KR100451788B1 - Method of L2TP packet fast receive to improve the performance of L2TP network server in virtual private network router - Google Patents

Abstract

The present invention relates to an LNS function improvement of a VPN router, and the L2TP packet fast reception method for improving LNS function of a VPN router according to the present invention includes: receiving a packet at a virtual private network router; Analyzing the tunnel ID and the call ID by analyzing a layer 2 tunnel protocol header in the case of a packet that meets the filtering condition through filtering by transmitting the packet to a switching block; And removing the data except for the layer 2 tunnel protocol payload of the packet and delivering the packet to the virtual serial device driver along with the tunnel ID and the call ID.

According to the present invention, the L2TP packet, which is a data packet and does not perform flow control, is directly transmitted to the virtual serial device driver block through filtering to process the packet, thereby directly passing through the IP block, the UDP block, and the L2TP block. By interpreting the tunnel ID and call ID and passing it to the virtual serial device driver block, it is expected to reduce the packet processing step and reduce the overhead to improve the reception function.

Description

Method of L2TP packet fast receive to improve the performance of L2TP network server in virtual private network router}

The present invention relates to the improvement of the L2TP network server (LNS) function of the VPN router. In particular, the L2TP packet high speed for the LNS function enhancement of the VPN router to maximize the data reception performance by additionally configuring a high speed reception function in the LNS function block. It relates to a receiving method.

A VPN (virtual private network) means that a user who does not have an own information network can directly operate and manage it using a public data communication network as if it is an individual network.

In recent years, Internet VPNs that use the public network of the Internet as virtual private networks have become popular. Internet VPN service can be used as a leased line in the form of connecting the head office and the domestic Internet service provider (ISP) and reconnecting each branch, especially for companies that operate overseas branches.

As a protocol used in the VPN, there is a layer 2 tunneling protocol (L2TP), and a router in the VPN can support the L2TP protocol.

In addition, the functions of the VPN router can be divided into L2TP access concentrator (LAC) and L2TP network server (LNS), and LAC can use only L2TP as a network access server connected to a public telephone network.

In addition, LNS can operate as a router connected to a local-area network (LAN) or wide-area-network (WAN), such as a public network or a private frame relay, and has a server side of L2TP and a platform for terminating PPP sessions. It should be operated.

In such a VPN router the invention relates in particular to the LNS function.

1 is a block diagram showing the configuration of the LNS function of a conventional VPN router.

Referring to FIG. 1, the VPN router 30 receiving L2TP data transmitted from the counterpart terminal 10 through the Internet network 20 and transmitting the received L2TP data to the terminal 40 connected to the LAN network is connected to a WAN port to transmit data. Receives the WAN block 31 to receive, the LAN block 32 connected to the LAN port, and the data received from the WAN block 31 or the LAN block 32 to the upper part or data transmitted from the upper layer. The link support layer (LSL) block 34 transmitting to the WAN block 31 or the LAN block 32 and the upper block according to the IP header of the packet transmitted from the LSL block 34 are transmitted to the upper block or by routing information. An Internet Protocol (IP) block 35 for transmission over a WAN or a LAN, a UDP block 36 for processing a packet according to a User Datagram Protocol (UDP) header of a packet transmitted from the IP block, and the UDP packet or TCP (Transmission Control Protocol) socket to forward packets Lock 37 and is configured to include an L2TP block 38 to process the L2TP packet.

In addition, the L2TP block 38 is composed of an L2TP transmission module 38-1 and an L2TP core module 38-2, and the WAN block 31 includes a serial device driver (SDD) module 31-1. ) And PPP (Point to Point Protocol) module 31-2.

The L2TP assigns a tunnel ID and a call ID to each user terminal 40 logging in to a private network from a remote location, and defines a session of the corresponding user. The L2TP is authenticated to allow access to the private network for the session opened by the L2TP. Allows PPP connections, which are handled by the PPP server block 33, and the L2TP block 38 and PPP server block 33 are located on different layers, so that a virtual serial device driver block is used to connect them. 39 is connected to the L2TP block 38 and the PPP server block 33.

2 shows a format structure of a packet for each layer of the configuration for the LNS function of the VPN router configured as described above.

FIG. 2 is a diagram illustrating a structure of a packet format for each layer of FIG. 1.

Referring to FIG. 2, a packet received by the PPP module of the WAN block 31 through the WAN port includes a PPP header and a PPP payload. In the LSL block 34, the PPP payload may be configured. It is further divided into an IP header and an IP payload. In the UDP block 36, the IP payload is composed of a UDP header and a UDP payload.

In addition, the UDP payload is composed of an L2TP header and an L2TP payload, and the L2TP payload has a double encryption structure consisting of a PPP header and a PPP payload, which is called tunneling.

In the LNS function of the VPN router configured as described above, a process of receiving L2TP packets and transmitting them to a user of a private network is first performed by receiving data from a WAN port and then a serial device driver (SDD) module of the WAN block 31. When delivered to the PPP module 31-2 through 31-1, the PPP module 31-2 interprets a protocol field of the PPP header to determine whether the corresponding packet is an IP packet. 34) to make the DLC header virtual and forward it.

The LSL block 34 receiving the IP packet looks at the protocol field of the IP header of the packet, and if the packet is a user datagram protocol (UDP) packet, transmits the packet to the UDP block 36 via the IP block 35. In the UDP block 36, the UDP port number of the packet is checked to determine whether the packet is an L2TP packet. If the packet is an L2TP packet, the UDP block 36 transmits the packet to the L2TP block 38 through the socket block 37.

The L2TP block 38 checks whether the packet is a control packet or a data packet using the L2TP header of the packet, and if it is a data packet, checks whether flow control is performed. After checking the call ID, the call ID is passed to the virtual serial driver block 39.

When the virtual serial driver block 39 finds the virtual port through the tunnel ID and the call ID and delivers the packet with the virtual port information to the PPP server block 33, the PPP server block 33 transmits the PPP of the packet. If the received packet is an IP packet through the header, the packet is transmitted to the LSL block 34 again, and the LSL block 34 transmits the packet back to the LAN block 32 for transmission to the destination.

In addition, when the packet is a PPP server block 33, the packet processes itself in the case where the packet is the same as the LCP or IPCP type, and most L2TP packets require flow control except for a special case when the data is data. You will not.

In this case, the flow control refers to adjusting a flow amount of a packet so that packet loss or lockup does not occur due to input of an excess packet exceeding a reception limit when a data packet is transmitted. For example, in the window flow control, the maximum number of packets continuously received is determined according to the buffer size of the receiving side, and the transmitting side controls the number of data packets to be transmitted to be lowered or less before receiving a response. In the switching network, it is to control the packets flowing into the network in order to avoid congestion caused by the speed difference between the transmitting and receiving terminals and the traffic conditions of the switching network.

As described above, the method of processing the L2TP packet received by the VPN router is a data packet or a control packet, which is passed through the LSL block to the LAN block through the IP block, the UDP block, and the L2TP block.

In the case of a data packet, the processing is completed by going through the virtual serial driver block, the PPP server block, or the LAN block. Therefore, it is necessary to go through several steps to receive and process one packet, which may cause overhead. there is a problem.

In particular, since most data packets have only tunnel ID and call ID in the L2TP header and do not have flow control information, it is also not effective to always determine the flow control of the data packet in the L2TP block.

In order to solve the above problems, the present invention determines whether the L2TP packet received from the WAN is a data packet in the LSL block, whether to perform flow control, etc., by analyzing the L2TP header and interpreting the tunnel ID and call ID information. Improve the LNS performance of the VPN router, which can improve the packet reception of the LNS function of the VPN router by reducing the data packet processing step by transmitting the data directly to the virtual serial device driver block to be processed by the PPP server. An object of the present invention is to provide a method for receiving L2TP packets at a high speed.

1 is a block diagram showing the configuration of the LNS function of a conventional VPN router.

FIG. 2 is a diagram illustrating a structure of a packet format for each layer of FIG. 1. FIG.

3 is a block diagram showing the configuration of the LNS function of the VPN router for the L2TP packet high-speed reception for improving the LNS function of the VPN router according to an embodiment of the present invention.

4 is a block diagram showing the configuration of a pipe filter of the VPN router of FIG.

5 is a flowchart illustrating an operation procedure of a L2TP packet high speed reception method for improving LNS function of a VPN router according to an embodiment of the present invention.

L2TP packet high speed reception method for improving LNS performance of a VPN router according to the present invention,

Receiving a packet at a virtual private network router;

Analyzing the tunnel ID and the call ID by analyzing a layer 2 tunnel protocol header in the case of a packet that meets the filtering condition through filtering by transmitting the packet to a switching block;

And removing the data except for the layer 2 tunnel protocol payload of the packet and delivering the packet to the virtual serial device driver along with the tunnel ID and the call ID.

Preferably, the filtering condition is

A Layer 2 tunnel protocol network server function is operated in the VPN router, the received packet is an Internet protocol packet, and the Internet protocol payload of the packet is a Layer 2 tunnel protocol packet;

The packet is a data packet, and flow control should not be applied.

The L2TP packet high speed reception method for improving LNS performance of a VPN router according to the present invention configured as described above will be described with reference to the accompanying drawings.

3 is a block diagram showing the configuration of the LNS function of the VPN router for the L2TP packet high-speed reception for improving the LNS function of the VPN router according to an embodiment of the present invention.

Referring to FIG. 3, the functional block for the LNS function of the VPN router 100 according to an embodiment of the present invention includes a WAN block 110 connected to a WAN port and receiving data, and a LAN block connected to a LAN port. 120 and an LSL block that transmits data received from the WAN block 110 or the LAN block 120 to the upper layer or transmits data transmitted from the upper layer to the WAN block 110 or the LAN block 120. 140, an IP block 150 that is transmitted to an upper block according to an IP header of a packet transmitted by the LSL block 140, or transmitted to a WAN or LAN by routing information, and a packet transmitted by the IP block. A UDP block 160 for processing a packet according to a UDP header, a socket block 170 for transmitting the UDP packet or a TCP packet to a higher level, and an L2TP block 180 for processing an L2TP packet are configured.

In addition, a PPP connection is allowed through an authentication for allowing access to a private network for the session opened by the L2TP, which is processed by the PPP server block 130, and the L2TP block 180 and the PPP server block 130 respectively. Since it is located in another layer, the virtual serial device driver block 190 is connected to the L2TP block 180 and the PPP server block 130 so as to connect them. In the LSL block 140, a data packet is directly transmitted among the L2TP packets. And a pipe filter 200 for filtering and transmitting to the virtual serial device driver block 190.

In particular, the configuration in the pipe filter 200 that provides the main function of the present invention will have the configuration as shown in FIG.

4 is a block diagram showing the configuration of the pipe filter of the VPN router of FIG.

Referring to FIG. 4, when the packet is delivered to the LSL block 140, the L2TP header is a tunnel of the L2TP header when the packet is an L2TP packet, a data packet, and flow control is not required by the filtering algorithm 210 of the pipe filter 200. A pipe, which is a kind of passage that connects the tunnel ID and call ID information to the virtual serial device driver block 190, with the L2TP payload removing the IP header, UDP header, and L2TP header of the received packet by interpreting the ID and call ID. Through the transmission, the transmitted packet is processed by the pipe API 191 of the virtual serial device driver block 190 to find a virtual port corresponding to the tunnel ID and the call ID and transmit it to the PPP server for processing.

The filtering algorithm 210 of the pipe filter 200 will be described in more detail with reference to FIG. 5.

5 is a flowchart illustrating an operation procedure of a L2TP packet high speed reception method for improving LNS function of a VPN router according to an embodiment of the present invention.

Referring to FIG. 5, when a packet arrives at the LSL block 140 (S101), it is determined whether the VPN router 100 can perform an LNS function (S102).

If it is possible to perform the LNS function, the pipe filter 200 first receives a packet to check whether the packet is an IP packet (S103), and if the received packet is an IP packet, checks whether the IP payload is a UDP packet. (S104), it is checked whether or not the L2TP packet is present (S105).

It is possible to check whether the packet is an IP packet by checking whether the Ethertype field of the DLC header is '0x0800' in the packet format of the LSL block, and distinguishing whether the packet is a UDP packet is '0x11'. This can be done by checking whether the current packet is an L2TP packet or not by checking whether the destination port of the UDP header is '1701'.

If the above condition is satisfied, it is checked whether the L2TP packet is a data packet or a control packet (S106). This indicates that the L2TP packet is a data packet if the type field is '0' and is a control packet if '1'.

In addition, if the packet is a data packet, it is checked whether the sequence field value of the L2TP header is '0', which determines whether flow control is applied to the data packet (S107).

When all of the above filtering conditions are satisfied, after analyzing the L2TP header of the received packet to analyze the tunnel ID and the call ID (S108), the IP header, the UDP header, and the L2TP header are removed (S109). Along with the tunnel ID and the call ID, it passes the pipe API 191 of the virtual serial device driver 190 to process the packet.

If at least one of the conditions is not satisfied in the filtering algorithm 210, the same process as the existing packet processing is performed, and the IP block, the UDP block, and the L2TP block are processed.

Through the above filtering process, L2TP packet, data packet, and flow control do not go through IP block, UDP block and L2TP block, and analyze tunnel ID and call ID directly to the virtual serial device driver block. By transmitting, the received packet can be processed more quickly.

As described above, in the L2TP packet high speed reception method for improving LNS function of the VPN router according to the present invention, a packet is a L2TP packet, a data packet, and does not perform flow control by previously inspecting a received packet through a filtering algorithm. Can be filtered and the tunnel ID and call ID are interpreted and passed to the virtual serial device driver block without going through the IP block, UDP block, and L2TP block, thereby reducing the packet processing step and reducing the overhead to improve the reception function. It has an effect.

Claims (2)

In the virtual private network router, Receiving a packet through an internet network; Determining, by the router, a Layer 2 Tunneling Protocol (L2TP) network server (LNS) function; When operating as the L2TP network server function, if it is determined that the packet is an L2TP packet, a data packet, and does not perform flow control through the filtering by transmitting the received packet to a switching block, an L2TP header Analyzing the tunnel ID and the call ID by analyzing the ID ; Removing the data except for the L2TP payload of the interpreted packet and forwarding the packet to the virtual serial device driver together with the interpreted tunnel ID and call ID to process the packet. High speed L2TP packet reception for LNS enhancement. The method of claim 1, wherein the filtering condition is Checking whether the packet received by the router is an Internet Protocol (IP) packet, and if the result is an IP packet, confirming whether the IP payload is a User Datagram Protocol (UDP) packet; Confirming whether the corresponding packet is an L2TP packet when the UDP packet is determined as the result; And determining that the L2TP packet is a data packet and does not apply flow control, and then filtering the packet that is a data packet and does not apply flow control as a result of the determination . L2TP packet high speed reception method.