JP2001313663A - Method and device for controlling exclusive logical network access - Google Patents

Abstract

PROBLEM TO BE SOLVED: To provide a method and a device by which control per logical network unit is performed and a plurality of VPN/VLAN technique are integrally used. SOLUTION: A virtual network interface for making a logical network abstract is provided. Consistency among physical network interface, a virtual network interface and the logical network is determined, and only a packet is transmitted received which corresponds to the physical network interface and the virtual network interface. Then the packet is controlled which is exchanged between the virtual network interface and the physical network interface.

Description

DETAILED DESCRIPTION OF THE INVENTION

[0001]

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to a method and apparatus for enabling exclusive control of a plurality of logical networks using a relay node in a network relay node accommodating a plurality of logical networks. It is.

[0002]

2. Description of the Related Art FIG. 1 shows a configuration example of a communication network. In this process, access to one network used by a specific majority from unspecified others is restricted, and information is shared within a group consisting of the specific majority while preventing information leakage to third parties Has become an important requirement when using networks. There are the following two main technologies that satisfy such requirements.

[0003] The first is a filtering technique for passing only specific information and prohibiting the passage of other information. For example, there is the following. -Selection by referring to network level information such as a source address and a destination address included in the packet header.・ Harmful W
A device that selects information by referring to an application-level identifier, such as selecting by URL to prohibit access to a WW page. -A device that selects information by referring to the information itself, such as a virus check in an e-mail server.

[0004] In the second method, a specific identifier is given to specific information flowing over the physical line used by the logical network by an unspecified number of persons or encrypted by a specific key. This is a technique for exclusively using specific information between a plurality of logical networks on the same physical line. For example, there is the following.

In an ATM (asynchronous transfer mode), a VPI / VCI value is added to a header of each cell (unit of information), and a VC (logical channel) is separated at an ATM cell level. The relay node of the ATM cell controls the path of the cell for each VC to prevent leakage of information to an unrelated logical line.
Thus, if the setting of the relay node cannot be changed, the third party cannot see the information.・ IEEE
In a tagged VLAN in the E802.1Q VLAN (virtual LAN), a VLAN tag value is added to an Ethernet frame to separate a logical channel at an Ethernet (registered trademark) frame level, thereby preventing information leakage.・ IETF
In MPLS (multi-protocol label switching) standardized in the above, a label is given to a part of an IP packet, a logical channel is separated at an IP level, and information leakage is prevented. In IPSEC (IP Security Protocol), an IP packet is encrypted by ESP (In-Capsulating Rating Security Payload). Therefore, even if a packet is leaked, a host having no shared key cannot be decrypted, so that information leak can be prevented. That is, a logical channel is substantially established between the hosts holding the shared key.

The above 1 and 2 are complementary to each other,
A service combining these can be considered. For example, AT
A logical network is assigned to each VC of M, and packet filtering used in a firewall is applied to packets from each logical network. By combining the access control provided by the first technique, a service with higher security can be provided.

In the case of providing such a service, in particular, from the viewpoint of operation cost, a filtering technique that matches each management policy is applied to a plurality of logical networks having different management policies on one relay node. It is desired to provide a service by using. However, when such a service is performed on an existing operating system, the access authority of a user cannot be set for each logical network, but is set for a physical network. Furthermore, there is no method for uniformly handling various VPN (Virtual Closed Network) / VLAN technologies, and each VPN / VLAN technology has to be individually dealt with.

[0008]

SUMMARY OF THE INVENTION In view of the above problems, an object of the present invention is to provide a method for realizing control on a logical network basis and enabling a uniform handling of a plurality of VPN / VLAN technologies. It is to provide a device.

[0009]

An exclusive logical network access control method according to the present invention comprises the steps of providing a virtual network interface for abstracting a logical network, and determining a correspondence between a physical network interface, a virtual network interface, and a logical network. And transmitting and receiving only packets associated with the physical network interface and the virtual network interface, and controlling packets exchanged between the virtual network interface and the physical network interface. I do.

Further, the exclusive logical network access control device of the present invention provides means for providing a virtual network interface for abstracting a logical network, means for determining correspondence between a physical network interface, a virtual network interface and a logical network, It comprises means for transmitting and receiving only packets associated with the network interface and the virtual network interface, and means for controlling packets exchanged between the virtual network interface and the physical network interface.

In the present invention, the network relay node has a plurality of physical network interfaces and is connected to a plurality of networks by using them. Within the relay node, logical channels (for example, VC, IP in the case of ATM,
In the case of SEC, a virtual communication channel such as SA) is provided, and a set of these logical channels constitutes a logical network. A logical network is a physical network interface or V on a relay node.
It is identified by the identifier of the logical channel that depends on the PN / VLAN technology.

Next, a virtual network interface layer is provided in the relay node to abstract a logical network, that is, a set of logical channels. One virtual network interface is provided for one logical network. One unique identifier within the same physical network interface is assigned to one logical channel information, and the physical network interface holds mapping information between the logical channel information and the identifier. The virtual network interface holds mapping information of the virtual network, the physical network interface, and the identifier of the logical channel of the physical network interface.

When configuring a logical network, a corresponding virtual network interface is created and various mapping information is set. The virtual network interface sends and receives only the packets of the corresponding logical network from the physical network interface,
The access control to the virtual network interface is performed only for the received packet. Therefore, by controlling this virtual interface, it is possible to control the logical network, and furthermore, it is possible to uniformly handle the logical channels in the physical interface mapped to the virtual interface.

[0014]

Next, embodiments of the present invention will be described.
FIG. 2 is a diagram showing a configuration example of system software according to the present invention. As a component of the system software 100, a physical network interface realizing the function of each network interface, VPN / VLAN
A virtual network interface that abstracts the implementation (logical network), a mapping table 10 that defines a connection between a physical network interface, a virtual network interface, and a VP value, and an access control processing unit 11 that performs access control. The physical network interface and the virtual network interface include a CPU and a memory (not shown), the mapping table 10 includes a memory and the like (not shown), and the access control processing unit 11 includes a CPU (not shown).
And so on.

The RNI internally has a correspondence table between identifier VP values unique within each physical network interface and identifiers defined by the VPN / VLAN technology used. The mapping table 10 holds the correspondence between physical network interfaces, virtual network interfaces, and VP values. That is, the system software 100 is an exclusive logical network access control device.

FIG. 3 is a flowchart showing the operation of the above embodiment. First, a logical channel and a VP value are set for the physical network interfaces RNI1 and RNI2 for each logical network to be used (step S11). Next, virtual network interfaces are created for the logical networks to be used (step S12), and the physical network interface, the virtual network interface, and the V
A P value is set (step S13). Further, an access control rule to be performed on the virtual network interface is set in the access control processing unit 11 (step S14).

When the physical network interface RNI1 or RNI2 receives the packet (step S15), the system software 100 issues a mapping table.
The packet is passed to the appropriate virtual network interface VNI1, VNI2 or VNI3 according to the information of Step 10 (Step S16). In the virtual network interfaces VNI1, VNI2, and VNI3, the access control processing unit 11 processes the packet received from the physical network interface RNI1 or RNI2 based on the access control rule specified for each virtual network interface ( Step S
17). Then, the virtual network interface VN
I1, VNI2, and VNI3 pass the packets received from the physical network interfaces RNI1 and RNI2 to the appropriate physical network interface RNI1 or RNI2 based on the information in the mapping table 10 according to the result of the access control (step S1).
8). After ending these series of processes, the system software 100 can perform normal processes (step S19).

FIG. 4 is a time chart of the processing of the above embodiment. In the system software 100, a logical channel and a VP value are set for the physical network interfaces RNI1 and RNI2. Next, a virtual network interface is created, associated with the virtual network interface based on the already set logical channel and VP value information, and written into the mapping table 10.

An access control rule for each logical network and a corresponding virtual network interface name are set in the access control processing unit 11. After receiving the packet, the physical network interfaces RNI1 and RNI2 refer to the mapping table 10 and pass the received packet to the appropriate virtual network interface VNI1, VNI2 or VNI3.
The access control processing unit 11 performs access control on the packets held by the virtual network interfaces VNI1, VNI2, and VNI3 based on the already set access control rules.

After the access control processing is completed, the packet to be transmitted is sent to the virtual network interface VNI.
1, passed from VNI2 and VNI3 to physical network interfaces RNI1 and RNI2. The physical network interfaces RNI1 and RNI2 transfer packets received from the virtual network interfaces VNI1, VNI2 and VNI3 onto the network.

[0021]

As described above, according to the present invention, in a network relay node accommodating a plurality of logical networks, exclusive control can be performed on a plurality of logical networks using the relay nodes. .

[Brief description of the drawings]

FIG. 1 is a diagram illustrating a configuration example of a communication network.

FIG. 2 is a diagram showing a configuration example of system software according to the present invention.

FIG. 3 is a flowchart showing the operation of the embodiment of the present invention.

FIG. 4 is a time chart of a process according to the embodiment of the present invention.

[Explanation of symbols]

 10 Mapping Table 11 Access Control Processing Unit 100 System Software RNI Physical Network Interface VNI Virtual Network Interface

Claims (2)

[Claims] 1. An exclusive logical network access control method in a network relay node, wherein a step of providing a virtual network interface that abstracts a logical network, a step of determining correspondence between a physical network interface, a virtual network interface, and a logical network, An exclusive communication method comprising the steps of: transmitting and receiving only packets associated with a physical network interface and a virtual network interface; and controlling packets exchanged between the virtual network interface and the physical network interface. Logical network access control method. 2. An exclusive logical network access control device in a network relay node, means for providing a virtual network interface for abstracting a logical network, means for determining correspondence between a physical network interface, a virtual network interface and a logical network, Exclusive features including means for transmitting and receiving only packets associated with the physical network interface and the virtual network interface, and means for controlling packets exchanged between the virtual network interface and the physical network interface. Logical network access control device.