JP2004032453A - Packet communication system, packet transfer device and packet transfer control program used therein - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To increase a packet transfer efficiency and a service quality by minimizing a packet loss and congestion. <P>SOLUTION: A packet transfer device RT monitors a traffic at a point where packets belonging to networks NWa, NWb having different communication protocols flow into an identical session, and to perform priority control over packet redirection transfer based on the monitored result. At this time, if the device detects a congestion, then a congestion response server RSV sends a congestion message to a transmission originator to inform of the congestion. The packet transfer device RT performs packet return transfer for direct communication between client terminals TMa, TMb. The device also collects a communication log from the transferred packet and stores it to thereby perform charging over a specific redirection. The device also performs address converting in order to solve routing in a network as a redirection destination. <P>COPYRIGHT: (C)2004,JPO

Description

[0001]
TECHNICAL FIELD OF THE INVENTION
The present invention relates to a packet communication system for performing packet communication between a plurality of communication devices having different communication systems and a packet transfer device used in the system. The present invention relates to a packet communication system having a function of reconstructing and transferring a packet format corresponding to a communication method of a device, a packet transfer device thereof, and a packet transfer control program used in the packet transfer device.
[0002]
[Prior art]
In a packet communication system accommodating a plurality of communication devices and networks having different communication systems, it is necessary to convert a packet format into a format according to a destination communication system in a process of transferring the packet. For example, communication devices include a device that uses a communication method that requires authentication and a device that uses a communication method that does not require authentication. When packet communication is performed between these devices, a packet format is used. Need to be rebuilt.
[0003]
Therefore, the present inventors have proposed a packet transfer device disclosed in Japanese Patent Application No. 2001-348939. This packet transfer device transmits a packet transmitted from a communication device using a communication method that requires authentication, such as Point-to-Point Protocol (PPP) or Point-to-Point Protocol over Ethernet (PPPoE), to a communication method that does not require authentication. Is converted to a packet that uses the packet and transferred. By using this packet transfer device, it is possible to extract a packet destined for a specific server or service, for example, and to branch the extracted packet to another network that does not require authentication.
[0004]
However, this type of packet transfer apparatus unconditionally performs a process of changing a transfer destination and a protocol stack of a packet and transferring the packet to a network that does not require authentication for all applicable packets. For this reason, when packets arriving from a plurality of networks or packets to be transferred to the plurality of networks are merged in a packet transfer device, packet loss may occur depending on the amount of data. For example, in the system shown in FIG. 9, when packets arriving from the networks NWa and NWb are respectively input to the port Pc and the port Pb of the packet transfer device R, the data amount of these packets is equal to the data amount allowed by the port Pa. If it exceeds, packet loss occurs in the packet transfer device R.
[0005]
Further, the packet transfer apparatus has only a simple service admission control function for congestion. For this reason, even if congestion occurs in the network, the client terminal cannot know this. As a result, the client terminal keeps sending out a packet requesting a service request, and this packet causes further congestion. That is, there is a case where a vicious circle occurs in which congestion causes congestion.
[0006]
Further, the following may be considered as a factor for increasing the congestion. That is, when performing communication between client terminals, the packet transfer apparatus does not consider the network topology positional relationship between these client terminals at all.
For example, as shown in FIG. 9, when communication is performed between client terminals TMa and TMb under the control of the packet transfer device R, the packet transfer device R temporarily transmits the packets of these client terminals TMa and TMb to an Internet service provider. The data is transferred to ISPa and ISPb, and then transferred via Internet IX. For this reason, even when the client terminals TMa and TMb are subscribed to the same provider, it is possible to access the client terminal of the communication partner only after passing through the network NWa and the providers ISPa and ISPb once. This leads to waste of the bandwidth of the network NWa and an increase in bottlenecks.
[0007]
Further, when packets of a communication session acquiring an IP address from an unspecified number of DHCP (Dynamic Host Configuration Protocol) servers are transferred to a network using a communication method that does not require authentication, the system of the IP address is changed. There is a problem in that the routing table becomes enormous because of the differences.
[0008]
For example, as shown in FIG. 10, when a packet of a communication session having an IP address allocated from the DHCP servers DSa to DSc as a source IP address is redirected to the network NWb, a subnet mask of a packet transferred to the network NWb. Fall apart. Therefore, when the number of client terminals TMa, TMb,... Becomes enormous, it is necessary to allocate a route for each communication session established by the client terminals TMa, TMb,. become. In addition, since this huge routing table is updated each time a client terminal TMa, TMb,... Establishes a communication session via the network NWa, an excessive load is imposed on a router installed in the network NWb. .
[0009]
[Problems to be solved by the invention]
As described above, the conventional packet transfer apparatus has only a basic function of converting and transferring a packet format according to a destination communication method. For this reason, packet loss and congestion are likely to occur, which causes a reduction in packet transfer efficiency and a deterioration in service quality, which is not preferable.
[0010]
The present invention has been made in view of the above circumstances, and its purpose is to reduce packet loss and congestion, thereby improving packet transfer efficiency and service quality. An object of the present invention is to provide a packet transfer device and a packet transfer control program used in this system.
[0011]
[Means for Solving the Problems]
In order to achieve the above object, a first invention provides a communication apparatus for transmitting a packet using a first communication protocol including an authentication procedure, a first network using the first communication protocol, and an authentication apparatus. In a packet transfer device connected to a second network using a second communication protocol that does not include a procedure, at a point where a packet sent from the first network and a packet sent from the second network join, The flow of packets transmitted from the second network is changed over from the transfer of packets transmitted from the first network when the flow exceeds a predetermined amount based on the monitoring result. It is controlled to give priority.
[0012]
Therefore, according to the present invention, when a packet from the first network and a packet from the second network are congested in the packet transfer device, the packet from the second network is transferred with priority. For this reason, it is possible to give priority to data transmission from a second network having a function as a content delivery network, for example, thereby transmitting multimedia data that is vulnerable to packet loss, jitter, delay, and the like with high quality. be able to.
[0013]
In order to achieve the above object, a second aspect of the present invention provides a method for transmitting a packet addressed to the communication device transmitted from the second network in a state where a packet is transferred between the communication device and the second network after performing protocol conversion. Is monitored, and based on the monitoring result, when the distribution amount exceeds a predetermined amount, packet transfer from the communication device to the second network is restricted.
[0014]
Therefore, according to the present invention, when congestion occurs while packet transfer is being performed between the communication device and the second network, upstream packet transfer from the communication device to the second network is restricted. . For this reason, a sufficient band in the downlink direction from the second network to the communication device can be ensured, and multimedia data that is vulnerable to packet loss, jitter, delay, and the like can be transmitted with high quality.
[0015]
The packet transfer restricting means includes a means for discarding a packet transferred from the communication device to the second network and a means for transferring a packet transferred from the communication device to the second network to the first network. is there.
[0016]
In order to achieve the above object, a third aspect of the present invention monitors a traffic volume of a packet transmitted from a first network and addressed to a communication device. When the traffic volume exceeds a predetermined amount, the communication device sends a first packet to the first device. When a packet addressed to the network arrives, the transfer destination of the packet is changed from the first network to another communication device prepared in advance, and the other communication device is transmitted to the communication device of the transmission source in a predetermined manner. To be notified.
[0017]
Alternatively, a message notification function is built in the packet transfer device, and when a packet addressed to the first network arrives from the communication device, the packet transfer device generates a notification message including the monitoring result of the distribution amount or the content related thereto. Then, the data is transmitted to the transmission source communication device.
[0018]
Therefore, according to the present invention, when congestion occurs in communication from the first network to the communication device, for example, a message notifying the occurrence of congestion is transmitted to the communication device from the packet transfer device itself or another communication device in place of the packet transfer device. Notified. For this reason, the communication device becomes aware of the occurrence of congestion and can voluntarily limit the transmission of requests, and as a result, further congestion can be avoided.
[0019]
In order to achieve the above object, a fourth invention monitors a traffic volume of a packet transmitted from a second network and addressed to a communication device, and, when the traffic volume exceeds a predetermined amount, transmits a second packet from the communication device. When a packet destined for the network arrives, the transfer destination of the packet is changed from the second network to another communication device prepared in advance, and the other communication device is given a predetermined To be notified.
[0020]
Alternatively, a message notification function is built in the packet transfer device, and when a packet addressed to the second network arrives from the communication device, the packet transfer device generates a notification message including the monitoring result of the distribution amount or the content related thereto. Then, the data is transmitted to the transmission source communication device.
[0021]
Therefore, according to the present invention, when congestion occurs in communication from the second network to the communication device, for example, a message notifying the occurrence of congestion is transmitted to the communication device from the packet transfer device itself or another communication device in place of the packet transfer device. Notified. For this reason, the communication device becomes aware of the occurrence of congestion and can voluntarily limit the transmission of requests, and as a result, further congestion can be avoided.
[0022]
In order to achieve the above object, a fifth invention is directed to a first and a second communication device for transmitting a packet using a first communication protocol including an authentication procedure, the first and second communication devices using the first communication protocol. In a packet transfer apparatus connected to a first network and a second network using a second communication protocol that does not include an authentication procedure, a destination of a packet arriving from the first communication apparatus is a destination of the second communication apparatus. It is determined whether or not there is. If it is determined that the destination of the packet arriving from the first communication device is the second communication device, the packet is subjected to protocol conversion for returning the packet to the second communication device, and the packet is converted. The protocol-converted packet is transmitted to the second communication device.
[0023]
Therefore, according to the present invention, it is possible to directly perform packet communication between a plurality of communication devices under the control of the packet transfer device without passing through the first network. For this reason, the communication traffic of the first network can be reduced to prevent the occurrence of congestion before it occurs, so that the communication quality of another communication session via the first network can be kept high.
[0024]
According to a sixth aspect of the present invention, in a state where communication via a packet transfer device is being performed, a predetermined header information element is read from a packet transmitted from the communication device, and the read header information element is read by the communication device of the transmission source. Is stored as a communication log in association with the communication log.
[0025]
By doing so, it becomes possible to perform charging processing and DRM (copyright management) on the basis of the stored communication log in the packet transfer apparatus. Billing can be performed for direct communication.
[0026]
Furthermore, a seventh invention provides a communication apparatus for transmitting a packet using a first communication protocol including an authentication procedure, a first network using the first communication protocol, and a second network not including an authentication procedure. A packet transfer device connected to a second network using the communication protocol of the first aspect includes a first address translation unit and a second address translation unit. Then, when the protocol conversion of the packet addressed to the second network sent from the communication device is performed and the packet is transferred to the second network, the source address of the packet is set to a preset address by the first address conversion means. Convert. Further, when a packet destined for a communication device sent from the second network is protocol-converted and transferred to the corresponding communication device, the destination address of the packet is changed by the second address conversion device to the first address conversion device. Is converted to the source address of the communication device before the conversion.
[0027]
Therefore, according to the present invention, even when a communication session packet whose IP address is obtained from an unspecified number of DHCP servers is transferred to the second network that does not require authentication, the packet is transferred to the second network. The subnet mask of the packet can be unified. Therefore, even when a large number of routes need to be allocated for each communication session due to an increase in the number of client terminals, it is possible to suppress an increase in the size of the routing table in the second network and to reduce the processing load on the router. be able to. That is, the packet transfer operation in the second network can be performed more smoothly by the address translation transfer, thereby making it possible to improve the communication quality.
[0028]
BEST MODE FOR CARRYING OUT THE INVENTION
(1st Embodiment)
FIG. 1 is a schematic configuration diagram of a packet communication system according to the first embodiment of the present invention. As shown in the figure, the packet communication system is one in which client terminals TMa and TMb and a plurality of networks NWa and NWb are mutually connected via a packet transfer device RT.
[0029]
The client terminals TMa and TMb and the network NWa use Point-to-Point Protocol (PPP) and Point-to-Point Protocol over Ethernet (PPoE) as communication protocols. Both PPP and PPPoE require authentication between sending and receiving. The network NWa is connected to the Internet via the access server ASV. An audio server SVa1, a WEB server SVa2, and a video server SVa3, which are servers for content services, are connected to the Internet. On the other hand, the network NWb uses IP (Internet Protocol) as a communication protocol, and is connected to the packet transfer device RT via an L4 switch SW. Further, the audio server SVb1, the WEB server SVb2, and the video server SVb3, which are servers for content services, are directly connected to the network NWb.
[0030]
FIG. 2 is a block diagram showing a functional configuration of the packet transfer device RT. As shown in FIG. 1, the packet transfer apparatus RT includes a central processing unit (hereinafter, referred to as a CPU) 10 that executes processing by a program. The program memory 30 and the data memory 40 are connected to the CPU 10 via the bus 20, and a plurality of communication interfaces (communication I / Fs) 51 to 54 are connected to the CPU 10.
[0031]
The communication I / Fs 51 to 54 have ports Pa, Pb, Pc, and Pd, respectively. The client terminals TMa, TMb, the network NWa, the network NWb, and the congestion response server RSV are respectively connected to the ports Pa, Pb, Pc, and Pd. Connected. Under the control of the CPU 10, the communication I / Fs 51 to 54 perform packet transfer processing among the client terminals TMa and TMb, the network NWa, the network NWb, and the congestion response server RSV.
[0032]
The data memory 40 is provided with a redirect table 41 and a communication management information storage area 42. The redirect table 41 stores a session ID of PPPoE detected from a PPPoE header of a packet arriving from the client terminal TMa, TMb or the network NWa, a MAC address of the client terminal, and the like. The stored header information is used to determine whether or not redirection can be performed on a packet arriving thereafter, and to distribute the packet to an appropriate network.
[0033]
The communication management information storage area 42 stores a VLAN ID, a MAC address, and the like read from the header of a packet arriving from the client terminals TMa and TMb as a communication log for each client. This communication log can include accumulated information on the amount of data used for each session of the client terminal, the type of packet, and the like. The type of packet is identified based on the packet type and port number read from the packet. The stored communication log is used for a billing process for a specific redirection.
[0034]
The program memory 30 includes, in addition to a transfer control program for converting a packet format according to a destination communication protocol and transferring the data, a communication amount control program 31 and a PtoP program as new programs for realizing the functions according to the present invention. A communication control program 32, a charging control program 33, and an address conversion transfer control program 34 are stored.
[0035]
First, the transfer control program stores the PPPoE session ID, the MAC address of the client terminal, and the like read by snooping (peeping) the PPPoE header of the packet input from the ports Pa and Pb in the redirection table 41. Remember. Thereafter, based on the information of the stored redirection table, it is determined whether or not redirection of the arriving packet is possible, and the destination of the packet is distributed to an appropriate network. This control function enables the PPPoE client terminals TMa and TMb to communicate with both the network NWa and the network NWb through an authenticated session. In particular, it is possible to receive a service of a real-time application via the network NWb, and thereby enjoy a high-quality service.
[0036]
The communication amount control program 31 monitors the data amount and the number of client terminals of communication performed between the port Pa to which the client terminals TMa and TMb are connected and the ports Pb and Pc to which the networks NWa and NWb are connected. Check whether packet data is flowing beyond the prescribed capacity. Then, based on the result, the traffic between the port Pa and the ports Pb and Pc is controlled in real time. The counting of the number of client terminals is performed based on the IP addresses and MAC addresses allocated to the client terminals TMa and TMb.
[0037]
The traffic control program 31 receives packets to be transferred from the client terminals TMa and TMb to the ports Pb and Pc where the congestion has occurred, in a state where congestion is detected at the ports Pb and Pc to which the networks NWa and NWb are connected. In this case, the received packet is redirected to the congestion response server RSV. Further, in response to this, the packet including the congestion notification message generated by the congestion response server RSV is transferred to the client terminals TMa and TMb of the transmission source.
[0038]
When the PtoP communication control program 32 receives a packet destined for the client terminal TMb, TMa from the client terminal TMa, TMb at the port Pa, the client terminal TMa, TMb of the transmission source and destination completes the authentication for this packet. It is checked whether the packet has been transmitted or whether the packet has been permitted for PtoP transfer. Then, if the packet has been authenticated or the PtoP transfer is permitted, the packet is converted into a protocol and returned at the port Pa.
[0039]
The charging control program 33 reads a VLAN ID, a MAC address, and the like from the header of a packet arriving from the client terminals TMa and TMb, and stores the read information in the communication management information storage area 42 of the data memory 40 as a communication log for each client. Let it. This communication log also includes accumulated information on the amount of data used for each session of the client terminal, the type of packet, and the like. Then, based on the stored communication log, a billing process is performed for a specific redirection, for example, a return communication between the client terminals TMa and TMb.
[0040]
The address conversion transfer control program 34 converts a source IP address of a packet input from the port Pa into a preset IP address when transferring a packet arriving from the client terminals TMa and TMb to the network NWb. Recalculate and transfer FCS. Conversely, if the packet packet arriving from the network NWb is a packet of a communication method that does not use authentication and the destination is a preset IP address, the destination IP address of the packet is set to the authenticated communication session. It is converted to the IP address of the destination to which it belongs, and transferred from the port Pa to the client terminals TMa and TMb.
[0041]
Next, a packet transfer control operation by the packet transfer device RT configured as described above will be described.
[0042]
(1) Monitoring congestion and controlling traffic based on the monitoring result
First, congestion in the network NWa is detected as follows. That is, the packet transfer device RT monitors the data amount of communication performed between the port Pa and the port Pb and the number of client terminals. Then, it is checked whether or not data is flowing beyond a prescribed capacity. Similarly, the data amount of communication performed between the port Pa and the port Pc and the number of client terminals are monitored, and it is checked whether or not data is flowing beyond a prescribed capacity. The counting of the number of client terminals can be performed based on the IP address, MAC address, and the like assigned to the client terminal.
[0043]
Next, a packet (port Pb to port Pa) transferred from the network NWa to the client terminals TMa and TMb and a packet (port Pc to port Pa) transferred from the network NWb to the client terminals TMa and TMb A description will be given of the allocation control of the bandwidth and the number of client terminals when congestion occurs in the packet transfer device RT.
[0044]
The packet transfer device RT sets in advance the bandwidth to be allocated or the number of client terminals for each of the packet transferred from the port Pb to the port Pa and the packet transferred from the port Pc to the port Pa. Then, after exceeding the set bandwidth or the number of client terminals, the packet arriving at the port Pa from the port Pb or the port Pa or the port Pa is accumulated in the built-in buffer, and after the buffer capacity is satisfied, the packet is discarded. .
[0045]
Further, when the client terminal permitted to perform redirection does not perform communication for a certain period of time, the packet transfer apparatus RT automatically deletes the corresponding client information described in the redirection table 41, thereby freeing up resources for redirection. Has a mechanism to make. Therefore, packet loss, jitter, and delay can be reduced, and the bandwidth of a real-time application distributed via the network NWb can be constantly secured. That is, when a service is provided via the network NWb, high-quality information distribution becomes possible.
[0046]
Next, packets (ports Pc to Pa) transferred from the network NWb to the client terminals TMa and TMb are transferred from the client terminals TMa and TMb to the network NWb when congestion occurs in the packet transfer device RT. The allocation control of the bandwidth of the packet (port Pa to port Pc) and the number of client terminals will be described.
[0047]
The packet transfer device RT presets the band to be allocated or the number of client terminals for the packet transferred from the port Pc to the port Pa. Then, when a packet transmitted from the client terminal to the network NWb is received after exceeding the set bandwidth or the number of client terminals, the packet is forwarded to the port Pb instead of performing redirection to the port Pc. Works as a bridge. This makes it possible to constantly secure the bandwidth of the real-time application being distributed via the network NWb. That is, when a service is provided via the network NWb, high-quality information distribution becomes possible.
[0048]
Next, a traffic control operation when congestion occurs in the network NWa will be described.
It is assumed that congestion has occurred in communication (downlink communication) from each of the servers SVa1, SVa2, and SVa3 connected to the network NWa via the access server ASV toward the client terminals TMa and TMb. Then, the packet transfer device RT restricts the transfer as a bridge in order to prevent the requests from the client terminals TMa and TMb from being transferred to the servers SVa1, SVa2 and SVa3 any more.
[0049]
The packet transfer apparatus RT stores the client terminal performing the transfer as a bridge in the redirect table 41 based on the IP address, the VLAN ID, and the like. If the transfer as a bridge is not performed for a certain period of time, the storage information is deleted from the redirect table 41.
[0050]
It is assumed that a packet to be transferred as a bridge is received from a client terminal in a state where congestion is detected at the port Pb. Then, the packet transfer device RT rewrites the destination of the received packet to the IP address of the congestion response server RSV. Then, the packet is redirected to the port Pd to which the congestion response server RSV is connected. The congestion response server RSV replies the same content regardless of the request to any URL by performing redirection inside the server.
[0051]
FIG. 3 shows an example of a protocol conversion process when a packet is redirected from the port Pa to the port Pd. This example shows a case where an IP packet is converted. First, an IP packet is extracted from the packet. Next, the destination IP address of this IP packet is rewritten to the preset IP address of the congestion response server RSV. Subsequently, a MAC header with a rewritten destination is added to a MAC address set in advance or obtained by ARP (Address Resolution Protocol), and finally, FCS (Frame Check Sequence) is recalculated to construct an Ethernet frame. Then, the constructed Ethernet frame is transmitted from the port Pd to the congestion response server RSV.
[0052]
When an Ethernet frame generated and transmitted by the congestion response server RSV is received by the port Pd in response to the Ethernet frame, the packet transfer device RT performs a redirect on the Ethernet frame as follows. FIG. 4 shows a protocol conversion process related to the redirection from the port Pd to the port Pa.
[0053]
That is, first, an IP packet is extracted from the Ethernet frame input from the port Pd. Next, the source IP address of the extracted IP packet is rewritten to the IP address of the server SVa1, SVa2, SVa3 learned together with the IP address of the client terminal at the time of redirection. Subsequently, a PPPoE header and a PPP header having a PPPoE session ID learned together with the corresponding destination IP address are constructed and attached to the IP packet whose source IP address has been rewritten. Then, a MAC header with the MAC address of the PPP client learned together with the corresponding IP address as the destination address is added, and finally, the recalculated FCS is added. Then, the constructed frame is transmitted from the port Pa to the client terminal.
[0054]
On the other hand, when a packet to be forwarded as a bridge is received from the client terminal in a state where congestion is detected at the port Pb, the packet input from the port Pa is stored in the IP addresses of the destination servers SVa1, SVa2, and SVa3. The port Pd to which the congestion response server RSV is connected can be helicopted while the connection is maintained. In this case, the congestion response server RSV replies the same congestion message to any IP address by performing NAT (address translation) inside the server.
[0055]
FIG. 5 shows an example of a protocol conversion process when a packet is redirected from the port Pa to the port Pd. First, it is determined whether or not the packet received at the port Pa is a packet having a previously stored PPPoE session ID and the destination IP address is a preset IP address. If the packet satisfies these conditions, an IP packet is extracted from the packet. Next, the destination IP address of the IP packet is added to the MAC address which is set in advance or obtained by ARP (address resolution protocol), and a MAC header is added. Finally, the FCS is recalculated to construct an Ethernet frame. . Then, the Ethernet frame is transmitted from the port Pd to the congestion response server RSV.
[0056]
When an Ethernet frame generated and transmitted by the congestion response server RSV is received by the port Pd in response to the Ethernet frame, the packet transfer device RT performs a redirect on the Ethernet frame as follows. FIG. 6 shows another example of the protocol conversion processing related to the redirection from the port Pd to the port Pa.
[0057]
That is, first, an IP packet is extracted from the Ethernet frame input from the port Pd. Next, a PPPoE header and a PPP header having a PPPoE session ID learned together with the corresponding IP address are constructed and attached to the extracted IP packet. Furthermore, a MAC header with the MAC address of the PPP client learned together with the corresponding IP address as the destination address is added, and finally the recalculated FCS is added and output from the port Pa.
[0058]
By performing the above traffic control operation, even if congestion occurs in the network NWa, the congestion response server RSV notifies the transmission source client terminals TMa and TMb of the congestion message. With TMb, the occurrence of congestion can be clearly known, and measures such as stopping transmission of a request can be taken. For this reason, it is possible to avoid further congestion.
[0059]
Next, a traffic control operation when congestion occurs in the network NWb will be described.
It is assumed that congestion has occurred in communication (downlink communication) from each of the servers SVb1, SVb2, and SVb3 connected to the network NWb via the access server ASV toward the client terminals TMa and TMb. Then, the packet transfer device RT restricts the transfer as a bridge in order to prevent the requests from the client terminals TMa and TMb from being transferred to the servers SVb1, SVb2 and SVb3 any more.
[0060]
The packet transfer apparatus RT stores the client terminal performing the transfer as a bridge in the redirect table 41 based on the IP address, the VLAN ID, and the like. If the transfer as a bridge is not performed for a certain period of time, the storage information is deleted from the redirect table 41.
[0061]
It is assumed that a packet to be transferred as a bridge is received from a client terminal in a state where congestion is detected at the port Pc. Then, the packet transfer device RT rewrites the destination of the received packet to the IP address of the congestion response server RSV. Then, the packet is redirected to the port Pd to which the congestion response server RSV is connected. The congestion response server RSV replies the same content regardless of the request to any URL by performing redirection inside the server.
[0062]
FIG. 3 shows an example of a protocol conversion process when a packet is redirected from the port Pa to the port Pd. FIG. 4 shows a protocol conversion process related to redirection from the port Pd to the port Pa.
[0063]
Alternatively, when a packet to be transferred as a bridge is received from a client terminal in a state where congestion is detected at the port Pc, the packet transfer apparatus RT transfers the packet input from the port Pa to the destination servers SVb1 and SVb2. , SVb3 while holding the IP address, the port Pd to which the congestion response server RSV is connected is helicopted. The congestion response server RSV replies the same congestion message to any IP address request by performing NAT (address translation) inside the server.
[0064]
FIG. 5 shows a protocol conversion process when a packet is redirected from the port Pa to the port Pd. It should be noted that the description of FIG. FIG. 6 shows a protocol conversion process regarding the redirection from the port Pd to the port Pa. It should be noted that the description of FIG.
[0065]
By performing the above-described traffic control operation, even if congestion occurs in the network NWb, the congestion response server RSV notifies the transmission source client terminals TMa and TMb of a congestion message. With TMb, the occurrence of congestion can be clearly known, and measures such as stopping transmission of requests can be taken. For this reason, it is possible to avoid further congestion.
[0066]
(2) PtoP communication control operation between client terminals
When receiving the packet addressed to the client terminal TMb from the client terminal TMa, the packet transfer device RT checks whether or not the packet from the client terminal TMa is a packet for which authentication has been completed. If the packet from the client terminal TMa has not been authenticated, the packet from the client terminal TMa is transferred from the port Pa to the port Pb. Alternatively, even if the packet from the client terminal TMa has been authenticated, if the client is not permitted to perform PtoP communication, the packet from the client terminal TMa is transferred from the port Pa to the port Pb. Therefore, at this stage, no direct communication is established between the client terminals.
[0067]
On the other hand, it is assumed that the authentication of the packet from the client terminal TMa has been completed or the PtoP communication has been permitted for the packet from the client terminal TMa. In this case, the packet transfer device RT subsequently checks whether the client terminal TMb, which is the destination of the packet, has completed authentication.
[0068]
The following method is used to check whether or not the packet from the client terminal has been authenticated in the packet transfer device RT. That is, in communication requiring authentication such as PPP or PPPoE, the packet transfer apparatus RT learns an identifier such as a session ID and stores it in the redirect table 41. Therefore, based on the information stored in the redirect table 41, it can be realized by searching whether or not the destination address of the packet corresponds to the authenticated client terminal stored in the table.
[0069]
When it is confirmed that the packet from the client terminal has been authenticated in the packet transfer apparatus RT by the determination of the completion of the authentication, the packet transfer apparatus RT returns the packet from the port Pa to the port Pa and transfers the packet. Perform protocol conversions to FIG. 7 is a diagram showing the processing contents of this protocol conversion.
[0070]
First, an IP packet is extracted from the packet input to the port Pa, and a PPPoE header and a PPP header having a PPPoE session ID learned together with the IP address of the destination client terminal TMb are constructed and attached to the IP packet. Next, the MAC address learned together with the IP address of the client terminal TMb as the destination is added as the destination MAC header, and finally the recalculated FCS is added and transmitted from the port Pa to the client terminal TMb as the destination.
[0071]
Note that an IP address, a VLAN ID, or the like assigned to each client terminal or session can be used to identify a packet that permits PtoP communication and a packet that does not.
[0072]
By performing packet return transfer control in the packet transfer device RT as described above, it is possible to establish packet communication directly between the client terminals TMa and TMb without passing through the upper network NWa or NWb. Therefore, the congestion of the upper networks NWa and NWb can be further reduced, and the quality of communication via the networks NWa and NWb can be kept high.
[0073]
The direct communication control between the client terminals TMa and TMb by the return transfer may be executed when congestion occurs in the network NWa or NWb or when congestion is likely to occur. , And TMb.
[0074]
(3) Communication log collection operation in the packet transfer device RT
When a packet arriving from the client terminals TMa and TMb is received at the port Pa, the packet transfer device RT reads a VLAN ID, a MAC address, and the like from the received packet. Then, the read information is stored in the communication management information storage area 42 as a communication log for each client. The communication log should include the accumulation of the amount of data used for each session of the client terminals TMa and TMb, or determine the type of the packet by reading the port number and the packet type from the packet, and include the type of the packet. Is possible.
[0075]
The packet transfer device RT executes a charging process and a DRM (copyright management) for a specific redirection based on the communication log stored in the communication management information storage area 42. For example, when the video server SVa3 communicates with the client terminal TMa, the video server SVa3 can perform charging processing and DRM (copyright management). However, in the case of the PtoP communication in which the client terminals directly communicate with each other by returning by the packet transfer device RT, charging processing and DRM (copyright management) for the content cannot be performed. Therefore, the redirection of the PtoP communication is selected. Then, for this selected redirection, charging processing and DRM (copyright management) are performed based on the communication log stored in the communication management information storage area 42. As a result, it is possible to perform charging processing and DRM (copyright management) for PtoP communication redirection.
[0076]
(4) Transfer control operation using address translation
When transferring the packets from the client terminals TMa and TMb to the port Pc, the packet transfer device RT converts the source IP address of the packet input from the port Pa into a preset IP address and recalculates the FCS. And transfer. Further, the packet transfer device RT converts a communication packet input from the port Pc, which is a communication method not using authentication, whose destination is the preset IP address into an IP address of a destination belonging to the authenticated communication session. And transfer it to port Pa.
[0077]
In this way, even when a packet of a communication session whose IP address has been obtained from an unspecified number of DHCP servers is transferred to a network using a communication method that does not require authentication, the IP address system is prepared and transferred. be able to.
[0078]
For example, as shown in FIG. 10, even when a packet from a communication session having an IP address assigned by the DHCP servers DSa, DSb, and DSc as a transmission source IP address is redirected to the network NWb, the IP address is transmitted to the packet transfer device RT. By converting the address to a preset IP address, the subnet mask of the packet transferred to the network NWb can be unified. For this reason, even if the number of client terminals becomes enormous and a route needs to be allocated for each communication session established by these client terminals, it is possible to suppress an increase in the size of the routing table in the network NWb. Further, the processing load on the router can be reduced.
[0079]
(Second embodiment)
In the second embodiment of the present invention, an address translator is installed between the port Pc of the packet transfer device RT and the network NWb, and the address translator performs a packet address translation process. .
[0080]
FIG. 8 is a schematic configuration diagram of the packet communication system according to this embodiment. In this figure, the same parts as those in FIG.
[0081]
In the figure, the packet transmitted from the port Pc of the packet transfer device RT 'is input to the port Pe of the address translation device AC. The address translator AC converts the source IP address of the packet received at the port Pe into a preset IP address, and transmits the address-converted packet from the port Pf to the network NWb. The packet sent from the network NWb is input to the port Pf of the address translation device AC. The packet sent from the network NWb is a packet that uses a communication method that does not use authentication and whose destination is the above-mentioned preset IP address. The address translator AC converts the destination of the packet received at the port Pf into an IP address of a destination belonging to the authenticated communication session, and transmits the address-translated packet from the port Pe to the packet transfer device RT. I do.
[0082]
Therefore, even when a packet of a communication session acquiring an IP address with an irregular subnet mask is transferred to the network NWb using a communication method that does not require authentication, the number of routes in the transfer destination network NWb is increased. It is possible to suppress such a situation, and it becomes possible to operate the network efficiently. Further, since the address translation device AC is provided independently, the processing load on the packet transfer device RT can be reduced.
[0083]
(Other embodiments)
In the first embodiment, as a configuration for replying a congestion message to the client terminals TMa and TMb, a congestion response server RSV is connected to the port Pd of the packet transfer device RT, and packets arriving from the client terminal are sent to the congestion response server. The case of redirection to the server RSV has been described. However, the present invention is not limited to this. For example, congestion may occur on the upper side (server side) of the network NWa to which the destination servers SVa1, SVa2, and SVa3 are connected, or on the upper side of the network NWb to which the servers SVb1, SVb2, and SVb3 are connected. The response server RSV may be connected, and the packet arriving from the client terminal may be directly transferred to the congestion response server RSV. Further, the packet transfer device RT can also incorporate the function of the congestion response server RSV.
[0084]
If a SYN packet requesting a redirection target TCP session is received from a client terminal not described in the redirect table 41 in a state where congestion is detected at the port Pb of the packet transfer apparatus RT, the packet transfer apparatus RT At RT, processing may be performed such that an RST packet is returned only when the reception port of the received SYN packet has a specific port number set in advance. With this configuration, it is possible to reject service acceptance at a location close to the client terminal.
[0085]
The configuration of the packet transfer device, the type and number of networks and client terminals connected to the packet transfer device, the control procedures and control contents of each of traffic control, PtoP communication control, charging control and address conversion transfer control, etc. Can be variously modified and implemented without departing from the gist of the present invention.
[0086]
【The invention's effect】
As described above in detail, according to the present invention, packet loss and congestion can be made less likely to occur, thereby improving packet transfer efficiency and service quality, a packet communication system, a packet transfer device, and a packet transfer device. A transfer control program can be provided.
[Brief description of the drawings]
FIG. 1 is a schematic configuration diagram of a packet communication system according to a first embodiment of the present invention.
FIG. 2 is a block diagram showing a configuration of a packet transfer device according to the first embodiment of the present invention.
FIG. 3 is a diagram for explaining an example of a protocol conversion process when a packet from a client terminal is redirected to a congestion response server.
FIG. 4 is a diagram illustrating an example of a protocol conversion process when client information redirects a packet from a congestion response server to a client terminal.
FIG. 5 is a diagram for explaining another example of a protocol conversion process when redirecting a packet from a client terminal to a congestion response server.
FIG. 6 is a view for explaining another example of the protocol conversion process when redirecting a packet from the congestion response server to the client terminal.
FIG. 7 is a view for explaining a protocol conversion process for PtoP communication.
FIG. 8 is a schematic configuration diagram of a packet communication system according to a second embodiment of the present invention.
FIG. 9 is a schematic configuration diagram showing an example of a conventional packet communication system having a redirection transfer function.
FIG. 10 is a diagram for explaining an example of a system that performs packet communication by acquiring IP addresses from an unspecified number of DHCP servers.
[Explanation of symbols]
RT, RT ': Packet transfer device
PatoPd: Port of the packet transfer device
NWa, NWb ... Network
ASV: Access server
SVa1, SVa2, SVa3, SVb1, SVb2, SVb3... Server for content service
TMa, TMb: Client terminal
RSV: Congestion response server
AC: Address translation device
Pe, Pf: Ports of the address translation device
10 CPU
20 ... Bus
30 ... Program memory
31: Traffic control program
32 ... PtoP communication control program
33 ... Charge control program
34 ... Address conversion transfer control program
40 ... data memory
41: redirect table 41
42: Communication management information storage area
51 to 54: Communication interface

Claims (23)

A communication device that transmits a packet using a first communication protocol including an authentication procedure is provided by a first network that uses the first communication protocol and a second network that uses a second communication protocol that does not include an authentication procedure. In the packet transfer device connected to the second network,
At a point where the packet sent from the first network and the packet sent from the second network converge, monitoring means for monitoring the traffic volume of these packets;
Based on the monitoring result of the monitoring means, when the distribution amount exceeds a predetermined amount, a process of giving priority to the transfer of the packet sent from the second network over the transfer of the packet sent from the first network is performed. A packet transfer device comprising: a transfer control unit. A communication device that transmits a packet using a first communication protocol including an authentication procedure is provided by a first network that uses the first communication protocol and a second network that uses a second communication protocol that does not include an authentication procedure. In the packet transfer device connected to the second network,
Monitoring means for monitoring the amount of distribution of packets sent from the second network to the communication device in a state where packets are protocol-converted and transferred between the communication device and the second network; ,
A packet control unit that restricts packet transfer from the communication device to the second network when the distribution amount exceeds a predetermined amount based on the monitoring result of the monitoring unit. Transfer device. A communication device that transmits a packet using a first communication protocol including an authentication procedure is provided by a first network that uses the first communication protocol and a second network that uses a second communication protocol that does not include an authentication procedure. In the packet transfer device connected to the second network,
Monitoring means for monitoring the amount of distribution of packets destined for the communication device sent from the first network;
Based on the monitoring result of the monitoring means, when a packet addressed to a first network arrives from the communication device in a state where the distribution amount exceeds a predetermined amount, a transfer destination of the packet is transmitted from the first network. Means for changing the communication device to another communication device prepared in advance and causing the other communication device to transmit a predetermined notification message to the communication device of the transmission source. A communication device that transmits a packet using a first communication protocol including an authentication procedure is provided by a first network that uses the first communication protocol and a second network that uses a second communication protocol that does not include an authentication procedure. In the packet transfer device connected to the second network,
Monitoring means for monitoring the amount of distribution of packets destined for the communication device sent from the first network;
Based on the monitoring result of the monitoring means, when a packet addressed to a first network arrives from the communication device in a state where the distribution amount exceeds a predetermined amount, the transfer of the packet to the first network is restricted. Means for restricting transfer;
A message for generating a notification message including the monitoring result or contents related thereto in response to the arrival of a packet addressed to a first network from the communication device, and transmitting the generated notification message to the communication device of the transmission source A packet transfer device comprising: a notifying unit. A communication device that transmits a packet using a first communication protocol including an authentication procedure is provided by a first network that uses the first communication protocol and a second network that uses a second communication protocol that does not include an authentication procedure. In the packet transfer device connected to the second network,
Monitoring means for monitoring the amount of distribution of packets destined for the communication device sent from the second network;
Based on the monitoring result of the monitoring means, when a packet addressed to a second network arrives from the communication device in a state where the distribution amount exceeds a predetermined amount, the transfer destination of the packet is changed from the first network. Means for changing the communication device to another communication device prepared in advance and causing the other communication device to transmit a predetermined notification message to the communication device of the transmission source. A communication device that transmits a packet using a first communication protocol including an authentication procedure is provided by a first network that uses the first communication protocol and a second network that uses a second communication protocol that does not include an authentication procedure. In the packet transfer device connected to the second network,
Monitoring means for monitoring the amount of distribution of packets destined for the communication device sent from the second network;
Based on the monitoring result of the monitoring means, when a packet addressed to a second network arrives from the communication device in a state where the distribution amount exceeds a predetermined amount, the transfer of the packet to the second network is restricted. Means for restricting transfer;
A message for generating a notification message including the monitoring result or contents related thereto in response to the arrival of a packet addressed to a second network from the communication device, and transmitting the generated notification message to the communication device of the transmission source A packet transfer device comprising: a notifying unit. A first communication device that transmits a packet using a first communication protocol including an authentication procedure, a first network using the first communication protocol, and a second communication device that does not include an authentication procedure. In a packet transfer device connected to a second network using a communication protocol,
Determining means for determining whether a destination of a packet arriving from the first communication device is the second communication device;
When the determination unit determines that the destination of the packet arriving from the first communication device is the second communication device, a protocol conversion for returning the packet to the second communication device by return And a return transfer control means for transmitting the protocol-converted packet to the second communication device. A communication device that transmits a packet using a first communication protocol including an authentication procedure is provided by a first network that uses the first communication protocol and a second network that uses a second communication protocol that does not include an authentication procedure. In the packet transfer device connected to the second network,
When a packet is sent from the communication device, a communication log collection unit that reads a predetermined header information element from the packet and stores the read header information element as a communication log in association with the communication device of the transmission source. A packet transfer device, comprising: 9. The packet transfer device according to claim 8, further comprising: accounting means for executing accounting processing for each communication device based on the communication log stored by said communication log collection means. A communication device that transmits a packet using a first communication protocol including an authentication procedure is provided by a first network that uses the first communication protocol and a second network that uses a second communication protocol that does not include an authentication procedure. In the packet transfer device connected to the second network,
A first address conversion means for converting a source address of the packet to a preset address when a packet addressed to the second network sent from the communication device is protocol-converted and transferred to the second network; When,
When a packet addressed to the communication device sent from the second network is protocol-converted and transferred to a corresponding communication device, the communication device before the first address translation means converts the destination address of the packet. And a second address translating means for translating the packet to the source address of the packet. A communication device that transmits a packet using a first communication protocol including an authentication procedure may be configured to include a first network using the first communication protocol and a second network using a second communication protocol not including the authentication procedure. A packet transfer control program used in a packet transfer device provided with a computer, which is connected to the network of No. 2;
At a point where the packet arriving from the first network and the packet arriving from the second network merge, a process of monitoring the traffic of these packets;
Based on the monitoring result of the traffic volume, when the traffic volume exceeds a predetermined volume, prioritizing the transfer of the packet arriving from the second network over the transfer of the packet arriving from the first network. ,
A packet transfer control program to be executed by the computer. A communication device that transmits a packet using a first communication protocol including an authentication procedure may be configured to include a first network using the first communication protocol and a second network using a second communication protocol not including the authentication procedure. A packet transfer control program used in a packet transfer device provided with a computer, which is connected to the network of No. 2;
A process of monitoring a flow rate of a packet sent from the second network to the communication device in a state where the packet is transferred after performing protocol conversion between the communication device and the second network;
Based on the monitoring result of the distribution amount, when the distribution amount exceeds a predetermined amount, a process of restricting packet transfer from the communication device to the second network,
A packet transfer control program to be executed by the computer. A communication device that transmits a packet using a first communication protocol including an authentication procedure may be configured to include a first network using the first communication protocol and a second network using a second communication protocol not including the authentication procedure. A packet transfer control program used in a packet transfer device provided with a computer, which is connected to the network of No. 2;
A process of monitoring a distribution amount of a packet transmitted from the first network and addressed to the communication device;
Based on the distribution amount monitoring result, when a packet addressed to a first network arrives from the communication device in a state where the distribution amount exceeds a predetermined amount, a transfer destination of the packet is changed from the first network. Changing to the response communication device, the process of causing the response communication device to transmit a predetermined notification message to the transmission source communication device,
A packet transfer control program to be executed by the computer. A communication device that transmits a packet using a first communication protocol including an authentication procedure may be configured to include a first network using the first communication protocol and a second network using a second communication protocol not including the authentication procedure. A packet transfer control program used in a packet transfer device provided with a computer, which is connected to the network of No. 2;
A process of monitoring a distribution amount of a packet transmitted from the first network and addressed to the communication device;
Based on the distribution amount monitoring result, when a packet addressed to a first network arrives from the communication device in a state where the distribution amount exceeds a predetermined amount, transfer of the packet to the first network is restricted. Processing,
A process of generating a notification message including the monitoring result or contents related thereto in response to the arrival of a packet addressed to a first network from the communication device;
Transmitting the generated notification message to the communication device of the transmission source by the computer. A communication device that transmits a packet using a first communication protocol including an authentication procedure may be configured to include a first network using the first communication protocol and a second network using a second communication protocol not including the authentication procedure. A packet transfer control program used in a packet transfer device provided with a computer, which is connected to the network of No. 2;
A process of monitoring a distribution amount of a packet transmitted from the second network and addressed to the communication device;
Based on the distribution amount monitoring result, when a packet addressed to a second network arrives from the communication device in a state where the distribution amount exceeds a predetermined amount, a transfer destination of the packet is changed from the first network. Changing to the response communication device, the process of causing the response communication device to transmit a predetermined notification message to the transmission source communication device,
A packet transfer control program to be executed by the computer. A communication device that transmits a packet using a first communication protocol including an authentication procedure may be configured to include a first network using the first communication protocol and a second network using a second communication protocol not including the authentication procedure. A packet transfer control program used in a packet transfer device provided with a computer, which is connected to the network of No. 2;
A process of monitoring a distribution amount of a packet transmitted from the second network and addressed to the communication device;
When a packet addressed to a second network arrives from the communication device in a state where the distribution amount exceeds a predetermined amount based on a result of monitoring the distribution amount, the transfer of the packet to the second network is restricted. Processing,
A process of generating a notification message including the monitoring result or contents related thereto in response to the arrival of a packet addressed to a second network from the communication device;
Transmitting the generated notification message to the communication device of the transmission source by the computer. A first communication device that transmits a packet using a first communication protocol including an authentication procedure, a first network using the first communication protocol, and a second communication device that does not include an authentication procedure. A packet transfer control program for use in a packet transfer device having a computer connected to a second network using a communication protocol,
Processing for determining whether or not the destination of the packet arriving from the first communication device is the second communication device;
When it is determined that the destination of the packet arriving from the first communication device is the second communication device, a process of performing a protocol conversion on the packet to return the packet to the second communication device; ,
Transmitting the protocol-converted packet to the second communication device;
A packet transfer control program to be executed by the computer. A communication device that transmits a packet using a first communication protocol including an authentication procedure may be configured to include a first network using the first communication protocol and a second network using a second communication protocol not including the authentication procedure. A packet transfer control program used in a packet transfer device provided with a computer, which is connected to the network of No. 2;
When a packet arrives from the communication device, a process of reading a predetermined header information element from the packet,
Storing the read header information element as a communication log in association with the communication device of the transmission source,
A packet transfer control program to be executed by the computer. 19. The packet transfer control program according to claim 18, further causing the computer to execute a charging process for each communication device based on the stored communication log. A communication device that transmits a packet using a first communication protocol including an authentication procedure may be configured to include a first network using the first communication protocol and a second network using a second communication protocol not including the authentication procedure. A packet transfer control program used in a packet transfer device provided with a computer, which is connected to the network of No. 2;
A process of protocol-converting a packet addressed to the second network sent from the communication device and transferring the packet to the second network;
A process of converting the source address of the packet to a preset address at the time of the transfer;
A process of protocol-converting a packet addressed to the communication device sent from the second network and transferring the packet to a corresponding communication device;
During the transfer, a process of converting the destination address of the packet into a source address of the communication device before conversion,
A packet transfer control program to be executed by the computer. A communication device for transmitting a packet using a first communication protocol including an authentication procedure, a first network using the first communication protocol, and a second network using a second communication protocol including no authentication procedure 2. A packet communication system, wherein a packet communication device is connected to the second network by a packet transfer device, and a response communication device can be connected to the packet transfer device.
The packet transfer device,
Monitoring means for monitoring the amount of distribution of packets destined for the communication device sent from the first network;
Based on the monitoring result of the monitoring unit, when a packet addressed to a first network arrives from the communication device in a state where the distribution amount exceeds a predetermined amount, a transfer destination of the packet is changed from the first network. Means for changing to the response communication device,
The response communication device,
Means for generating a notification message including the monitoring result or contents related thereto when a packet is transferred from the packet transfer device;
Means for transmitting the generated notification message to the communication terminal apparatus of the transmission source. A communication device for transmitting a packet using a first communication protocol including an authentication procedure, a first network using the first communication protocol, and a second network using a second communication protocol including no authentication procedure 2. A packet communication system, wherein a packet communication device is connected to the second network by a packet transfer device, and a response communication device can be connected to the packet transfer device.
The packet transfer device,
Monitoring means for monitoring the amount of distribution of packets destined for the communication device sent from the second network;
Based on the monitoring result of the monitoring unit, when a packet addressed to a second network arrives from the communication device in a state where the distribution amount exceeds a predetermined amount, the transfer destination of the packet is changed from the second network. Means for changing to the response communication device,
The response communication device,
Means for generating a notification message including the monitoring result or contents related thereto when a packet is transferred from the packet transfer device;
Means for transmitting the generated notification message to the communication terminal apparatus of the transmission source. A communication device for transmitting a packet using a first communication protocol including an authentication procedure, a first network using the first communication protocol, and a second network using a second communication protocol including no authentication procedure A packet communication system in which a packet transfer device is connected to a second network and an address translation device is connected between the packet transfer device and the second network.
The packet transfer device,
Means for protocol-converting a packet addressed to the second network sent from the communication device and transferring the packet to the address translation device;
Means for protocol-converting a packet addressed to the communication device transferred from the second network via the address conversion device and transferring the packet to the communication device,
The address translator,
First address conversion means for converting a source address of a packet addressed to a second network transferred from the packet transfer device to a preset address, and transferring the address-converted packet to the second network; ,
A destination address of a packet addressed to the communication device sent from the second network is converted into a source address of the communication device before the first address conversion unit converts the packet. A packet communication system comprising: a second address translation unit that forwards the packet to a packet forwarding device.

Images