VPN CONNECTION SYSTEM AND VPN CONNECTION METHOD

• US 20110060902A1
• Filed: 03/01/2010
• Published: 03/10/2011
• Est. Priority Date: 03/02/2009
• Status: Active Grant

• Current Assignee: NEC Corporation
• Original Assignee: NEC Corporation
• Inventors: NAGATA, ATSUSHI
• Granted Patent: US 8,769,262 B2
• Time in Patent Office: Days
• US Class Current: 713/155
• CPC Class Codes: H04L 12/4641 Virtual LANs, VLANs, e.g. virtual private networks [VPN] LAN interconnection over a bridge based backbone H04L12/462; encapsulation techniques H04L12/4633; routing of packets H04L45/00; packet switches H04L49/00; virtual private networks for security H04L63/0272
• CPC Class Codes: H04L 63/0272 Virtual private networks
• CPC Class Codes: H04L 63/0281 Proxies
• CPC Class Codes: H04L 63/068 using time-dependent keys, e.g. periodically changing keys cryptographic mechanisms or cryptographic arrangements for controlling usage of secret information H04L9/088
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/0884 by delegation of authentication, e.g. a proxy authenticates an entity to be authenticated on behalf of this entity vis-à-vis an authentication entity

Abstract

For establishing a VPN connection in the call-back type, a VPN server establishes an always-on connection through a unique protocol different from the electronic mail delivery system. A client generates a client authentication data used for the client authentication implemented by the VPN server, and establishes the relay server through the unique protocol to transmit the client authentication data. The relay server device relays the client authentication data to the VPN server through the unique protocol. The VPN server implements the client authentication based on the relayed data. The VPN server establishes the VPN connection with the client based on the result of the authentication.

Claims

1. A VPN connection system comprising:

a client device configured to generate a client authentication data in response to a VPN (Virtual Private Network) connection request;

a relay server device configured to relay a communication through a protocol which is different from an electronic mail; and

a VPN server device configured to establish an always-on connection with the relay server device through the protocol,

wherein the client device is configured to establish a connection with the relay server through the protocol to transmit the client authentication data to the relay server,

the relay server device is configured to relay the transmitted client authentication data to the VPN server device, and

the VPN server device is configured to perform an authentication of the client device based on the client authentication data, and to report a failure of a VPN connection to the client device when the authentication is failed, and to implement a VPN connection with the client device when the authentication is succeeded.

2. The VPN connection system according to claim 1, wherein the client device comprises:

a first user information accumulation part configured to store user information being used for generating the client authentication data;

an authentication data generation part configured to generate the client authentication data in response to the VPN connection request by referring the user information;

a first relay information accumulation part configured to store address information indicating an address of the relay server device and device identification information specifying the VPN server device;

an authentication key transfer part configured to establish a connection to the relay server device through the protocol by referring to the address information, and to request a connection to the VPN server device by transmitting the device identification information to the relay server device; and

a first connection reception part configured to implement a VPN connection with the VPN server device.

3. The VPN connection system according to claim 2, wherein the relay server device comprises:

a second relay information accumulation part configured to store status information indicating whether an authentication data relay function is turned on or turned off and connection authentication information specifying the relay server device;

an authentication key transfer part configured to request a VPN server device side connection authentication information to the VPN server device when the authentication data relay function is turned on and the device identification information is transmitted from the client device, and to establish an always-on connection with the relay server device and the VPN server device through the protocol when the connection authentication information stored in the second relay information accumulation part and the VPN server device side connection authentication information is matched.

4. The VPN connection system according to claim 3, wherein the authentication key transfer part is configured to store a data table in which the device identification information and connection information indicating the established always-on connection are related to each other in the second relay information accumulation part when the always-on connection is established, and

the relay server device further comprises:

a destination device authentication part configured to acquire device identification information from the authentication key transfer part, to perform matching between the acquired device identification information and the device identification information stored in the data table, to retrieve the connection information corresponding to the acquired device identification information from the data table when a result of the matching is matched, and to request a data transmission through the always-on connection based on the acquired connection information to the authentication key transfer part, and

the authentication transfer part is configured to transmit the client authentication data to the VPN server device through the always-on connection based on the acquired connection information.

5. The VPN connection system according to claim 4, wherein the second relay information accumulation part stores search performance information which defines an interval and the number of times of the matching, and

the destination device authentication part is configured to repeat the matching by the interval and the number of times defined by the search performance information when the acquired device authentication information is not found in the data table, and to determine the VPN connection request as bad when all results of the repeated matching is unmatched.

6. The VPN connection system according to claim 4, wherein the VPN server device comprises:

a third relay information accumulation part configured to store address information indicating an address of the relay server device, connection authentication information used for a communication with the relay server device, and device identification information specifying the VPN server device, and

an authentication key reception part configured to request a connection to the relay server device based on the address information stored in the third relay information accumulation part, to transmit the connection authentication information stored in the third relay information accumulation part to the relay server device when a request of the connection authentication information is received from the relay server device, to transmit the device identification information to the relay server device when the always-on connection with the relay server device is established, and to acquire the client authentication data from the relay server device.

7. The VPN connection system according to claim 6, wherein the VPN server device further comprises:

a second user information accumulation part configured to store user information being an object of a connection authentication;

a client authentication part configured to acquire the client authentication data from the authentication key reception part, to perform an authentication based on the client authentication data by referring the user information stored in the second user information accumulation part, and to register information indicating that a VPN connection with the client device is allowed to the second user information accumulation part when the authentication based on the client authentication data is succeeded; and

a second connection reception part configured to implement a VPN connection with the client device when the information indicating that a VPN connection with the client device is allowed is registered in the second user information accumulation part.

8. The client device used for the VPN connection system according to claim 1.

9. The relay server device used for the VPN connection system according to claim 1.

10. The VPN server device used for the VPN connection system according to claim 1.

11. A VPN connection method comprising:

a VPN (Virtual Private Network) server device establishing an always-on connection with the relay server device through the protocol;

a client device generating a client authentication data in response to a VPN connection request;

a client server establishing a connection with the relay server through the protocol to transmit the client authentication data to the relay server by the client server;

the relay server relaying the transmitted client authentication data to the VPN server device;

the VPN server device performing an authentication of the client device based on the client authentication data;

the VPN server reporting a failure of a VPN connection to the client device when the authentication is failed; and

the VPN server implementing a VPN connection with the client device when the authentication is succeeded.

12. The VPN connection method according to claim 11, further comprising:

the client device storing user information being used for generating the client authentication data in a first user information accumulation part;

the client device generating the client authentication data in response to the VPN connection request by referring the user information;

the client device storing address information indicating an address of the relay server device and device identification information specifying the VPN server device in a first relay information accumulation part;

the client device establishing a connection to the relay server device through the protocol by referring to the address information in an authentication key transfer part included in the relay server device to request a connection to the VPN server device by transmitting the device identification information to the relay server device; and

the client device implementing a VPN connection with the VPN server device.

13. The VPN connection method according to claim 12, further comprising:

the relay server storing status information indicating whether an authentication data relay function is turned on or turned off and connection authentication information specifying the relay server device in a second relay information accumulation'"'"'part;

the relay server requesting a VPN server device side connection authentication information to the VPN server device when the authentication data relay function is turned on and the device identification information is transmitted from the client device; and

the relay server establishing an always-on connection with the relay server device and the VPN server device through the protocol when the connection authentication information stored in the second relay information accumulation part and the VPN server device side connection authentication information is matched.

14. The VPN connection method according to claim 13, further comprising:

the relay server device storing a data table in which the device identification information and connection information indicating the established always-on connection are related to each other in the second relay information accumulation part when the always-on connection is established;

the relay server device acquiring the device identification information from the authentication key transfer part;

the relay server device performing matching between the acquired device identification information and the device identification information stored in the data table;

the relay server device retrieving the connection information corresponding to the acquired device identification information from the data table when a result of the matching is matched, and to request a data transmission through the always-on connection based on the acquired connection information to the authentication key transfer part; and

the relay server device transmitting the client authentication data to the VPN server device through the always-on connection based on the acquired connection information.

15. The VPN connection method according to claim 14, further comprising:

the relay server device storing search performance information which defines an interval and the number of times of the matching;

the relay server device repeating the matching by the interval and the number of times defined by the search performance information when the acquired device authentication information is not found in the data table; and

determining the VPN connection request as bad when all results of the repeated matching is unmatched.

16. The VPN connection method according to claim 14, further comprising:

the VPN server device storing address information indicating an address of the relay server device, connection authentication information used for a communication with the relay server device, and device identification information specifying the VPN server device;

the VPN server device requesting a connection to the relay server device based on the address information stored in the third relay information accumulation part;

the VPN server device transmitting the connection authentication information stored in the third relay information accumulation part to the relay server device when a request of the connection authentication information is received from the relay server device;

the VPN server device transmitting the device identification information to the relay server device when the always-on connection with the relay server device is established; and

the VPN server device acquiring the client authentication data from the relay server device by an authentication key reception part included in the VPN server.

17. The VPN connection method according to claim 16, further comprising:

the VPN server device storing user information being an object of a connection authentication in a second user information accumulation part;

the VPN server device acquiring the client authentication data from the authentication key reception part;

the VPN server device performing an authentication based on the client authentication data by referring the user information stored in the second user information accumulation part;

the VPN server device registering information indicating that a VPN connection with the client device is allowed to the second user information accumulation part when the authentication based on the client authentication data is succeeded; and

the VPN server device implementing a VPN connection with the client device when the information indicating that a VPN connection with the client device is allowed is registered in the second user information accumulation part.

18. A computer program product embodied on a computer-readable medium and comprising code that, when executed, causes a computer to perform the VPN connection method according to claim 11 and performed by the client device.

19. A computer program product embodied on a computer-readable medium and comprising code that, when executed, causes a computer to perform VPN connection method according to claim 11 and performed by the relay server device.

20. A computer program product embodied on a computer-readable medium and comprising code that, when executed, causes a computer to perform VPN connection method according to claim 11 and performed by the VPN server device.