JP2003134153A - Intra-ip-vpn access control system and method - Google Patents

Abstract

PROBLEM TO BE SOLVED: To realize access control between subnetworks in a VPN (virtual private network) without reducing the number of VPNs to be housed in a gateway (GW). SOLUTION: An intra-IP-VPN access control system enables packet filtering even inside the same VPN by providing a subnetwork housing edge router and an edge router for access control. The edge router for access control has a means for attaching a VPN identifier for a return to a packet transmitted from an external network side I/F of a gateway device and received from an IP network side I/F and transmitting the packet to its own transfer network address, and a means for transmitting a packet received from a transfer network side I/F and with a VPN identifier for a return attached to the external network side I/F of the gateway device from the IP network side I/F.

Description

Detailed Description of the Invention

[0001]

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to an intra-IP-VPN access control system and method capable of packet filtering even within the same VPN.

[0002]

2. Description of the Related Art An IP-VPN service is based on a public IP network and is an environment (V
PN: Virtual Private Network
In k), it is a service that connects a plurality of sub-networks.

As shown in FIG. 1, the IP-VPN network is composed of an IP network which is a sub-network of customers who use the IP-VPN service, and a transfer network which connects the sub-networks. The transfer network and the IP network are connected by a network device called an edge router. The transfer network is
It consists of edge routers and forwarding routers that connect the edge routers.

An IP packet transmitted from an IP network is tunneled at an edge router connected to the IP network to which a source host belongs, and is directly transferred to an edge router corresponding to a destination or indirectly via a transfer router. It The transferred IP packet is untunneled at the transfer destination edge router and reaches the destination host. At the time of tunneling in the transfer network, an identifier for each VPN (hereinafter abbreviated as VPN identifier) is given. In the transfer network, the closed nature is secured by not transferring between IP networks having different VPN identifiers. MPLS (Multi) is a technology for realizing tunneling in a transport network.
(Protocol Label Switching)
And GMN-CL (Connectionless ne
forking technologies for
Global Mega-media Network
ks) and the like.

Since the edge router is connected to both the transfer network and the IP network, the transfer network side interface (hereinafter, I / F) is used.
And each IP network side I / F are physically provided. Physical I / F is one or more logical I / F
It may be used as / F. ATM (Asynchronous) is a technology for realizing a logical I / F.
VP (Vir) in Transfer Mode
true Path) / VC (Virtual Cha)
nnel) and the like. Hereinafter, I / F refers to a logical I / F unless otherwise specified.

[0006] Each transfer network side I / F of the edge router is assigned a transfer network address that can uniquely identify the I / F within the transfer network.

Each IP network side I / F of the edge router is connected to one VPN. The VPN identifier of the connected VPN is hereinafter referred to as a VPN identifier corresponding to the IP network side I / F.

When the edge router receives a packet from the transfer network side I / F, the edge router transmits it from the IP network side I / F,
When the packet is received from the P network side I / F, it is transmitted from the transfer network side I / F. The edge router has the following two types of routing functions. One is a routing function (routing function A) that determines to which transfer network address the packet received from the IP network side I / F is to be sent, and the other is which packet is received from the transfer network side I / F. I
This is a routing function (routing function B) for determining whether to transmit from the P network side I / F.

The routing table used for the determination of the routing function A can specify the transfer network address indicating the edge router or the transfer router to be transmitted, using the VPN identifier corresponding to the IP network side I / F and the destination IP address as keys. Have a structure. The routing table used for the judgment of the routing function B is the V added to the packet.
I that should be transmitted using the PN identifier and the destination IP address as keys
It has a structure that can specify the P network side I / F.

Since the transfer network does not transfer between IP networks having different VPN identifiers, inter-VPN communication cannot be performed. Therefore, the inter-VPN communication is realized via a gateway device (hereinafter, abbreviated as GW) arranged on the IP network side. The GW serves as a boundary between the VPN and the external network and generally has a packet filtering function and an address conversion function. Since the GW is connected to both the VPN IP network and the external network IP network, it has at least one VPN side I / F and at least one external network side I / F. Each I / F of the GW, both the VPN side I / F and the external network side I / F, are associated with one VPN. The VPN identifier of the associated VPN is hereinafter referred to as the VPN identifier corresponding to the I / F. The filtering rule used in the packet filtering function of GW is I /
A VPN identifier corresponding to F, a source / destination IP address, a source / destination port number, etc. are used as keys to determine whether or not a received packet can pass.

Communication between the VPN # 1 and the VPN # 2 is performed by first transferring the packet from the VPN # 1 to the external network via the GW, and then transferring the packet from the external network to the VPN # 2 via the GW. Will be realized. Access control in inter-VPN communication is performed by changing the filtering rule of the GW. At this time,
A plurality of VPNs that perform N-to-N communication must be connected to a network space and an external network having the same address system. In addition, the network space of the external network and the address system may be different between the VPNs that do not communicate with each other.
There is one external network connected to the GW, or
There will be multiple.

[0012]

The GW enables the communication between VPNs by controlling the access between the VPNs.
Access control cannot be performed between sub-networks inside N. Therefore, in the conventional technique, it is necessary to divide VPNs and allocate one sub-network to one VPN in order to perform access control between the sub-networks. Since the GW requires an I / F for each VPN, the conventional technology consumes a large amount of the finite physical I / F and logical I / F of the GW, and can be substantially accommodated by one GW device. There is a problem that the number of VPNs is greatly reduced.

An object of the present invention is to realize access control between sub-networks inside a VPN without reducing the number of VPNs that can be accommodated by one GW device, and to realize IP-VPN.
To provide more detailed access control functions for services.

[0014]

The present invention is an access control system in an IP-VPN, which has a sub-network accommodating edge router and an access control edge router to enable packet filtering even in the same VPN. The sub-network accommodating edge router controls the packet received from the IP network side I / F to the control target V.
It has a means for giving a PN identifier and transmitting it to the transfer network address assigned to the access control edge router,
The access control edge router transfers the packet to which the control target VPN identifier is received from the transfer network side I / F from the IP network side I / F to the VPN side I of the gateway device.
/ F, and a packet sent from the external network side I / F of the gateway device and received from the IP network side I / F, with a return VPN identifier,
A means for transmitting to its own transfer network address, and a transfer network side I /
And a means for transmitting the packet to which the return VPN identifier is received from F from the IP network side I / F to the external network side I / F of the gateway device. As a result, it is possible to enable packet filtering without sending to the external network, which is a problem in which filtering by the GW cannot be performed until now until the packet is sent to the external network outside the VPN.

[0015]

BEST MODE FOR CARRYING OUT THE INVENTION An embodiment of the present invention will be described below. FIG. 2 is a block diagram showing an IP-VPN internal access control device of the present invention. In FIG. 2, 200 and 30
0 is a sub-network (IP network), 20 and 30 are terminals in the sub-networks 200 and 300, 500 is a transfer network,
1000 is an edge router for access control, and 2000 and 3
000 is a sub-network accommodating edge router
Is a GW device, 1101, 1102, 2101 and 3101
Is the IP network side I / F of the edge router, 1201 and 2201
And 3201 are transfer network side I / Fs 1110 of the edge router.
And 2110 and 3110 are IP network routing tables of edge routers, 1210, 2210 and 3210 are forwarding network routing tables of edge routers, and 4101 is GW.
The device VPN side I / F, 4102 is an external network side I / F, and 4100 is a packet filtering rule.

The sub-network 200 and the sub-network 300 are the same VP whose VPN identifier is "# 1".
It is housed in N. Subnetwork accommodating edge router 2000, 3000 IP network side I / F 2101, 31
01, the IP network side I / F 1101 of the access control edge router 1000, the VPN side I / F 4101 of the GW apparatus, and the external network side I / F 4102 of the GW apparatus are “# 1”. The return VPN identifier used in the access control edge router 1000 is “#
0 ", and the VPN identifier corresponding to the IP network side I / F 1102 is"# 0 ". The subnetwork accommodating edge router and the access control edge router of the present invention access the conventional router as a subnetwork accommodating edge router and access. It can also be realized by making settings so that the control edge router can be used for two purposes.

In the present embodiment, "GW4000", "transfer router (transfer network 500 is composed of an edge router and a transfer router connecting the edge routers"),
“IP network side I / F 1101 and IP network side I / F 1102
Access edge router 1000 provided with transfer network side I / F 1201 "," IP network side I / F 2101,
3101 and the sub-network accommodating edge routers 2000 and 300 including the transfer network side I / Fs 2201 and 3201.
It consists of "0". The “GW” and the “forwarding router” have the same functions as those of the above-mentioned conventional technology.

The "IP network side I / F 1101" of the access control router 1000 uses the corresponding VPN identifier as a VPN.
As an identifier of a VPN for performing internal access control (hereinafter, abbreviated as a control target VPN identifier) (“# 1” in FIG. 2),
The corresponding VPN identifier of the GW 4000 (“#” in FIG. 2)
1 ″) is connected to the same VPN network side I / F 4101.

The "IP network side I / F 1102" of the access control router 1000 uses a corresponding VPN identifier as a virtually prepared identifier (hereinafter referred to as a return VPN identifier) ("# 0" in FIG. 2). , GW 4000 is connected to the external network side I / F 4102 corresponding to the identifier of the VPN to be controlled (“# 1” in FIG. 2).

The access control edge router 1000 is
In addition to the edge router of the prior art, "transfer network side I / F1
"Means for forcibly transmitting from the IP network side I / F 1101 a packet received from 201 and to which the control target VPN identifier is added" and "a packet received from the transfer network side I / F 1201 and having a return VPN identifier "A means for forcibly transmitting the assigned packet from the IP network side I / F 1102" and "a packet received from the IP network side I / F 1101 is given a control target VPN identifier and transferred in accordance with its destination. "Means for sending to network address" and "IP network side I
VPN for returning the packet received from the / F1102
Means for sending an identifier to the transfer network address of itself ".

Subnetwork accommodating routers 2000, 3
“IP network side I / F 2101, 3101” of 000 uses the corresponding VPN identifier as the control target VPN identifier (see FIG.
Then “# 1”), subnetwork 2 of the VPN to be controlled
00 and 300 are connected. The sub-network accommodating edge routers 2000 and 3000 add the control target VPN identifier to the packets received from the IP network side I / Fs 2101 and 3101 in addition to the edge routers of the prior art, and provide the access control edge router 1000 with the packets. Means for transmitting to the assigned transport network address ".

For example, from the sub-network 200, V
The packet transmitted to the other sub-network 300 in the PN is transmitted from the sub-network accommodating edge router 2000 to the access control edge router 1000, GW 4000.
The packet filtering process is performed by the GW 4000. The packet whose passage is prohibited by the GW 4000 is discarded at this point. The packet permitted to pass by the GW 4000 is once again transmitted to the GW 4000 via the access control edge router 1000. The packet is further transmitted from the GW 4000 to the access control edge router 1000, and the access control edge router 1000 transmits the packet to the subnetwork accommodating edge router 3000 accommodating the destination subnetwork 300. Subnetwork 20 inside VPN
Access control is realized by forcibly passing the communication between 0 and 300 through the GW 4000.

The embodiments of the present invention will be described in detail below. The subnetwork accommodating edge router 2000 is
Upon receiving a packet from the IP network side I / F 2101, the transfer network routing table 2210 determines the transfer network address of the transmission destination, and the transfer network side I / F 2201 transmits the packet. Upon receiving the packet from the transfer network side I / F 2201, the sub network accommodating edge router 2000 determines the IP network side I / F to be transmitted by the IP network routing table 2110, and the IP network side I / F 2
101 or another IP network side I / F not described in FIG. 2 transmits a packet. Transport network routing table 2
Reference numeral 210 designates the destination of all packets received from the IP network side I / F 2101 as the access control edge router 100.
It is defined as a transfer network address assigned to 1201 which is the transfer network side I / F of 0. The IP network routing table 2110 defines the IP network side I / F to be transmitted according to the VPN identifier and the destination IP address given to the packet, as in the existing technology. The sub-network accommodating edge router 3000 has the same operation and setting as the sub-network accommodating edge router 2000.

The access control edge router 1000 is
When a packet is received from the IP network side I / F 1101, the transfer network routing table 1210 determines the transfer network address of the destination, and the transfer network side I / F 1201 transmits the packet. Access control edge router 100
When receiving a packet from the transfer network side I / F 1201, 0 determines the IP network side I / F to be transmitted by the IP network routing table 1110, and the IP network side I / F 110.
1, IP network side I / F 1102, other IP not described in FIG.
A packet is transmitted from the network side I / F. The forwarding network routing table 1210 receives a packet from the IP network side I / F 1101 whose corresponding VPN identifier is “# 1”, and if the destination IP address is the IP address of the terminal 20, the subnetwork accommodating edge router. 2000 transfer network side I / F 2201 transfer network address to destination IP
If the address is the IP address of the terminal 30, the transfer network side I / F 32 of the sub-network accommodating edge router 3000
The packet is defined to be transmitted to the transport network address of 01, and the packet is an IP whose corresponding VPN identifier is "# 0".
When received from the network side I / F 1102, the transfer network side I / F 120 of the access control edge router 1000 itself
It is defined to be transmitted to one transfer network address. I
In the P network routing table 1110, if the VPN identifier given to the packet is “# 1”, the IP network side I
From the / F1101, if it is "# 0", all the IP network side I /
It is defined as transmitting a packet from F1102.

The GW device 4000 has a VPN side I / F 41.
When the packet is received from 01, the packet filtering rule 4100 determines whether or not the packet can pass, and if permitted, the packet is transmitted from the external network side I / F 4102. Conversely, I / on the external network side
Even when the packet is received from the F4102, the packet filtering rule 4100 determines whether or not the packet can pass, and if permitted, the packet is transmitted from the VPN side I / F 4101.

Here, communication from the terminal 20 to the terminal 30 will be described as an example. The following notation means that an arrow indicates a packet transfer route, () in the middle indicates a routing table for determining a route, and {} indicates a packet filtering rule for determining passage refusal. Further, => represents transfer to its own transfer network address.

Terminal 20 → IP network side I / F 2101 of the sub-network accommodating edge router 2000 → (forwarding network routing table 2210) → forwarding network side I / F 2201
→ Transfer network side I / of the access control edge router 1000
F1201 → (IP network routing table 1110)
→ IP network side I / F 1101 → GW side VPN side I / F
4101 → {packet filtering rule 4100}
→ external network side I / F 4102 → IP network side I / F 1102 of the access control edge router 1000 → (transfer network routing table 1210) → transfer network side I / F
1201 => transfer network side I / F 1201 → (IP network routing table 1110) → IP network side I / F 1102 →
External network side I / F 4102 of GW device → {packet filtering rule 4100} → VPN side I / F
4101 → IP of access control edge router 1000
Network side I / F 1101 → (Transfer network routing table 1
210) → transfer network side I / F 1201 → transfer network side I / F 3201 of the sub-network accommodating edge router 3000 →
(IP network routing table 3110) → IP network side I
/ F3101 → terminal 30 As described above, the terminal 30 in the sub-network 300 having the same VPN identifier “# 1” from the terminal 20 in the sub-network 200 having the VPN identifier “# 1”
Packets can be forwarded to.

As described above, the invention made by the present inventor is
Although the specific description has been given based on the above-described embodiments, the present invention is not limited to the above-described embodiments, and it goes without saying that various modifications can be made without departing from the scope of the invention.

[0029]

The edge router for access control according to the present invention allows the GW to pass even in the communication between the sub-networks within the VPN. By using this access control edge router, access control between sub-networks inside the VPN becomes possible without reducing the number of VPNs that can be accommodated by one GW device. As a result, IP-VP
The N service can provide a more detailed access control function.

[Brief description of drawings]

FIG. 1 is a diagram showing a network configuration (prior art) of an IP-VPN service.

FIG. 2 is a diagram showing an IP-VPN access control device (embodiment of the present invention).

[Explanation of symbols]

20, 30 ... Terminals 200, 300 ... Sub network 1000 ... Access control edge router 2000, 3000 ... Sub network accommodating edge router 4000 ... Gateway device (GW) 1201, 201, 3201 ... Transfer network side I / F 1101 of edge router , 1102, 2101, 3101 ... IP network side I / F of edge router 1110, 2110, 3110 ... IP network routing table 1210, 2210, 3210 ... Transfer network routing table 4100 ... Packet filtering rule 4101 ... VPN of gateway device (GW) Side I / F 4102 ... External network side I / F of gateway device (GW)

Claims (2)

[Claims] 1. The same V by having an edge router for accommodating a sub-network and an edge router for access control.
IP that enables packet filtering inside the PN
-In-VPN access control system, wherein the sub-network accommodating edge router receives the packet received from the IP network side I / F from the control target VPN.
The access control edge router has means for giving an identifier and transmitting it to the forwarding network address assigned to the access control edge router. The access control edge router is provided with the control target VPN identifier received from the forwarding network side I / F. Means for transmitting a packet from the IP network side I / F to the VPN side I / F of the gateway device, and a packet transmitted from the external network side I / F of the gateway device and received from the IP network side I / F, A means for adding a return VPN identifier and transmitting it to its own transfer network address, and a packet received from the transfer network side I / F and provided with the return VPN identifier from the IP network side I / F to the outside of the gateway device. And a means for transmitting to the network side I / F. 2. The same V by having an edge router for accommodating a sub-network and an edge router for access control.
IP that enables packet filtering inside the PN
-In-VPN access control method, wherein the sub-network accommodating edge router receives a packet received from the IP network side I / F as a control target VPN.
An identifier is added and transmitted to the transfer network address assigned to the access control edge router, and the access control edge router receives the packet to which the control target VPN identifier is received from the transfer network side I / F, A packet sent from the IP network side I / F to the gateway apparatus VPN side I / F, transmitted from the gateway apparatus external network side I / F, and received from the IP network side I / F is given a return VPN identifier. Then, the packet is sent to its own transfer network address, and the packet with the return VPN identifier received from the transfer network side I / F is forcibly sent from the IP network side I / F. Method.