JP2004247858A - Information providing system and information providing method - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To enhance the immunity to attacks and the operating rate of an entire information providing service by localizing a damage of an information providing system due to an external access of illegitimate purpose via a broadband computer network. <P>SOLUTION: This information providing system includes: a plurality of server entities C<SB>1</SB>to C<SB>5</SB>to which the same network identifier is assigned and for providing a service S to users on a broadband network; and routers R<SB>1</SB>to R<SB>10</SB>each having an ordinary path control processing table for defining path control processing from one network on the broadband network to another network and a path control processing table for defining path control processing applied to information whose destination is the prescribed network identifier, the routers refering to the tables to carry out the path control processing thereby physically dividing objects in a prescribed unit to which the prescribed service S is provided. <P>COPYRIGHT: (C)2004,JPO&NCIPI

Description

[0001]
TECHNICAL FIELD OF THE INVENTION
The present invention relates to an information providing system and an information providing method operating on, for example, a wide area computer network. In particular, the present invention relates to localization of system damage caused by unauthorized access from outside, thereby improving the attack resistance of the entire information providing service. The present invention relates to an information providing system and an information providing method for improving an operation rate.
[0002]
[Prior art]
2. Description of the Related Art Conventionally, on a wide area computer network, various services are provided by an information providing system including a plurality of computers.
[0003]
In such an information providing system, one service is provided by a plurality of computers having the same function (hereinafter, referred to as “server entity”). Further, one service is assigned a network identifier (hereinafter, referred to as “representative address”) that specifies the service. Under such a configuration, in the information providing system, even if one server entity stops for some reason during the service provision, the user directed to the representative address via the wide area computer network By automatically distributing traffic to another running server entity, the service itself can be provided continuously.
[0004]
For example, an L4 switch used in a conventional information providing system reads header information of a transport layer of a packet, such as a TCP or UDP port number, and transfers the packet based on the header information. That is, the L4 switch realizes priority control and filtering, load distribution in an environment where a plurality of server entities are connected, and the like according to the application type identified by the port number.
[0005]
Further, in the L7 switch, based on header information of the seventh layer such as a URL, a transfer destination of a packet is determined and a transfer process is performed. That is, in the L7 switch, a transfer order can be set for each application by adopting a method of switching by recognizing the application itself.
[0006]
On the other hand, when a DNS (domain name system) server returns an IP address to a DNS resolver serving as a client, the DNS server functions to sequentially reply a plurality of IP addresses registered for one name. Is generally known as "DNS Lounge Robin". According to the DNS lounge robin, when the server entities are distributed and arranged at a plurality of sites, the load of the server can be distributed over a wide area by replying to the end user side with the IP address that has been sequentially turned.
[0007]
[Problems to be solved by the invention]
However, according to the conventional technology, if an unauthorized access from the outside is continuously performed on the representative address, all the server entities are damaged and the service cannot be provided. This is because, as described above, in the information providing system according to the related art, when one server entity becomes inoperable due to the unauthorized access, traffic is automatically distributed to another server entity.
[0008]
As described above, in the information providing system according to the related art, in order to back up the server entity that has stopped functioning due to the unauthorized access as described above, the traffic related to the unauthorized access is transmitted to another operating server entity. All the server entities in the system are damaged in a chain because they are distributed.
[0009]
The present invention has been made in view of the above problems, and an object of the present invention is to provide a predetermined service while distributing a load on each server entity by distributing a plurality of server entities on a wide area computer network. Under such circumstances, system damage due to unauthorized access from outside via the wide area computer network, for example, the effects of damages such as DDoS attacks, etc., can be An object of the present invention is to provide an information providing system and an information providing method for improving the attack resistance and the operation rate.
[0010]
[Means for Solving the Problems]
In order to achieve the above object, according to the first aspect of the present invention, in an information providing system operating on a wide area network, a predetermined network identifier is assigned to provide a predetermined service to an object on the wide area network. A plurality of information providing means, a first table defining a route control process from one network to another network on the wide area network, and a route control process for information having the predetermined network identifier as a destination. And at least the defined second table, and each of the information providing means provides the predetermined service by performing the route control processing with reference to either the first or the second table. Routing control means for physically dividing objects on the wide area network into predetermined units. Information providing system characterized the door is provided.
[0011]
According to the second aspect of the present invention, the second table performs label processing for adding, removing, and changing a predetermined label to information having the predetermined network identifier as a transmission destination, and then performs predetermined transmission. It is further characterized in that it is defined at least that transmission is to be performed first, or that information to which a predetermined label is added is subjected to further label processing and then transmitted to a predetermined transmission destination. An information providing system according to claim 1 is provided.
[0012]
In the invention according to claim 3, the predetermined network identifier is an IP address, and the route control processing means refers to the second table when receiving an IP packet having the predetermined network identifier as a destination. Then, after performing further label processing of the IP packet based on at least one of information of an IP address, a combination of an IP address and a port number, and a combination of an IP address and a protocol number, predetermined transmission is performed. The information providing system according to claim 2, wherein the information is transmitted first.
[0013]
According to the fourth aspect of the present invention, in an information providing system operating on a wide area network, when an IP packet to be transmitted from one network on the wide area network to another network is received, the first table is referred to. Then, when the IP packet is transmitted to the other network and an IP packet having a predetermined IP address related to a predetermined service as a destination is received, the IP packet is referred to the second table. A predetermined label is added, removed, or changed to the IP packet based on at least one of information of the IP address, the combination of the IP address and the port number, and the combination of the IP address and the protocol number. An edge router for transmitting to a predetermined destination after performing label processing, and an IP When receiving the packet, the core router refers to the third table, performs further label processing determined based on a predetermined label included in the IP packet, and transmits the packet to a predetermined destination. When a predetermined IP address related to the predetermined service is assigned and an IP packet is received via at least one of the edge router and the core router, predetermined information based on the IP packet is transmitted to the IP. A plurality of server entities to be transmitted to the source of the packet, and a route control process performed by the edge router and the core router to provide a predetermined service on the wide area network by the server entity in a predetermined unit. There is provided an information providing system characterized in that the information providing system is divided into groups.
[0014]
According to a fifth aspect of the present invention, in the information providing method by the information providing system operating on the wide area network, when the information providing system receives information to be transmitted from one network on the wide area network to another network, Refers to the first table, performs a route control process so as to transmit the information to the other network, and, on the other hand, receives information having a predetermined network identifier related to a predetermined service as a transmission destination. Performs a route control process based on a second table, and logically divides a target on the wide area network that provides the predetermined service by a predetermined unit by the route control process. A method is provided.
[0015]
In the invention according to claim 6, the second table performs label processing for adding, removing, or changing a predetermined label to information having the predetermined network identifier as a transmission destination, and then performs predetermined transmission. It is further characterized in that it is defined at least that transmission is to be performed first, or that information to which a predetermined label is added is subjected to further label processing and then transmitted to a predetermined transmission destination. An information providing method according to claim 5 is provided.
[0016]
In the invention of claim 7, the predetermined network identifier is an IP address, and when the information providing system receives an IP packet having the predetermined network identifier as a destination, the second table is referred to. Adding or removing a predetermined label to or from the IP packet based on at least one of the IP address, the combination of the IP address and the port number, and the combination of the IP address and the protocol number. The information providing method according to claim 6, further comprising transmitting a predetermined destination after performing a label process for changing.
[0017]
According to the invention of claim 8, there is provided a method by an information providing system having an edge router, a core router, and a server entity and operating on a wide area network. When an IP packet to be transmitted to the network is received, the IP packet is transmitted to the other network with reference to the first table, and a predetermined IP address related to a predetermined service is set as a transmission destination. When an IP packet to be received is received, the IP address, the combination of the IP address and the port number, and the combination of the IP address and the protocol number are stored in the second table with reference to the second table. Label processing for adding, removing, or changing a predetermined label to the IP packet based on the IP packet When the IP packet is transmitted to a predetermined destination after performing the above, and the above-mentioned IP packet subjected to the label processing is received by the above-mentioned core router, referring to the third table, based on the predetermined label included in the IP packet, After performing further label processing defined in the above, the packet is transmitted to a predetermined destination, and when the server entity receives an IP packet through at least one of the edge router and the core router, the Transmitting the predetermined information to the source of the IP packet, and performing a path control process by the edge router and the core router to provide a target on the wide area network for providing a predetermined service by the server entity in a predetermined unit. The information providing method is characterized in that the information providing method logically classifies the information.
[0018]
BEST MODE FOR CARRYING OUT THE INVENTION
Hereinafter, embodiments of the present invention will be described with reference to the drawings.
[0019]
(1st Embodiment)
First, an information providing system and an information providing method according to a first embodiment of the present invention will be described in detail with reference to FIGS.
[0020]
FIG. 1 shows and describes the configuration of the information providing system according to the first embodiment.
[0021]
As shown in FIG. 1, the network N _X Above, a plurality of server entities C ₁ Or C ₅ Are distributed. And network N _X Administrator of a plurality of server entities C ₁ Or C ₅ To provide one service S by the server entity C ₁ Or C ₅ Are assigned the same network identifier "identifier" in advance. Further, the server entity C ₁ Or C ₅ Is the router R ₁ Or R ₁₀ Are communicably connected to each other via a router R ₁ Or R ₁₀ Through the external network N _A Or N _C Are also connected to communicate freely. These routers R ₁ Or R ₁₀ Has a function of transmitting a packet to a destination expected by a user.
[0022]
Router R ₁ , R ₄ , R ₈ , R ₁₀ Are edge routers and the others are core routers.
[0023]
In addition to the above, Network N _X Within the predetermined user U ₁ , U ₂ And traffic is accommodated in two routers.
[0024]
As described above, the information providing system according to the first embodiment of the present invention is constructed as a network operated by a predetermined routing policy, that is, an autonomous system (AS). Here, in order to simplify the explanation, five server entities C ₁ Or C ₅ And 10 routers R ₁ Or R ₁₀ Is illustrated, but it is of course only an example, and it is a matter of course that the present invention is not limited to this number.
[0025]
The server entities C1 to C5 correspond to an example of an information providing unit described in the claims, and the routers R1 to R10 correspond to an example of a route control processing unit described in the claims.
[0026]
In such a configuration, in the information providing system according to the first embodiment, the user who uses the service S _X Server entity C according to a predetermined routing policy according to ₁ Or C ₅ Grouped by the number of.
[0027]
Here, the user who uses the service S is, for example, the network N _X Internal user U ₁ And user U ₂ , External network N _A Or N _C Means a user or the like that exists within. In this example, as described above, the network N _X Within five server entities C ₁ Or C ₅ Are distributed, the network N _X User U in ₁ And user U ₂ , Network N _A Users, network N _B Users, network N _C The users are grouped into five groups.
[0028]
That is, the traffic of each user is transferred to a different server entity C. ₁ Or C ₅ Grouping such as sorting to. It is naturally assumed that the number of users is larger than the number of server entities. In this case, for example, predetermined classification is performed based on the number of server entities and the like, and traffic of each user is distributed.
[0029]
Next, in this information processing system, each server entity C ₁ Or C ₅ Traffic of each user group toward the network N _X Determine which resource to use and which path to take. The determination of this route is performed by the network N _X The network manager or the like at the time of following the network resources can be freely determined.
[0030]
Here, FIG. 2 shows each server entity C ₁ Or C ₅ In the following, a state in which a route used by a user group is determined will be conceptually shown and described. In the information providing system according to the first embodiment, the network N _X Each router R in ₁ Or R ₁₀ , The server entity C ₁ Or C ₅ Is route control processing of the packet to which the transmission destination is, and the transmission destination is the server entity C. ₁ Or C ₅ The condition processing is separately performed from the path control processing of the packet that is not.
[0031]
Then, in order to realize such condition processing, each router R ₁ Or R ₁₀ Has two route control processing tables, which will be described in detail later.
[0032]
In this information processing system, as shown in the flowchart of FIG. ₁ Or R ₁₀ Receives the packet (step S1), the destination of the packet is the server entity C ₁ Or C ₅ Is determined (step S2). Destination is server entity C ₁ Or C ₅ If not, the packet is transferred along a route (for example, a route indicated by a dotted area in FIG. 2) predetermined by the network administrator instead of the normal route control process (step S4). , The transmission destination is server entity C ₁ Or C ₅ If not, a normal route control process is performed (step S3).
[0033]
For example, in FIG. _X User U in ₂ To server entity C ₁ Or C ₅ The traffic directed to (network identifier) is sent along a predetermined route, that is, the router R ₈ , R ₉ Is transferred through the server entity C ₃ And another server entity C ₁ , C ₂ , C ₄ , C ₅ Will not be forwarded to On the other hand, user U ₂ Server entity C from ₁ Or C ₅ Other than (network identifier Identifier), for example, network N _A The traffic destined for the network N _A Packets will be sequentially transferred to the server.
[0034]
In order to realize the above processing, in the information providing system according to the first embodiment, the network N _X All routers R within ₁ Or R ₁₀ Is configured to have two routing control processing tables as shown in FIGS. 4 (a) and 4 (b).
[0035]
That is, FIG. 4A shows that essentially all routers R ₁ Or R ₁₀ Is a routing control processing table T for determining a normal packet transfer destination. ₁ It is. This routing control processing table T ₁ Defines a transmission destination identifier and a packet transfer destination identifier in association with each other. On the other hand, FIG. 4B illustrates a route control processing table T defined by a transfer destination for a service S employed in the information providing system according to the first embodiment. ₂ It is. This path control processing table T ₂ Defines only the packet transfer destination identifier corresponding to the network identifier "identifier" related to the service S. The identifier of the packet transfer destination corresponding to the network identifier "identifier" ₁ Or R ₁₀ Server entity C that provides service S and the traffic of the group that it processes ₁ Or C ₅ Will be set according to the position of.
[0036]
The table T1 corresponds to an example of a first table described in the claims, and the table T2 corresponds to an example of the second and third tables described in the claims.
[0037]
Here, the router R shown in FIG. ₁ Or R ₁₀ Is a route control table reference process, and is achieved by sequentially referring to two route control process tables in a procedure as shown in FIG. Hereinafter, this will be described in detail. Note that this series of processes corresponds to an example of an information providing method.
[0038]
Router R ₁ Or R ₁₀ Receives the packet (step S11), it extracts information on the destination from the header of the packet (step S12).
[0039]
And router R ₁ Or R ₁₀ Performs a routing control table reference process for the service S (step S13). That is, the transmission destination is the server entity C related to the service S. ₁ Or C ₅ It is determined whether or not the received information is (network identifier) (step S13a). And the transmission destination is server entity C ₁ Or C ₅ Is determined, the route control processing table T shown in FIG. ₂ , The corresponding packet transfer destination is specified, and the packet is transferred to the transfer destination (step S13b). On the other hand, in step S13a, the transmission destination is the server entity C related to the service S. ₁ Or C ₅ If it is determined that it is not the normal path control processing table T shown in FIG. ₁ To transfer the packet to the corresponding packet transfer destination (step S14). Thus, a series of processing ends.
[0040]
By a series of routing control described above, the network N _A From server to service S is server entity C ₁ Network N _B From server to service S is server entity C ₂ Only to be sent. Further, for the traffic other than the service S, a normal route control process is performed as in the conventional case. That is, as far as the traffic to the service S is concerned, as shown in FIG. ₁ Or G ₅ Can be isolated every time.
[0041]
As described above, according to the information providing system according to the first embodiment, the server entity C that provides the same service ₁ Or C ₅ Assigned the same representative address (identifier) to the normal routing control processing table T ₁ And the routing control processing table T corresponding to the representative address. ₂ Router R to use properly ₁ Or R ₁₀ Allows user traffic to be transmitted to each server entity C ₁ Or C ₅ By distributing the load, localization of system damage (for example, DDoS attacks, etc.) due to unauthorized access from the outside via a wide area computer network improves the attack resistance of the entire information providing service and the operating rate. Can be improved.
[0042]
That is, if the network N _A Even if a computer criminal attacks the service S via the server, the server entity C ₁ May stop functioning, but other server entity C ₂ Or C ₆ Can continue to provide services as usual without being affected. In that case, the network N _B , N _C , User U ₁ , User U ₂ For network N _A It can completely hide the effects of attacks via the Internet. Further, even if a plurality of computer criminals cooperate to launch an attack on the service S, one computer criminals of the number of user groups must be included in a user group that can be independently determined by the network administrator. If all server entities C ₁ Or C ₅ Can't attack all of them. Since this is practically impossible, it can be said that the information providing system according to the first embodiment having the above-described configuration and operation has extremely high attack resistance against computer criminals.
[0043]
(2nd Embodiment)
Next, an information providing system and an information providing method according to a second embodiment of the present invention will be described in detail with reference to FIGS.
[0044]
In the second embodiment, it is assumed that some servers (DNS, Web, etc.) are constructed in a wide area IP network. Here, the network identifier assigned to the server entity, that is, the “representative address” is an IP address. The IP address may be IPv4 or IPv6.
[0045]
First, FIG. 7 shows and describes the configuration of an information providing system according to the second embodiment.
[0046]
As shown in FIG. _X Above, a plurality of server entities C ₁ Or C ₅ Are distributed. And ISP1 _X Administrator of a plurality of server entities C ₁ Or C ₅ In order to provide one service S by means of these server entities C ₁ Or C ₅ Are assigned the same network identifier, that is, the same representative address in advance. These server entities C ₁ Or C ₅ The representative address assigned to ISP1 _X May be any as long as they hold, and in the second embodiment, for example, a representative address "136.187.1.1" is used.
[0047]
Server entity C ₁ Or C ₅ Is the router R ₁ Or R ₁₀ Are communicably connected to each other via the ₁ Or R ₁₀ Via an external ISP1 _A Or 1 _C Are also connected to communicate freely. These routers R ₁ Or R ₁₀ Has a function of transmitting an IP packet to a destination expected by a user. Server entity C ₁ Or C ₅ , Router R ₁ Or R ₁₀ Is not limited to this.
[0048]
ISP1 _X ISP1 outside of _A Or 1 _C Has an AS number. These ISP1 _A Or 1 _C Exchanges IP routing information based on BGP (Border Gateway Protocol) which is a protocol used between ASs.
[0049]
In addition to the above, the ISP1 _X Within the predetermined user U ₁ , U ₂ And traffic is accommodated in two routers. In addition, this user U ₁ Or U ₂ Is ISP1 _X Means the connected organization connected to. The server entity C ₁ Or C ₅ Corresponds to an example of the information providing means described in the claims, and the router R ₁ Or R ₁₀ Corresponds to an example of a route control unit described in the claims.
[0050]
In such a configuration, ISP1 _X The network administrator of each server entity C ₁ Or C ₅ Configure a user group for. That is, for example, the server entity C ₁ ISP1 _A User of the server accesses the server entity C ₂ ISP1 _X User U of ₁ Accesses the server entity C3 and the ISP1 _X User U of ₂ Accesses the server entity C ₄ ISP1 _B User of the server accesses the server entity C ₅ ISP1 _C The user group is defined so that the user of the user accesses. However, the user group is not limited to this mode.
[0051]
Subsequently, the user group is defined as each server entity C ₁ Or C ₅ Is determined by determining the route to be passed before reaching the router R. ₁ Or R ₁₀ The predetermined setting is made with. This setting is made for each router R ₁ Or R ₁₀ And the corresponding router R ₁ Or R ₁₀ To server entity C ₁ Or C ₅ This is achieved by providing a function of performing packet transfer without depending on the IP layer.
[0052]
Specifically, each router R ₁ Or R ₁₀ To server entity C ₁ Or C ₅ A first method for setting up a physical leased line up to each router R ₁ Or R ₁₀ In the above, a second method or the like may be adopted in which a label that does not depend on the IP address is set and a setting is made so that packet transfer processing in accordance with the label can be performed. As a method for realizing the latter second technique, MPLS (multiprotocol label switching), GMPLS (generalized multiprotocol label switching), ATM (Asynchronous Transfer, etc.) are available.
[0053]
Here, MPLS is a packet transfer technology of a cut-through method used in an IP network, and is also called a label switching technology. In this MPLS, an identifier called a label is inserted into an IP packet, and an MPLS-compatible node on the IP network that manages the correspondence between the label and the route transfers the packet at a high speed by using the label, thereby realizing load distribution of traffic. The label is inserted between the layer 2 header and the layer 3 header of the IP packet in the form of an MPLS-specific header called a shim header. Note that a path through which a packet is delivered in MPLS is called an LSP (Label Switch Path). GMPLS is an extension of the MPLS label delivery technology to the wavelength of light and time slots in TDM. In either case, information necessary for packet delivery is exchanged using a label distribution protocol such as CR-LDP that allows explicit LSP setting.
[0054]
The ATM VC setting is to implement the LSP in the MPLS with the function of the VC in the ATM.
[0055]
Hereinafter, an implementation example of the second embodiment employing MPLS will be described in detail.
[0056]
In this example, router R ₁ Or R ₄ Have an MPLS function and operate on an LSR. Here, the LSR refers to a router (MPLS edge router, MPLS core router) that can interpret MPLS.
[0057]
Router R ₁ Adds an MPLS label to an IP packet whose destination is the IP address 136.187.1.1, and ₂ Send to Then, the setting is made so that the IP packet having the destination other than the IP address is subjected to the routing by the IGP (Interior Gateway Protocol) which is the routing protocol used in the normal AS.
[0058]
Where router R ₁ (A) and (b) of FIG. This corresponds to FIG. 4 described in the first embodiment.
[0059]
As shown in FIG. 9A, the normal routing control processing table is obtained by IGP and BGP (Border Gateway Protocol), and the destination and the IP address of the packet transfer destination are associated with each other. .
[0060]
On the other hand, as shown in FIG. 9B, FTN (FEC to NHLFE) in the MPLS Forwarding Information Base (FIB) uses some label distribution procedure, for example, CR-LDP (Constraint-Based LDP) or RSVP-TE. (Resource Reservation Protocol Traffic Engineering Extension) or the like.
[0061]
CR-LDP is an extension of LDP, and differs from the prefix-based method in that a label path is individually created between certain routers.
[0062]
The RSVP-TE transmits a label assignment request to an adjacent router, and the router that has received the request assigns a label to a corresponding prefix or the like in accordance with the content of the request. That is, this is a method in which a label is individually assigned only to a prefix that has been requested.
[0063]
FTN is a table showing a relationship between FEC (Forwarding Equivalence Class) and NHLFE (Next Hop Label Forwarding Entry).
[0064]
The FEC indicates one of the destination group entries.
[0065]
In NHLFE, a predetermined label is added to a packet to which no label is added (command: label PUSH), a label of a packet to which a label is already added is removed (command: label POP), and a label is added. This shows the contents of the exchange of the label of the packet (command: label SWAP) and the contents taken.
[0066]
For example, in the FTN of FIG. 9B, the FEC indicates “136.187.1.1”, which means that the transmission destination address is “136.187.1.1”. .
[0067]
Further, the NHLFE has "label PUSH, label # 136", which means that a label to which 136 is assigned as an identification number is added to the packet. This will be described as “label # 136”. Further, NHLFE has "Forward = 150.100.9.1", which means that the IP address of the transfer destination of the packet to which the label # 136 is added is 150.100.9.1. I have.
[0068]
Note that the FILS of the MPLS generally includes an ILM (Incoming Label Mapping) indicating the relationship between the label and the NHLFE, but in this example, the router R is used for convenience of explanation. ₁ It is assumed that the ILM has not been set.
[0069]
The table in FIG. 9A corresponds to an example of a first table described in claims, and the table in FIG. 9B corresponds to an example of a second table in claims.
[0070]
Similarly, router R ₂ (A) and (b) of FIG. This corresponds to FIG. 4 described in the first embodiment.
[0071]
As shown in FIG. 10A, the normal routing control processing table is obtained by IGP and BGP (Border Gateway Protocol), and the destination and the IP address of the packet transfer destination are associated with each other. .
[0072]
On the other hand, as shown in FIG. 10B, the ILM of MPLS indicates the relationship between the label attached to the transmitted packet and NHLFE.
[0073]
Again, in NHLFE, a predetermined label is added to a packet to which no label is added (command: label PUSH), a label of a packet to which a label is already added is removed (command: label POP), and a label is added. The contents of the attached packet are exchanged (command: label SWAP), and the contents taken are shown.
[0074]
For example, in the ILM of FIG. 10B, the Incoming Label indicates “# 136”, which means that the identification number of the label added to the received labeled packet is 136.
[0075]
In addition, the label “POP, Forward = 136.187.1.1” is written in the NHLFE of the ILM. This is to remove the label # 136 from the packet and then transfer the packet to the IP address 136.187.1.1. Means In this example, router R ₂ In, for convenience of explanation, it is assumed that FTN is not set. The table in FIG. 10B corresponds to an example of a third table described in the claims.
[0076]
Next, addition of label information will be described with reference to FIGS.
[0077]
In this example, it is assumed that the network uses a wide area Ethernet dedicated line. Now, ISP1 in FIG. _A The frame directed to the IP address 136.187.1.1 has a physical header, an IP header, and IP data.
[0078]
Then, the IP packet is transmitted to the router R ₁ Are labeled as shown in FIG. That is, as shown in FIGS. 11A and 11B, in the labeling process, the Type field value indicating the upper layer protocol in the layer 2 header of the network media indicates the MPLS unicast packet label from 0x0800 indicating IP. This is performed by rewriting to 0x8847, and further inserting a shim header containing MPLS label information. Even when other network media are used, although the format and the field value of the layer 2 header are different, the value indicating the upper protocol basically indicates the MPLS unicast packet label from the value indicating the IP. There is no difference in rewriting.
[0079]
On the other hand, ISP1 in FIG. _A To another destination, eg, ISP1 _X Via ISP1 _B The labeling process is not performed on the packet destined for (IP address 160.160.160.160). Therefore, in this case, the Type field value of the layer 2 header is not rewritten, and the field value is maintained at 0x0800.
[0080]
Hereinafter, the router R in the information providing system according to the second embodiment will be described with reference to FIGS. 9A and 9B and the flowchart of FIG. ₁ (MPLS edge router) routing control table reference processing will be described in further detail.
[0081]
Note that the processing of this example also corresponds to an example of an information providing method.
[0082]
Router R ₁ Receives the physical frame having the IP packet as data (step S21), and determines whether or not the Type field value of the physical header of the IP packet is 0x0800 indicating IP (step S22). In this step S22, the router R ₁ If the Type field value is not 0x0800, the IP packet is discarded as an error (step S23), and the process ends.
[0083]
On the other hand, router R ₁ Extracts the destination address of the IP header if the Type field value is 0x0800 (step S24). Then, the process shifts to a route control table reference process for the service S (step S25).
[0084]
That is, router R ₁ Determines whether the transmission destination is the representative address "136.187.1.1" (step S25a). If the transmission destination is 136.187.1.1, the process proceeds to FIG. 9B. Referring to the indicated FIB, in accordance with the NHLFE corresponding to 136.187.1.1 of FTN, the Type field value of the IP packet is rewritten to 0x8847 indicating the MPLS unicast packet label, and then the label information is added as a shim header. Then, the IP packet with the label is transferred (step S25b), and the process ends.
[0085]
On the other hand, if it is determined in step S25a that the transmission destination is not 136.187.1.1, the packet is forwarded to the corresponding packet forwarding destination by referring to the normal routing control table shown in FIG. The process is performed (step S26), and the process ends.
[0086]
Next, referring to the flowchart of FIG. 13, the router R in the information providing system according to the second embodiment will be described. ₂ The process of referring to the routing control table of the (MPLS core router) will be described in further detail. Note that this series of processes corresponds to an example of an information providing method.
[0087]
Router R ₂ Receives a physical frame having an IP packet as data (step S31), and determines whether the Type field value of the physical header of the IP packet is 0x0800 indicating IP (step S32).
[0088]
In this step S32, the router R ₂ If the Type field value is not 0x0800 indicating the IP, it determines whether the Type field value is 0x8847 indicating the MPLS unicast packet label (step S35).
[0089]
If the value of the Type field is not 0x8847 at step 35, the IP packet is discarded as an error (step S36), and the process ends.
[0090]
On the other hand, router R ₂ If the Type field value is 0x8847, the process proceeds to the routing control table reference process for the service S (step S37).
[0091]
That is, router R ₂ Determines whether the destination is label # 136 (step S37a). If it is label # 137 in step S37a, referring to the FIB shown in FIG. 10B first, after removing label # 137 of the IP packet according to NHLFE corresponding to label # 137 of the LIM, the IP packet is The IP address is transferred to 136.187.1.1 (step S25b), and the process ends. If the destination is not label # 137 in step S37a, the IP packet is discarded as an error (step S37b), and the process ends.
[0092]
On the other hand, if the destination is determined to be 0x0800 indicating the IP in step S32, the router R ₂ Extracts the transmission destination address of the IP header from the IP packet (step S33), and refers to the normal routing table shown in FIG. A packet transfer process is performed (step S34), and this process ends.
[0093]
As described above, according to the second embodiment, a plurality of server entities C that provide the same service ₁ Or C ₅ In an information providing system in which is distributed and arranged, for example, an MPLS edge router R having an MPLS function ₁ , R ₄ , R ₈ , R ₁₀ And MPLS core router R ₂ , R ₃ , R ₅ , R ₆ , R ₇ , R ₉ Are arranged, and the router is provided with a normal routing control processing table and an MPLS FIB. ₁ Or R ₁₀ Sends the IP packet to the server entity C using the table ₁ Or C ₅ By distributing the load, localization of system damage (for example, DDoS attacks) due to unauthorized access from the outside via a wide area computer network is performed while distributing the load. The rate can be improved.
[0094]
That is, in the second embodiment, ISP1 _A If there is a DDoS attack from, all traffic will be sent to server entity C ₁ Concentrate on As a result, the server entity C ₁ Goes down, but the other server entity C ₂ Or C ₅ Can operate continuously. In addition, server entity C ₁ Down the ISP1 _B User, ISP1 _C User, ISP1 _X User U in ₁ , User U ₂ I don't know. Furthermore, if ISP1 _B To server entity C ₁ ISP1 _B To server entity C ₁ Cannot reach the IP packet. Further, even if an IP source route is set to make a packet reach 136.187.1.1 through 150.100.7.1, the router R ₂ Does not have an entry via IP of 136.187.1.1, the packet cannot reach 136.187.1.1.
[0095]
(Third embodiment)
Next, an information providing system and an information providing method according to a third embodiment of the present invention will be described in detail with reference to FIGS.
[0096]
In the third embodiment, as in the second embodiment, the ISP 1 _X Consider the case of building an autonomous system on the above. In the second embodiment, one representative address is set for one service. However, in the third embodiment, a plurality of services are provided by one representative address, and a DDoS attack is performed on each service. Localizes the range of server down due to. That is, in a situation where a plurality of server entities are distributed and arranged on the wide area computer network and a predetermined service is provided while distributing the load on each server entity, an unauthorized purpose from outside via the wide area computer network may be used. Is characterized by improving the attack resistance of the entire information providing service and the operating rate by localizing the effects of system damage caused by access to the information, for example, the damage of DDoS attacks and the like. This is the same as the first and second embodiments described above.
[0097]
The configuration of the information providing system according to the third embodiment of the present invention is substantially the same as that of FIG. 7 described above as the second embodiment. Will be described using the same reference numerals. The relationship between each configuration and the claims is substantially the same as that described in the second embodiment.
[0098]
In the third embodiment, the ISP 1 _X The network administrator configures a user group for each server entity.
[0099]
In the third embodiment, for example, “Web page browsing (HTTP) is performed by server entity C. ₁ And file download (FTP) is performed on server entity C ₄ To use. " That is, the server entity used by the service can be changed while using the same representative address.
[0100]
Here, FIG. 14 illustrates a partially enlarged view of the information providing system according to the third embodiment, which is substantially similar to FIG.
[0101]
As shown in FIG. _A Homepage browsing (HTTP) is performed by server entity C ₁ , File download (FTP) is server entity C ₄ The user traffic is grouped so as to select. Next, the user group is assigned to each server entity C. ₁ Or C ₅ Is determined, and the network is set so that such a routing process is performed. For other traffic, settings are made so as to be left to normal IGP routing.
[0102]
Hereinafter, an implementation example of the third embodiment employing MPLS will be described in detail.
[0103]
In this example, router R ₁ Or R ₄ Have an MPLS function and operate on an LSR. Here, the LSR refers to a router (MPLS edge router, MPLS core router) that can interpret MPLS.
[0104]
Where router R ₁ (A) and (b) of FIG. This corresponds to FIG. 4 described in the first embodiment.
[0105]
As shown in FIG. 15A, the normal routing control processing table is obtained by IGP and BGP, and the destination and the IP address of the packet transfer destination are associated with each other. Then, as shown in FIG. 15B, the FTN in the MPLS FIB extends some label distribution procedure, for example, CR-LDP or RSVP-TE, and combines a protocol number and a port number in addition to an IP address. Obtained. The difference from the second embodiment described above lies in the manner in which the MPLS FIB is provided. That is, in the second embodiment described above, one label is set for the IP address, but in the third embodiment, one label is set for one protocol port. In detail, one label is set for one protocol port because TCP / 80 is used in HTTP. On the other hand, in the FTP, one label is set for two protocol ports in order to use both TCP / 20 and TCP / 21.
[0106]
For example, when the transmission destination address is 136.187.1.1 and the protocol port is TCP / 80, the FTN in FIG. 15B transmits the packet with the label # 136 added to the IP address 150.100. .9.1. Further, when the transmission destination address of the FTN is 136.187.1.1 and the protocol ports are TCP / 20 and TCP / 21, the packet to which the label # 137 is added is sent to the IP address 150.100.9. 1 means to be transferred.
[0107]
Here, the FILS of the MPLS generally includes the ILM indicating the relationship between the label and the NHLFE, but in this example, for convenience of explanation, the router R ₁ It is assumed that the ILM has not been set. The table in FIG. 15A corresponds to an example of a first table described in claims, and the table in FIG. 15B corresponds to an example of a second table in claims.
[0108]
Similarly, router R ₂ 16A and 16B show the route control processing table included in. This corresponds to FIG. 4 described in the first embodiment.
[0109]
As shown in FIG. 16A, the normal routing control processing table is obtained by IGP and BGP, and the transmission destination and the IP address of the packet transfer destination are associated with each other. On the other hand, as shown in FIG. 16B, the ILM of MPLS indicates the relationship between the label attached to the transmitted packet and NHLFE. For example, in the ILM of FIG. 10B, when the label added to the IP packet is # 136, it is necessary to remove the label # 136 and transfer the packet to the IP address 136.187.1.1. Means. Further, when the label added to the IP packet is # 137, it means that the label is changed to a new label # 237 and then transferred to the IP address 150.100.7.2.
[0110]
Here, for convenience of explanation, the router R ₂ In, it is assumed that FTN is not set. The table shown in FIG. 16B corresponds to an example of a third table described in the claims.
[0111]
Similarly, router R ₃ (A) and (b) of FIG. This corresponds to FIG. 4 described in the first embodiment.
[0112]
As shown in FIG. 17A, the normal routing control processing table is obtained by IGP and BGP, and the transmission destination and the packet transfer destination IP address are associated with each other. On the other hand, as shown in FIG. 17B, the ILM of MPLS indicates the relationship between the label attached to the transmitted packet and NHLFE. For example, in the ILM of FIG. 17B, if the label added to the IP packet is # 237, it is necessary to remove the label # 237 and transfer the packet to the IP address 136.187.1.1. Means. Here, for convenience of explanation, the router R ₃ In, it is assumed that FTN is not set. The table shown in FIG. 17B corresponds to an example of a third table described in the claims.
[0113]
Here, as described above, in order to distribute the label based on the protocol number and the port number in addition to the IP address, it is necessary to extend the existing label distribution procedure.
[0114]
Hereinafter, an example of distributing labels using CR-LDP will be described with reference to FIG. This corresponds to the label distribution method of the present invention.
[0115]
In the CR-LDP, a Downstream on Demand type label distribution method and an Ordered LSP control method are combined. In this Downstream on Demand type label distribution system, labels are assigned only when a label assignment request is issued.
[0116]
As shown in FIG. 18, the server entity C ₁ Label distribution corresponding to (136.187.1.1, TCP / 80) is performed by router R ₁ Designates a router that explicitly passes through an explicit route (ER-Route) TLV (router R ₁ -Router R ₂ Is a direct connection, so router R ₂ Only) is sent to the router R ₂ To the router R ₂ Sends a label assignment message to router R ₁ It is done by returning to.
[0117]
In contrast, server entity C ₄ The label distribution corresponding to (136.187.1.1, TCP20, TCP21) is performed by the router R. ₁ The router that should pass through the explicit route (ER-Route) TLV is router R ₂ From router R ₃ The router R sends a label request message explicitly designated as ₃ To the router R ₃ The label assignment message sent by ₁ It will be done by arriving at.
[0118]
Here, this server entity C ₄ The detailed procedure until a label is assigned to TCP / 20 is as shown in FIG. Hereinafter, this will be described in detail.
[0119]
That is, router R ₁ More router R ₂ When a label of 136.187.1.1, TCP / 20 is requested by the label request message (# 1), the router R ₂ Is the router R ₃ And transmits a label request message to request a label of 136.187.1.1, TCP / 20 (# 2). Router R ₃ Assigns the label # 237 and sets the ILM to the symbol T in FIG. ₁₀ (# 3). In other words, if the label # 237 is affixed to the transferred IP packet, the ILM is set so that the label # 237 is peeled off and transferred to 136.187.1.1.
[0120]
Then, router R ₃ Sends the information of label # 237 to the router R ₂ (# 4). Router R ₂ Receives the label assignment message, assigns the input label # 137 to the output label # 237 of FEC 136.187.1.1, TCP / 20, and sets the ILM to T in FIG. ₁₁ (# 5). That is, router R ₂ Is such that when the label # 137 is attached to the transferred IP packet, the label # 137 is changed to the label # 237, and the FIB ILM is transferred to 150.100.7.2. It is set to.
[0121]
Then, router R ₂ Transmits the information of label # 137 to the router R by the label assignment message. ₁ (# 6). Router R ₁ Receives the label assignment message, sets the FTN to the code T in FIG. ₁₂ Set as shown in. That is, when the IP address of the transmission destination is 136.187.1.1 and TCP / 20, the content is set such that the label # 137 is attached and the content is transferred to 150.100.8.1. As described above, the server entity C ₄ Is assigned a label to TCP / 20.
[0122]
That is, in the label distribution method according to the embodiment of the present invention, when the edge router requests a label for an IP packet whose transmission destination is specified by at least a predetermined IP address and a port number from the core router by a label request message, the core router Assigns a predetermined label, sets the contents of its own ILM, and transmits the information of the label to the edge router by a label assignment message. When receiving the label assignment message, the edge router sets the contents of the FTN so that at least the IP address and port number of the IP packet are associated with the label. When there is a router to be passed by the edge router by the explicit route (ER-Route) TLV, the fact is indicated by the label request message.
[0123]
By the way, in the conventional CR-LDP, the FEC corresponding to one label is only the IP prefix. However, in the third embodiment, since an upper layer (TCP and UDP port numbers) is required in addition to the IP prefix, the FEC TLV portion commonly used by both LDP and CR-LDP is extended.
[0124]
Here, FIG. 20A shows a general FEC TLV format.
[0125]
That is, as shown in FIG. 20A, the following four types are defined in the FEC description field of the general FEC TLV format.
[0126]
0x01; wild card
0x02; IP prefix
0x03: Host address
0x04; CR-LSP
In the third embodiment, in addition to these, a new type 0x05 (type: socket) is defined. The type 0x05 TLV format is as shown in FIG. The above-described extension enables label distribution for each application using CR-LDP.
[0127]
Hereinafter, the router R in the information providing system according to the third embodiment will be described with reference to FIGS. 15A and 15B and the flowchart of FIG. ₁ (MPLS edge router) routing control table reference processing will be described in further detail.
[0128]
First, router R ₁ Receives the physical frame having the IP packet as data (step S41), and determines whether or not the Type field value of the physical header of the IP packet is 0x0800 indicating IP (step S42). In this step S42, the router R ₁ If the Type field value is not 0x0800, the IP packet is discarded as an error (step S43), and the process ends.
[0129]
On the other hand, router R ₁ Extracts the destination address of the IP header if the Type field value is 0x0800 (step S44). Then, the process shifts to a route control table reference process for the service S (step S45).
[0130]
That is, router R ₁ Determines whether the transmission destination is the representative address "136.187.1.1" (step S45a). If the transmission destination is 136.187.1.1, the port numbers are TCP / 80 and TCP. / 20 or TCP / 21 (step S45b). If neither is the case, the IP packet is discarded as an error (step S45c), and the process ends. On the other hand, when the port number is one of TCP / 80, TCP / 20, and TCP / 21, the FIB shown in FIG. 15B is referred to, and the FTN is set to 136.187.1.1. After rewriting the Type field value of the IP packet to 0x8847 indicating the MPLS unicast packet label according to the corresponding NHLFE, label information is added as a shim header, and the labeled IP packet is transferred (step S45d). The process ends.
[0131]
On the other hand, if it is determined in step S45a that the transmission destination is not 136.187.1.1, the packet is forwarded to the corresponding packet destination by referring to the normal routing control table shown in FIG. The process is performed (Step S46), and the process ends.
[0132]
As described above, in the third embodiment, a plurality of services (for example, homepage browsing (HTTP) and file download (FTP)) are provided by a plurality of server entities C1 to C5 given one representative address. However, the range of server down due to the DDoS attack can be localized for each service.
[0133]
That is, in the third embodiment, if ISP1 _A Even if there is a DDoS attack using a large amount of ICMP known as a Smurf attack or an attack using UDP having a huge data size, each server entity C ₁ Or C ₅ Is not attached unless the specified TCP port is used, the server entity C ₁ Or C ₅ Has no effect. Also, if ISP1 _A Even if a DDoS attack using HTTP that has been used correctly from is performed, the server entity C that provides the HTTP service will go down. ₁ Server entity C that provides the FTP service with the same representative address ₄ Can continue the service normally without any influence.
[0134]
Also, as in the second embodiment, if the server entity C ₁ Even if you fall, the affected area is ISP1 _A Of users.
[0135]
The first to third embodiments of the present invention have been described above. However, the present invention is not limited to the embodiments, and it is needless to say that various improvements and modifications can be made without departing from the gist of the present invention. . For example, the present invention can be applied to an IP telephone system, an optical VPN, or the like, which is a communication system that performs relay switching using VoIP technology for converting telephone voice into IP packets. A similar effect can be obtained by including information on a path in TOS (type of service) included in the header of the IP packet and performing a path control process based on the information and by each router.
[0136]
【The invention's effect】
As described above in detail, according to the present invention, in a situation where a plurality of server entities are distributed and arranged on a wide area computer network and a predetermined service is provided while distributing the load on each server entity, By localizing the system damage caused by unauthorized access from outside via a wide area computer network, for example, the effects of damages such as DDoS attacks, it is possible to improve the attack resistance of the entire information provision service and improve the operation rate. It is possible to provide an information providing system and an information providing method for improving the information.
[Brief description of the drawings]
FIG. 1 is a diagram showing a configuration of an information providing system according to a first embodiment of the present invention.
FIG. 2 is a diagram illustrating each server entity C in the information providing system according to the first embodiment; ₁ Or C ₅ FIG. 5 is a diagram conceptually showing a state in which a route used by a user group is determined for the user.
FIG. 3 is a flowchart illustrating a flow of a route control process performed by the information providing system according to the first embodiment.
FIG. 4A shows each router R of the information providing system according to the first embodiment; ₁ Or R ₁₀ FIG. 7B is a diagram illustrating a normal routing control processing table included in FIG. 5B, and FIG. 7B is a diagram illustrating a routing control processing table for periodically setting a transfer destination related to the service S;
FIG. 5 is a flowchart showing two route control process table reference processes of FIGS. 4A and 4B by the information providing system according to the first embodiment.
FIG. 6 shows an information providing system according to the first embodiment as a user group G; ₁ Or G ₅ FIG.
FIG. 7 is a diagram illustrating a configuration of an information providing system according to a second embodiment.
FIG. 8 is a diagram illustrating a configuration of an information providing system according to a second embodiment.
FIG. 9A illustrates a router R of the information providing system according to the second embodiment; ₁ FIG. 7B is a diagram illustrating a normal routing control processing table included in FIG. 5B, and FIG. 7B is a diagram illustrating a routing control processing table for periodically setting a transfer destination related to the service S;
FIG. 10A shows a router R of the information providing system according to the second embodiment; ₂ FIG. 7B is a diagram illustrating a normal routing control processing table included in FIG. 5B, and FIG. 7B is a diagram illustrating a routing control processing table for periodically setting a transfer destination related to the service S;
FIG. 11 is a diagram illustrating the addition of label information by the information providing system according to the second embodiment.
FIG. 12 shows a router R in the information providing system according to the second embodiment. ₁ It is a flowchart for demonstrating the routing control table reference process of (MPLS edge router) in further detail.
FIG. 13 is a flowchart for explaining in more detail a routing control table reference process of a router R2 (MPLS core router) in the information providing system according to the second embodiment.
FIG. 14 is a partially enlarged view of an information providing system according to a third embodiment, which is substantially similar to FIG.
FIG. 15A shows a router R of the information providing system according to the third embodiment; ₁ FIG. 7B is a diagram illustrating a normal routing control processing table included in FIG. 5B, and FIG. 7B is a diagram illustrating a routing control processing table for periodically setting a transfer destination related to the service S;
FIG. 16A illustrates a router R of an information providing system according to a third embodiment; ₂ FIG. 7B is a diagram illustrating a normal routing control processing table included in FIG. 5B, and FIG. 7B is a diagram illustrating a routing control processing table for periodically setting a transfer destination related to the service S;
FIG. 17A shows a router R of the information providing system according to the third embodiment; ₃ FIG. 7B is a diagram illustrating a normal routing control processing table included in FIG. 5B, and FIG. 7B is a diagram illustrating a routing control processing table for periodically setting a transfer destination related to the service S;
FIG. 18 is a diagram illustrating an example in which a label is distributed using CR-LDP by the information providing system according to the third embodiment.
FIG. 19 is a diagram illustrating a server entity C by the information providing system according to the third embodiment. ₄ FIG. 11 is a diagram showing a detailed procedure until a label is assigned to TCP / 20 of FIG.
20A is a diagram showing a general FEC TLV format, and FIG. 20B is a diagram showing a FEC TLV format in which type 0x05 (type: socket) is newly defined.
FIG. 21 shows a router R in the information providing system according to the third embodiment. ₁ It is a flowchart for demonstrating the routing control table reference process of (MPLS edge router) further in detail.
[Explanation of symbols]
C ₁ ~ C ₅ Server entity
R ₁ ~ R ₁₀ Router
N _A ~ N _X network
U ₁ , U ₂ User terminal
G ₁ ~ G ₅ User group
T ₁ Normal routing control processing table
T ₂ Routing control processing table for service S

Claims (8)

In an information providing system operating on a wide area network, a predetermined network identifier is assigned, and a plurality of information providing means for providing a predetermined service to an object on the wide area network,
A first table that defines a route control process from one network to another network on the wide area network, a second table that defines a route control process of information having the predetermined network identifier as a destination, By performing a route control process with reference to either the first or second table, whereby each of the information providing means can provide an object on the wide area network for providing the predetermined service. A path control means for physically dividing in predetermined units,
An information providing system comprising: The second table indicates that after performing label processing for adding, removing, and changing a predetermined label to the information having the predetermined network identifier as a transmission destination, the information is transmitted to a predetermined transmission destination, or 2. The information according to claim 1, further comprising: performing at least label processing on the information to which a predetermined label is added, and then transmitting the information to a predetermined destination. Offer system. The predetermined network identifier is an IP address,
The route control processing means, when receiving an IP packet having the predetermined network identifier as a destination, refers to the second table, and describes an IP address of the IP packet, a combination of the IP address and the port number, After performing further label processing determined based on at least one of the information of the combination of the IP address and the protocol number, the packet is transmitted to a predetermined destination.
The information providing system according to claim 2, further comprising: In the information providing system operating on the wide area network, when an IP packet to be transmitted from one network on the wide area network to another network is received, the IP packet is referred to by referring to the first table. When transmitting to another network and receiving an IP packet destined to a predetermined IP address related to a predetermined service, the IP address and the IP address of the IP packet are referred to the second table. Based on at least one of the combination of an address and a port number and the combination of an IP address and a protocol number, a predetermined label is added to, removed from, or changed from the IP packet, and then a predetermined label is processed. An edge router that sends to the destination of the
When the IP packet subjected to the label processing is received, a predetermined destination is determined after performing further label processing determined based on a predetermined label included in the IP packet with reference to the third table. To the core router,
When a predetermined IP address related to the predetermined service is assigned and an IP packet is received through at least one of the edge router and the core router, predetermined information based on the IP packet is transmitted to the IP packet. Multiple server entities to send to the sender of the
An information providing system, comprising: physically dividing a target on the wide area network, which provides a predetermined service by the server entity, by a predetermined unit by a route control process by the edge router and the core router. In an information providing method by an information providing system operating on a wide area network,
With the above information providing system,
When information to be transmitted from one network on the wide area network to another network is received, a route control process is performed to transmit the information to the other network with reference to the first table,
On the other hand, when the information having the predetermined network identifier related to the predetermined service as the transmission destination is received, a route control process based on the second table is performed,
By the route control processing, objects on the wide area network that provide the predetermined service are logically divided in predetermined units,
An information providing method, comprising: The second table indicates that after performing label processing for adding, removing, and changing a predetermined label to the information having the predetermined network identifier as a transmission destination, the information is transmitted to a predetermined transmission destination, or 6. The information according to claim 5, further defining that after further label processing is performed on the information to which a predetermined label is added, the information is transmitted to a predetermined destination. Delivery method. The predetermined network identifier is an IP address,
When the information providing system receives an IP packet having the predetermined network identifier as a destination, the IP packet, the combination of the IP address and the port number, and the IP address of the IP packet are referred to by referring to the second table. Based on at least one of the combination of an address and a protocol number, perform a label process for adding, removing, or changing a predetermined label on the IP packet, and then transmit the IP packet to a predetermined destination. The information providing method according to claim 6, further comprising: An edge router, a core router, and a method by an information providing system having a server entity and operating on a wide area network,
With the above edge router,
When an IP packet to be transmitted from one network on the wide area network to another network is received, the IP packet is transmitted to the other network with reference to the first table,
On the other hand, when an IP packet having a predetermined IP address related to a predetermined service as a destination is received, an IP address, a combination of an IP address and a port number, Based on at least one of the information of the combination of the IP address and the protocol number, adding a predetermined label to the IP packet, performing label processing for removing and changing the packet, and transmitting the IP packet to a predetermined destination;
With the above core router,
When the IP packet subjected to the label processing is received, a predetermined destination is determined after performing further label processing determined based on a predetermined label included in the IP packet with reference to the third table. Send to
By the above server entity,
When receiving an IP packet via at least one of the edge router and the core router, transmitting predetermined information based on the IP packet to a source of the IP packet;
An information providing method, wherein a target on the wide area network for providing a predetermined service by the server entity is logically divided into predetermined units by a path control process by the edge router and the core router.

Images