JP2003092601A - Filter processing method and its apparatus - Google Patents

Abstract

PROBLEM TO BE SOLVED: To update filter condition without stopping the filter processing with respect to revision of the respective conditions. SOLUTION: An update filter generating program section 14 calculates a dummy condition to store it to an update filter section 15 in response to a condition revision request by a user 3 and applies switch control to a switch 17 to connect the update filter section 15 and a routing engine section 16, the filter processing apparatus 11 implements the filter processing according to the dummy condition for the revision period, and after the revision of the condition in an ordinary filter section 13, the switch 17 connects the ordinary filter section 13 and the routing engine section 16 and the filter processing apparatus 11 continues the filter processing according to the revised condition.

Description

Detailed Description of the Invention

[0001]

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to a filter processing method and apparatus for performing filter processing, which is a selection procedure for selecting a predetermined element according to preset conditions.

[0002]

2. Description of the Related Art In a conventional filter processing method, a filter processing condition is set in advance, and when an element is input, it is determined whether or not the element meets this condition.
Some have filtered the element to include if it does, or not if it does.

For example, as in the system configuration shown in FIG. 4, a filter processing function is provided to a router 10 or the like which is provided between an external wide area network such as WAN 1 and a regional network such as LAN 2 and which relays packet configuration data. There is something to provide. In this case, the IP address in the packet is used as an element, and the IP address for which relay is permitted is used as a condition for the selection procedure for filtering. Here, when a packet is taken into the router 10 from one of the networks, the router 10 sends this packet if the IP address of the taken packet matches the condition of the IP address for which relay is permitted. When relaying to the other network and not compatible,
I was dropping this packet.

For such filter processing, for example, a permit for extracting an element specified by a condition
Deny (d) that discards the filter and the element specified in the condition
ny) A plurality of filters are provided to set conditions hierarchically. Then, a new PC 2 is added to a personal computer (hereinafter, referred to as “PC”) 20 that constructs the LAN 2.
When 1 is added and the number of IP addresses permitted to relay increases, the filtering process is performed by newly adding or changing the condition to be set.

[0005]

However, in the above conventional example, when adding or changing this condition, the entire filter processing function must be stopped. In such a case, all the filtering functions are once stopped and all the packets are relayed or all the packets cannot be relayed.

Therefore, according to the conventional method, when the addition or change is complicated in this state and the conditioning takes a long time, unnecessary packets are selected and relayed in the meantime, or vice versa. There is a problem that no packets can be relayed without being selected.

The present invention has been made in view of the above problems, and provides a filter processing method and apparatus capable of updating a condition without stopping the function of the filter processing for each change of the condition. The purpose is to provide.

[0008]

To achieve the above object, in the present invention, in a filter processing method for performing a selection procedure for selecting a predetermined element according to a preset condition, before changing the condition, At least one of a saving step of saving at least one set condition, a calculating step of calculating a condition to be followed by the selection procedure during the change period in response to the change request, and at least one of the saved conditions. A change step of changing one condition, and during the change period, a selection procedure of selecting the predetermined elements according to the calculated condition is performed, and when the condition is changed, the change condition is changed according to the changed condition. And a performing step of performing a selection procedure for selecting the predetermined elements.

According to the present invention, when a condition change request is made, a dummy condition is calculated, and during the change period, a selection procedure for selecting a predetermined element according to the dummy condition is performed to change the condition. Then, by switching from the dummy condition to this changed condition and performing a selection procedure that selects predetermined elements according to the changed condition, the filtering process function is not stopped for each condition change. In addition, it is possible to update the conditions.

According to a second aspect of the present invention, in the above invention, the calculation step calculates a condition for performing the selection procedure based on the stored condition.

According to the present invention, the dummy condition is calculated based on the stored condition and the filtering process is performed during the changing period, so that the filtering process function can be executed even when the condition is changed. Becomes

According to a third aspect of the present invention, in the above invention, at least one of discarding an element conforming to the condition or extracting an element conforming to the condition is executed in the executing step. To do.

According to the present invention, in the filter processing function, the deny filter processing, which is the disposal of the elements that meet the conditions, and the permi, which extracts the elements that meet the conditions, are performed.
By performing at least one of the t-filter processes, hierarchical conditioning is possible.

According to a fourth aspect of the present invention, in a filter processing device which performs a selection procedure for selecting a predetermined element according to a preset condition, the set at least one condition is stored before the condition is changed. First storing means for creating, and a creating means for creating a condition to be followed by the selection procedure during the change period when the change request is input;
At least one of the second storage means for storing the created condition and the condition stored in the first storage means
Changing means for changing one condition, and the first or second
Execution means for performing a selection procedure for selecting the predetermined elements according to the conditions stored in the storage means, and when the creating means creates a condition, the second storage means and the executing means are connected to each other, and When the condition is changed by the changing unit, there is provided a filter processing device including a connecting unit that connects the first storing unit and the executing unit.

According to the present invention, in response to the input of the change request, a dummy condition for performing the filtering process during the change period is created, and the dummy condition is saved in the second saving means. The executing means selects and discards the predetermined elements according to the stored dummy conditions, and when the creating means creates the conditions, the executing means selects and discards the predetermined elements according to the created conditions, thereby It is possible to update the condition without stopping the function of the filtering process for the change.

According to a fifth aspect of the present invention, in the above invention, the creating means calculates a condition for performing the selection procedure based on the condition stored in the first storing device, and the second creating process is performed. It is characterized in that it is stored in a storage means.

According to the present invention, the dummy condition is calculated according to the condition stored in the first storing means and the filtering process is performed during the changing period, so that the function of the filtering process is executed even when the condition is changed. It becomes possible.

According to a sixth aspect of the present invention, in the above invention, the execution means discards or disposes of an element conforming to a condition stored in the first or second storage means connected by the connection means. It is characterized in that at least one of the extraction of elements that meet the conditions is executed.

According to the present invention, the deny filter processing, which is the discarding of the elements that meet the conditions, stored in the first or second storage means, and the permit filter processing, which extracts the elements that meet the conditions, are executed. This allows hierarchical conditioning.

[0020]

BEST MODE FOR CARRYING OUT THE INVENTION Preferred embodiments of a filter processing method and apparatus according to the present invention will be described below with reference to the accompanying drawings.

FIG. 1 is a block diagram showing the structure of a filter processing apparatus according to the present invention. In the figure, a filter processing device 11 includes a normal filter update interface unit (hereinafter, referred to as “interface unit”) 12 that captures information input by a user 3, and a normal filter unit 13 that saves a condition set by the user 3. And an update filter creation program section (hereinafter referred to as “program section”) 14 that creates a condition (hereinafter referred to as “dummy condition”) that the filter process should follow during the change period, and an update that saves the created dummy condition. The filter unit 15, the routing engine unit 16 connected to the normal filter unit 13 or the update filter unit 15, the normal filter unit 13 or the update filter unit 15, and the routing engine unit 16
It is composed of a switch 17 for switching connection with.

The user 3 uses an information input device (not shown) to output to the interface section 12 information such as a change request signal and a switch change request signal for requesting setting or changing of conditions for filter processing. In addition, the setting of the above-mentioned conditions is, in this embodiment, for example, setting for selecting an IP address for executing the deny filter process or the permit filter process.

The interface section 12 is usually connected to the filter section 13 and the program section 14. Then, the interface unit 12 notifies the program unit 14 of the change request and the switch change request signal input, and the input of the condition setting to the normal filter unit 13 for the condition setting input. Perform write operation.

The normal filter unit 13 performs filter processing by the permit filter and the deny filter set by the user 3, and stores and saves conditions for performing this filter processing. As shown in FIG. 2, for example, elements 1 to 4 are set in this saved content, and a permit filter and a deny filter are designated (registered) for these elements 1 to 4 (see FIG. ), (B)). In this example, elements 1-4
Is the IP address of the packet for which data relay is permitted between the networks.

In this embodiment, the normal filter unit 13 is
First, the permit filter process is performed, then the deny filter process is performed, and the elements that are not registered in either the permit filter or the deny filter are extracted,
The element extracted by the permit filter (element 1 in this embodiment) is not discarded even if specified by the deny filter.

With this setting, the information of the elements 1 and 4 is extracted and output from the normal filter unit 13. Note that FIG. 2 is a schematic diagram schematically showing the stored contents of the normal filter unit 13 and the update filter unit 15 in order to explain the stored contents.

The contents stored in the normal filter unit 13 can be updated by a writing process from the interface unit 12. In this writing process, the interface unit 12 can specify the user by setting a password or the like, and based on the recognition of the password input by the user 3, writing or rewriting the condition to the specific user. Change of the above shall be permitted.

The program section 14 is connected to the interface section 12, the normal filter section 13, and the update filter section 15, and controls the switching of the switch 17. The program unit 14 is the interface unit 1.
In accordance with the change request input from 2, the normal filter unit 13
The stored conditions are read, the dummy conditions are calculated and created based on the conditions, and the dummy conditions are written in the update filter unit 15.

That is, as shown in FIG. 2, the program section 14 calculates the conditions to be followed by the update filter during the change period from the contents read from the normal filter section 13 (elements 1 and 4 in this embodiment). , Its contents are written in the update filter unit 15. In this embodiment, as shown in FIG.
Since the setting contents of the permit filter and the deny filter shown in (b) are equivalent to the setting contents of the update filter unit 15 shown in FIG. 2C, the program unit 14 sets the dummy condition in the update filter unit 15. Remember and save.

In this case, the processing function of the update filter unit 15 is similar to that of the deny filter,
From the update filter unit 15, the elements 2 and 3 are discarded, and the information of the elements 1 and 4 is extracted and output. Also, the processing function of the update filter can be configured by the processing function of the permit filter, and in this case, it suffices to specify the elements 1 and 4 and set such information to be extracted.

Further, the program section 14 uses the switch 1
7 is performed, and the normal filter unit 13 and the routing engine unit 16 are normally connected, and the switch 17 is switched so that the update filter unit 15 and the routing engine unit 16 are connected when conditions are changed. Is going.

The routing engine unit 16 is connected to the normal filter unit 13 or the update filter unit 15 via the switch 17, and is also connected to the network transmission / reception module unit 4. The routing engine unit 16 is connected to the filter units 13 and 1 via the switch 17.
The information of the element extracted from 5 is input, and this information is compared with the element from the network transmission / reception module unit 4 (the IP address of the received packet in this embodiment), and the relay transfer of this packet is permitted. I am deciding whether or not to do it.

Next, referring to the flow chart of FIG.
The operation of the filter processing device shown in FIG. In the figure, first, the normal filter update interface unit 12 determines whether or not a signal indicating a request for changing the filter condition is input from the user 3 (step 10).
1).

Here, when the change request signal is input, the interface section 12 notifies the update filter creation program section 14 that the condition change request has been issued. As shown, the information of the elements 1 and 4 is read from the normal filter unit 13 and a dummy condition to be followed by the update filter unit 15 during the change period is created based on this information (step 102). Then, the program unit 14 writes the created dummy condition in the update filter unit 15, controls the switch 17 to switch from the normal filter unit 13 to the update filter unit 15, and controls the update filter unit 15 and the routing engine unit 16.
And are connected (step 103).

As a result, in the relay process during the change period,
The dummy condition (in this embodiment, the information of the elements 1 and 4 which permits data relay, that is, the IP address) is extracted from the update filter unit 15 and read out to the routing engine unit 16. The routing engine unit 16 can determine whether or not to permit the relay of the packet by comparing the element (IP address) in the packet output from the network transmission / reception module unit 4 with this dummy condition.

The program section 14 also includes a switch 17
When the switching of is completed, the interface unit 12 is notified of the completion of switching. The interface unit 12 is
Upon receiving this notification, the user 3 is notified of the permission to update the normal filter unit 13 (step 104). User 3
This notification is given, for example, by displaying it on a display not shown. This display allows the user 3 to recognize the completion of switching of the switch and change the conditions stored in the normal filter unit 13 using the information input device.

That is, the user 3 is, for example, permi
It is assumed that the setting of the t filter is changed to the designation of the element 2 as shown in FIG. In this embodiment, d
The setting of the ny filter is not changed as shown in FIG. 2 (e), but it is of course possible to change it.

The interface unit 12 judges whether or not the user 3 has completed the update input of the normal filter unit 13 (step 105), which is, for example, the switch switching request from the user 3 or the input of the signal indicating the update completion. It is judged by the following. The interface unit 12 is
When this signal is input, a signal indicating a switch change request is output to the program unit 14, and the program unit 1
When the switching request is input, the switching control unit 4 controls switching of the switch 17 from the update filter unit 15 to the normal filter unit 13, and connects the normal filter unit 13 and the routing engine unit 16 (step 106).

As a result, in the relay processing after the change, the stored condition (in this embodiment, the information of the elements 2 and 4 which permit data relay, that is, the IP address) is extracted, It is read by the routing engine unit 16. Routing engine section 1
The element 6 can determine whether or not to permit the relay of the packet by comparing the element (IP address) in the packet output from the network transmission / reception module unit 4 with this dummy condition. The determination result will be returned to the network transmission / reception module unit 4.

As described above, in this embodiment, when a condition for filter processing such as addition of a new element or deletion of an existing element is changed, a dummy condition to be followed by the filter before change is created. During the change period, filter processing is performed to select elements according to this dummy condition, and when the condition in the normal filter part is changed, the condition that the filter should follow is switched to this changed condition and this filter process Since it executes, the condition can be updated without stopping the filtering function for the condition change, and the routing engine part can continue the routing process regardless of whether the condition is changed. it can.

In this embodiment, the case of changing the condition for selecting an element in the routing process, that is, the IP address has been described, but the present invention is not limited to this, and a predetermined element is selected according to a certain condition. It can be applied to any filtering process. For example, the present invention can be applied to a case of filtering an identifier (virtual path identifier or virtual channel identifier) in ATM (asynchronous transfer mode), and further to a filtering process when reading an ID (identification) card or the like. Is.

In this embodiment, the dummy condition is calculated based on the condition stored in the normal filter unit. However, the present invention is not limited to this. For example, the condition in the normal filter unit is copied as it is and the dummy condition is calculated. Or a part of this condition may be a dummy condition. Furthermore, it is also possible to save a preset new condition as a dummy condition in the update filter unit.

The present invention is not limited to these embodiments, and various modifications can be made without departing from the gist of the present invention.

[0044]

As described above, according to the present invention, when a request for changing the condition of the filter processing is made, a dummy condition is calculated, the filter processing is performed according to the dummy condition during the changing period, and the condition is changed. Switches from the dummy condition to this changed condition and continues the filter processing, so that the condition can be updated without stopping the function of the filter processing for each change of the condition.

[Brief description of drawings]

FIG. 1 is a configuration diagram showing a configuration of a filter processing device according to the present invention.

FIG. 2 is a schematic diagram schematically showing stored contents of a normal filter unit and an update filter unit shown in FIG.

FIG. 3 is a flowchart for explaining a condition changing operation of the filter processing device shown in FIG.

FIG. 4 is a configuration diagram showing a configuration of a system for explaining conventional filter processing.

[Explanation of symbols]

1 WAN 2 LAN 3 users 4 Network transmission / reception module 10 routers 11 Filter processing device 12 Normal filter update interface 13 Normal filter 14 Update filter creation program section 15 Update filter section 16 Routing engine section 17 switch 20,21 Personal computer

Claims (6)

[Claims] 1. A filter processing method for performing a selection procedure of selecting a predetermined element according to a preset condition, including a saving step of saving the set at least one condition before changing the condition, A calculation step of calculating a condition to be followed by the selection procedure during the change period in response to a change request; a change step of changing at least one condition of the stored conditions; Performing a selection procedure for selecting the predetermined element according to the calculated condition, and performing a selection procedure for selecting the predetermined element according to the changed condition when the condition is changed. A filtering method comprising: 2. The filtering method according to claim 1, wherein in the calculating step, a condition for performing the selection procedure is calculated based on the stored condition. 3. In the execution step, among the discarding of elements that meet the conditions or the extraction of elements that meet the conditions,
The filtering method according to claim 1, wherein at least one is executed. 4. A filter processing device for performing a selection procedure for selecting a predetermined element according to a preset condition, wherein the first storage means stores the set at least one condition before changing the condition. When the change request is input, a creating unit that creates a condition to be followed by the selection procedure during the changing period, a second saving unit that saves the created condition, and a first saving unit Changing means for changing at least one of the saved conditions; executing means for performing a selecting procedure for selecting the predetermined elements according to the conditions saved in the first or second saving means; When the condition is created by the creating unit, the second saving unit and the executing unit are connected, and when the condition is changed by the changing unit, the first saving unit and the A filter processing device comprising: a connecting unit that connects the executing unit. 5. The creating means calculates a condition for performing the selection procedure based on a condition stored in the first storing means and stores the calculated condition in the second storing means. The filter processing device according to claim 4. 6. The executing means discards elements that meet the conditions stored in the first or second storage means connected by the connecting means or extracts elements that meet the conditions. The filtering device according to claim 4, which performs at least one.