KR100428311B1 - System and method for controlling a traffic of a network - Google Patents

Abstract

The present invention relates to a network traffic control system and a network traffic control method using the same. In the present invention, a network traffic control method for an arbitrary terminal is selected in a conventional port control method, and the terminal is selectively selected from a normal VLAN or a null VLAN. By changing in a way to belong, the terminal disconnection process on the network can be performed independently of the port.

If such a base environment is established, the control block, even if the terminal having the disconnection filtering condition and the terminal having the connection condition are connected together in any one port, only the terminal having the "disconnection filtering condition" to the "connection condition" Irrespective of the terminal, it can be selectively excluded from the network.

Description

System and method for controlling a traffic of a network

The present invention relates to a control system for controlling a network traffic state of an arbitrary terminal of the present invention. More specifically, the network disconnection process of an arbitrary terminal is independently performed regardless of a port, thereby preventing prediction of terminals having a connection condition. The present invention relates to a network traffic control system that can prevent a network disconnection in advance. Moreover, the present invention relates to a network traffic control method using such a network traffic control system.

Recently, as the information security problem is a very small concern, the technology related to the network traffic control system for controlling the traffic state of any terminal connected on the network has also made rapid progress.

As shown in Fig. 1, the conventional network traffic control system is largely composed of a combination of a switch block 5 and a switch control block 1 for controlling the switch block 5 in software.

In this case, the switch control block 1 includes a MAC address (Media Access Control address; hereinafter referred to as a "MAC address") filtering table 2, a learning module 3, a control module 4, and the like. A plurality of terminals 7 are connected to each port 6 of the switch block 5.

Here, the MAC address filtering table 2 stores a MAC address of each terminal 7 connected to each port 6 of the switch block 5, and the learning module 3 is a switch block 5. By observing all the network frames received at each of the ports (6) possessed by the), by identifying a series of MAC addresses contained in the network frame, and learning the learned MAC address to the port (6) receiving the network frame If a network frame arrives at the MAC address as a destination from other terminals 7, the network frame is transmitted to the learned port 6.

In addition, the control module 4 determines whether any MAC address exists in the previous MAC address filtering table 2 when any MAC address is learned in the port 6 by the learning module 3 mentioned above. If the corresponding MAC address exists in the previous MAC address filtering table 2, the MAC address checks the filtering condition of the MAC address.

At this time, if the filtering condition of the corresponding MAC address is a disconnection filtering condition, the control module 4 controls the switch block 5 to change the state of the port 6 learned from the corresponding MAC address to the no traffic state, The network frame output from the terminal 7 having the MAC address is quickly disconnected from the entire network.

Of course, when the filtering condition of the corresponding MAC address is a connection condition, the control module 4 maintains the state of the port where the corresponding MAC address is learned in a traffic state, thereby outputting a network output from the terminal 7 having the corresponding MAC address. This allows the frame to maintain a seamless networking relationship with the entire network.

However, as described above, in the conventional network traffic control system, the network traffic of the arbitrary terminal 7 is controlled through a process of changing the state of the port 6 learned from the MAC address to, for example, a no traffic state and a traffic state. If you do, an unexpected problem is caused.

As an example of such a problem, a conventional network traffic control process is performed in a state in which a terminal 7 and a terminal 7 having a "connection condition" are connected to a certain port 7 at a time. May be mentioned.

In this case, since the terminal 7 having the "disconnection filtering condition" terminal 7 and the terminals 7 having the "connection condition" are all connected to one port 6, if the corresponding port 6 is in a state of no traffic, If it is controlled, not only the "disconnection filtering condition" terminal but also the terminals having the "connection condition" cause a serious problem that network traffic is impossible at once.

For example, in a state in which not only the terminal 7a having the "disconnection filtering condition" but also the terminals 7a and 7c having the "connection condition" are connected at the same time, the conventional network traffic control process is performed. When the port 7 (6a) is changed to the no traffic state, not only the terminal 7b having the "disconnect filtering condition" but also the terminals 7a and 7c having the "connection condition" become impossible at once. Serious problems are caused.

Of course, in order to solve such a problem, it is the first priority to connect all terminals 7 to the port 6 one-to-one, but in this case, since various problems such as an increase in cost and a decrease in network operating efficiency may appear, While deeply aware that the network traffic control process by "port control" has many problems, it has not prepared a specific countermeasure.

Accordingly, an object of the present invention is to change the network traffic control method of an arbitrary terminal to a method other than the conventional port control method, for example, a virtual local area network (VLAN) employing method. For example, with a terminal having a "disconnect filtering condition", it is easy to solve the conventional problem that terminals having a "connection condition" are disconnected on a network at once.

Other objects of the present invention will become more apparent from the following detailed description and the accompanying drawings.

1 is an exemplary diagram conceptually showing a network traffic control system according to the prior art;

2 conceptually illustrates a network traffic control system in accordance with the present invention;

3 is a flowchart sequentially illustrating a network traffic control method according to the present invention.

In order to achieve the above object, the present invention discloses a network traffic control system comprising a combination of a switch block for switching a network frame transmitted from arbitrary terminals and a control block for controlling a switching state of the switch block.

In this case, the previous switch block includes a normal VLAN to which a series of broadcast domains are assigned, and a null VLAN in an abnormal state to which such a forwarding domain is not assigned. It is composed by a combination.

In addition, the control block for controlling the switch block communicates with the MAC address filtering table, which stores the MAC address and a series of network filtering conditions of each terminal, and the MAC address filtering table. In the case of transmission, the MAC address recorded in the corresponding network frame and the port information connected to the specific terminal are learned, and the MAC address filtering table is searched to determine whether or not the MAC address exists, and if the MAC address exists. In accordance with the network filtering condition corresponding to the MAC address, the specific terminal selectively serves to belong to a normal VLAN or a null VLAN.

In the present invention, as described above, by changing the network traffic control method for an arbitrary terminal from a conventional port control method to a method in which the terminal is selectively belonged to a normal VLAN or a null VLAN, terminal disconnection on the network. Allows the process to be done independently of the port.

If such a base environment is established, the control block is a terminal having a "several filtering condition" even if a terminal having a "connection condition" as well as a terminal having a "connection condition" are connected together. Bay can be selectively excluded from the network regardless of the terminal having the "connection condition".

Hereinafter, a network traffic control system and a network traffic control method using the same according to the present invention will be described in detail with reference to the accompanying drawings.

As shown in FIG. 2, the network traffic control system 100 according to the present invention is largely composed of a combination of a switch block 30 and a control block 20. In this case, the switch block 30 serves to switch a network frame transmitted from arbitrary terminals 50, and the control block 20 controls the switching state of the switch block 30 in software. Play a role.

At this time, as shown in the figure, the switch block 30 has a normal VLAN to which a series of forwarding areas are allocated, for example, VLAN 1 31 and VLAN 2 32, and an abnormal state in which such forwarding areas are not assigned. It consists of a combination of null VLANs 33. In this case, the transfer area is constituted by a combination of the ports 40, and the ports 40 form a close connection with the terminals 50 mentioned above.

As such, a normal VLAN, that is, VLAN 1 31 and VLAN 2 32, possesses a set of forwarding zones consisting of ports 40, and thus belong to this VLAN 1 31 and VLAN 2 32. The terminals 50 can easily form a smooth networking relationship with each other, but since the null VLAN 33 does not have a series of forwarding regions composed of ports at all, it belongs to this null VLAN 33. The terminals 50 may not form any networking relationship with each other.

On the other hand, the control block 20 for controlling the switch block 30 is a MAC address filtering table 21 for storing the MAC address of each terminal 50 and the network filtering conditions of each terminal 50, and this MAC While continuously communicating with the address filtering table 21, a combination of affiliation control module 22 for precisely controlling the network traffic of each terminal 50. In this case, the contents described in the MAC address filtering table 21 are set by, for example, the computing operation of the network administrator who manages the overall network state.

At this time, the belonging control module 22, when a network frame is transmitted from a specific terminal, for example, the terminal C (53) of the above-mentioned terminal, the MAC address recorded in the corresponding network frame and the port to which the terminal C (53) is connected Information, for example, the port information of the port 7 (43), the MAC address filtering table 21 is searched and the MAC address of the terminal C (53) is present in the MAC address filtering table (21). It quickly plays a role in judging whether or not it is.

Here, if the MAC address of the terminal C (53) is present, the belonging control module 22, the terminal C (53) according to the network filtering conditions, VLAN 1 (31), VLAN 2 (32) or null VLAN Perform the process of selectively belonging to (33).

Hereinafter, a network traffic control method using the network traffic control system 100 of the present invention having the above-described configuration will be described in detail.

As shown in FIG. 3, first, the network manager initially learns a switch block through a series of computational operations using the control block 20, thereby providing a normal VLAN, that is, VLAN 1 31, in the switch block 30. The VLAN 2 32 and the null VLAN 33 corresponding thereto are initially set (step S1).

Subsequently, the belonging control module 22 of the control block 20 determines whether a series of network frames have been received from any terminal 50 connected to the port 40 of the switch block 30 (step S2). .

At this time, if a series of network frames are not received from any terminal 50, the belonging control module 22 advances the flow to step S3 to maintain a series of standby states.

However, if a series of network frames have been received from any terminal 50, the belonging control module 22 may include the MAC address recorded in the corresponding network frame and information of the port 40 to which the arbitrary terminal 50 is connected, for example. In addition, the process of learning the information of the port 1 (41) and the port 4 (42) is carried out, and based on the learning result, the process of searching the MAC address filtering table 21 is performed (step S4).

This search process is performed by, for example, hashing search technology so that the search time can be minimized.

Subsequently, the belonging control module 22 determines whether or not the MAC address received from any terminal 50 exists in the above-mentioned MAC address filtering table 21 based on the result obtained in the above-described search process ( Step S5).

At this time, if it is determined that the MAC address received from any terminal 50 does not exist in the previous MAC address filtering table 21, the belonging control module 22 proceeds to step S8 to describe the flow later.

However, it is determined that any terminal 50 is, for example, terminal A 51, and the MAC address received from this terminal A 51 is MAC A, so that the corresponding MAC address exists in the MAC address filtering table 21. If so, the belonging control module 22 determines whether the network filtering condition corresponding to MAC A is a disconnection filtering condition (step S6).

Of course, this step S6 is that any terminal is, for example, the terminal B 52, the MAC address received from the terminal B 52 is MAC B, so that the MAC address exists in the MAC address filtering table 21. If it is determined that the same proceeds, any terminal is, for example, terminal C (53), the MAC address received from the terminal C (53) is MAC C, so that the MAC address in the MAC address filtering table 21 The same proceeds even when it is determined to exist, and any terminal is, for example, terminal X 54, and the MAC address received from the terminal X 54 is MAC X, so that the MAC address is a MAC address filtering table ( The same goes for the case where it is determined to exist in 21).

At this time, in step S6 described above, any terminal is, for example, terminal C 53, and the network filtering condition corresponding to the MAC address received from the terminal C 53 is " FILTER " If so, the belonging control module 22 immediately attaches the terminal C 53 to the null VLAN 33 mentioned above.

As described above, since the null VLAN 33 does not have a series of forwarding regions composed of ports 40 at all, all terminals 50 belonging to the null VLAN 33 are in a total networking relationship. As a result, the terminal C 53 belonging to the null VLAN 33 is completely disconnected from the overall networking relationship.

Here, as shown in FIG. 2, the terminal X 54 shares one same port, that is, port 7 43, with the terminal C 53. If implemented through a traffic control method such as the port control method of, the terminal X (54) with the terminal C (53) will be forced to suffer the problem of being completely disconnected in the overall networking relationship.

However, in the case of the present invention, as described above, in the conventional " port control method " for the network traffic control method for the arbitrary terminal 50, the terminal 50 is connected to the normal VLANs 31 and 32 or null. By selectively changing to belonging to the VLAN 33 to induce the terminal disconnection process on the network to proceed independently of the port 40, if the present invention is achieved, the control block 20 is Even if a terminal having a "disconnection filtering condition" and a terminal having a "connection condition" are connected together in any one port, only the terminal having the "disconnection filtering condition" may be selectively excluded from the network.

That is, when the present invention is implemented, even if the terminal C 53 having the " disruption filtering condition " and the terminal X 54 having the " connection condition " are connected together to port 7, the control block is the terminal X 54. Irrespective of), only terminal C 53 can be selectively excluded from the network.

On the other hand, in the above-described step S6, any terminal is, for example, the terminal A 51 or the terminal B 52, the network filtering condition corresponding to the MAC address received from the terminal A 51 or the terminal B 52 If it is determined that "PASS" means "connection condition", the belonging control module immediately attaches the terminal A 51 or the terminal B 52 to a normal VLAN, for example, VLAN 1 31.

As described above, since VLAN 1 31 has a series of forwarding areas composed of ports, that is, port 1, port 2, port 3, port 4, and the like, the terminal belonging to this VLAN 1 31. The A 51 or the terminal B 52 can stably form a smooth networking relationship.

Then, the belonging control module 22 of the present invention, each time a series of network frame transmission event is generated from each of the above-described terminals, each of the above-mentioned through a close connection process with the switch block 30 By repeating the process continuously, certain terminals placed in the "disruption filtering condition" are selectively excluded from the network.

As described in detail above, in the present invention, the network traffic control method for an arbitrary terminal is changed from a conventional "port control method" to a method in which the terminal is selectively belonged to a normal VLAN or a null VLAN. The terminal disconnection process can be independently performed without any association with the port.

If such a base environment is established, the control block may include only the terminal having the "disconnect filtering condition" even if the terminal having the "disconnect filtering condition" and the terminal having the "connection condition" are connected together. Regardless of the terminal having the "connection condition", it can be selectively excluded from the network.

While specific embodiments of the invention have been described and illustrated above, it will be apparent that the invention may be embodied in various modifications by those skilled in the art.

Such modified embodiments should not be understood individually from the technical spirit or point of view of the present invention and such modified embodiments should fall within the scope of the appended claims of the present invention.

Claims (4)

It includes a switch block for switching the network frame sent from any terminal and a control block for controlling the switching state of the switch block, The switch block includes: a normal virtual local area network (VLAN) to which a series of broadcast domains composed of a combination of ports connected to the terminals is allocated; The propagation zone comprises an unassigned null VLAN, The control block includes a MAC address filtering table storing a media access control address (MAC) address and a series of network filtering conditions of the respective terminals; In communication with the MAC address filtering table, when a network frame is transmitted from a specific terminal among the terminals, the MAC address recorded in the network frame and port information to which the specific terminal is connected are learned, and the MAC address filtering is performed. Search the table to determine whether the MAC address exists, and if the MAC address exists, selectively selecting the specific terminal in the normal VLAN or the null VLAN according to a network filtering condition corresponding to the MAC address. And a belonging control module for assigning. Initial setting a series of normal VLANs and null VLANs in the switch block; Determining whether a network frame has been received from an arbitrary terminal; When the network frame is received from the arbitrary terminal, learning the MAC address recorded in the corresponding network frame and port information to which the arbitrary terminal is connected, and determining whether the MAC address exists; Determining whether the network filtering condition corresponding to the MAC address is a disconnection filtering condition when the MAC address exists; And if the network filtering condition is a disconnection filtering condition, assigning the arbitrary terminal to a null VLAN. 3. The method of claim 2, wherein if the MAC address does not exist, the step of assigning any terminal to a normal VLAN is further performed. The method of claim 2, wherein if the network filtering condition is not a disconnection filtering condition, the step of attaching the terminal to the normal VLAN is further performed.