network and converting an IP address for said internal network into an IP address for the said external network.

2. A gateway apparatus according to claim 1, wherein

said global IP address of said gateway apparatus is dynamically assigned by an Internet service provider, and

said external apparatus is an authentication server for authenticating said device to be permitted to connect, wherein a fixed global IP address is assigned to said authentication server.

3. A gateway apparatus according to claim 1, wherein said connector unit transmits a search message over said internal network to a plurality of devices configured to said internal network, then receives response messages from ones of said devices that are adapted to form a virtual private network, and transmits information representative of a list of said devices adapted to form a virtual private network to said device having transmitted said URI.

4. A gateway apparatus according to claim 2, wherein said connector unit transmits a search message over said internal network to a plurality of devices configured to said internal network, then receives response messages from ones of said devices that are adapted to form a virtual private network, and transmits information representative of a list of said devices adapted to form a virtual private network to said device having transmitted said URI.

5. A gateway apparatus according to claim 1, wherein said address converter unit extracts packets transferred only between said device permitted to connect by said connector unit and a device configured to said internal network, and converts the IP addresses of said packets.

6. A gateway apparatus according to claim 2, wherein said address converter unit extracts packets transferred only between said device permitted to connect by said connector unit and a device configured to said internal network, and converts the IP addresses of said packets.

7. A gateway apparatus according to claim 3, wherein said address converter unit extracts packets transferred only between said device permitted to connect by said connector unit and a device configured to said internal network, and converts the IP addresses of said packets.

8. A gateway apparatus according to claim 1, wherein when the transfer of a packet does not occur for a predetermined period of time between said device permitted to connect by said connector unit and a device configured to said internal network, said connector unit releases the connection between said device permitted to connect by said connector unit and said internal network.

9. A gateway apparatus according to claim 2, wherein when the transfer of a packet does not occur for a predetermined period of time between said device permitted to connect by said connector unit and a device configured to said internal network, said connector unit releases the connection between said device permitted to connect by said connector unit and said internal network.

10. A gateway apparatus according to claim 3, wherein when the transfer of a packet does not occur for a predetermined period of time between said device permitted to connect by said connector unit and a device configured to said internal network, said connector unit releases the connection between said device permitted to connect by said connector unit and said internal network.

11. A gateway apparatus according to claim 5, wherein when the transfer of a packet does not occur for a predetermined period of time between said device permitted to connect by said connector unit and a device configured to said internal network, said connector unit releases the connection between said device permitted to connect by said connector unit and said internal network.

12. A gateway apparatus according to claim 1, wherein after the connection between said device having transmitted said URI and a device configured to said internal network is released, said address converter unit releases the conversion of IP addresses of packets transferred between said device having transmitted said URI and said device configured to said internal network.

13. A gateway apparatus according to claim 2, wherein after the connection between said device having transmitted said URI and a device configured to said internal network is released, said address converter unit releases the conversion of IP addresses of packets transferred between said device having transmitted said URI and said device configured to said internal network.

14. A gateway apparatus according to claim 3, wherein after the connection between said device having transmitted said URI and a device configured to said internal network is released, said address converter unit releases the conversion of IP addresses of packets transferred between said device having transmitted said URI and said device configured to said internal network.

15. A gateway apparatus according to claim 5, wherein after the connection between said device having transmitted said URI and a device configured to said internal network is released, said address converter unit releases the conversion of IP addresses of packets transferred between said device having transmitted said URI and said device configured to said internal network.

16. A gateway apparatus according to claim 8, wherein after the connection between said device having transmitted said URI and a device configured to said internal network is released, said address converter unit releases the conversion of IP addresses of packets transferred between said device having transmitted said URI and said device configured to said internal network.

17. A program for a gateway apparatus capable of connecting to an internal network and an external network, said program being operable to effect the steps of:

transmitting, over said external network to an external apparatus, a global IP address of said gateway apparatus and identification information for a device to be permitted to connect to said internal network;

transmitting a one-time password over said external network to said external apparatus in response to a request received over said external network;

permitting said device to connect to said internal network, when a URI containing said global IP address and said one-time password is received from said device to be permitted to connect over said external network; and

converting between an IP address for said external network into an IP address for the said internal network and converting an IP address for said internal network into an IP address for the said external network.

18. In a gateway apparatus capable of connecting to an internal network and an external network, a method comprising the steps of:

transmitting, over said external network to an external apparatus, a global IP address of said gateway apparatus and identification information for a device to be permitted to connect to said internal network;

transmitting a one-time password over said external network to said external apparatus in response to a request received over said external network;

permitting said device to connect to said internal network, when a URI containing said global IP address and said one-time password is received from said device to be permitted to connect over said external network; and

converting between an IP address for said external network into an IP address for the said internal network and converting an IP address for said internal network into an IP address for the said external network.