JP2006174510A - Communication system - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To provide a VNP(Virtual Private Network) across a plurality of Internet service providers(ISP). <P>SOLUTION: In the interwork gateway of the network connecting part of both Internet service providers, when the line of each packet is decided, the line is decided by using the information of the regions of both a capsuled header and an IP header introduced for configuring a VNP, and the capsuled header in an output side network is also configured of the information. The interconnection of a virtual private line is made possible, and a VPN across a plurality of Internet service providers is made configurable. Also, the QoS information of the first network and the second network can be interworked. <P>COPYRIGHT: (C)2006,JPO&NCIPI

Description

  The present invention relates to a virtual private network (VPN) construction method on the Internet and an interwork router for connecting Internet service providers.

  Applications such as e-mail and WWW (World Wide Web) can be used on the Internet protocol (IP) network. IP networks are also cheaper to build than traditional telephone-based switching networks. For this reason, the Internet has become popular in recent years. Under such circumstances, an intra-company network (intranet) constructed with IP has become indispensable for corporate activities.

  Companies are often unevenly distributed in multiple regions. In this case, it is necessary to interconnect the corporate networks in each region to construct a single corporate network. When building a corporate network across multiple regions, the following two methods can be considered.

  The first is to interconnect the local corporate networks with dedicated lines. By constructing in this way, the corporate network can be isolated from the external network and security can be ensured.

  Second, the terminal is provided with a function for identifying packets of its own network by IPsec (IP security protocol) technology, and is transferred as an IP packet based on a global address in the Internet. A VPN can be realized by countering an attack from a malicious user with this identification function and encryption.

  However, the use of a dedicated line increases the network cost, and in the VPN using the IPsec method, malicious users can be intruded by attack and decryption, and encryption processing becomes a bottleneck for the speed of high-speed networks. There is a problem that the terminal cost increases.

  For this reason, as the Internet becomes widespread and can be used at a low price, a dedicated network is virtually constructed on the Internet using the IP lower layer functions provided by the network, the cost is reduced, and There has been a growing demand for safe and some quality assurance that is isolated from external networks.

  The following VPN is considered as a network that satisfies this requirement. Encapsulation is performed at the entrance of a network of an Internet service provider (ISP) that provides VPN. On the ISP network, transfer is performed based on the encapsulated header, and the capsule header is removed at the exit of the network. In this VPN configuration method, by using a VPN-specific encapsulation header, it is isolated from an external network and security is ensured. Specific protocols for this encapsulation include IP encapsulation, MPOA (Multi Protocol over ATM), MPLS (Multi Protocol Layer Switching), etc. As of February 1999, ITU-T SG13 and IETF It is being studied by standardization organizations such as Also, in ITU-T SG13, a study is being conducted on Core Protocol (also called GMN-CL) that encapsulates and transfers the inside of a network with an E.164 address.

  NTT R & D vol.47 No.4 1998 (published on April 10, 1998) proposes a configuration method for access systems and edge nodes that interwork user networks and core networks in GMN-CL.

  Business activities in recent years are extensive. For this reason, for example, there is a need to have bases in Japan, the United States, and Europe, build an intranet at each base, and connect them with each other by VPN.

  On the other hand, since ISPs generally provide services in a specific area, in order to connect the networks of each base as described above with VPN, a VPN is constructed across multiple ISPs. There is a need to.

  When multiple ISPs are connected to each other, an interworking gateway is provided for mutual connection. In this interwork router, interworking is realized by transferring packets destined for the partner network coming from both networks to the partner network according to the IP header. Also, as described on page 146 of the Nikkei Communication December 15, 1997, for mutual interworking of multiple networks, each other's networks are connected using a device called IX (Internet Exchange). Packets transferred between networks may be transferred by IX. In such IX, there is a method using “Layer 3 forwarding” that identifies and forwards an IP packet, or “Layer 2 forwarding” that identifies and forwards a lower layer header in an ATM communication device or the like. .

  The inventors of the present application have examined a problem when attempting to configure a VPN across a plurality of ISP networks. First, in order to construct a VPN in each Internet service provider's network, encapsulation is performed in each network. The encapsulation protocol for each network will generally be different. In this case, the interwork router needs to search the IP header information of the IP packet, which is a common protocol of both networks, determine the destination route, and search whether the packet is for another network. .

However, since the interwork router terminates the protocol lower than the IP layer at the interface, the interwork router searches for the IP address by removing the encapsulation header attached to configure the VPN in the previous network. Hop information is determined, and a capsule header for constructing a VPN in the subsequent network is generated and attached to the packet. Therefore, inside the interwork apparatus, packets in the VPN and packets in networks other than the VPN are mixed.
Therefore, there is a problem that intrusion into the VPN becomes possible with the interwork router as a base point due to the addition of an illegal header by a malicious user.

  Further, some companies may configure a VPN using an internal address without using a global address. In this case, once the encapsulated header is removed by the interwork router, the internal address is uniquely used by the multiple VPNs on the receiving ISP side, so packets with the same address should be distinguished. I can't. For this reason, the transfer destination of the packet cannot be determined. When a VPN is configured on the Internet across a plurality of ISPs, there is a problem as described above (first problem).

  Furthermore, services in each ISP are not uniform. Taking communication quality as an example, one ISP guarantees the quality of each VPN by creating a path using an ATM VC, and another ISP guarantees the quality by Diffserv (Differenciated Services). In this case, it is difficult to define the communication quality end-to-end when VPNs configured by both are connected to each other. (Second problem).

  As described above, it is difficult to construct a VPN on the Internet across a plurality of ISPs at a practical level.

  Accordingly, the present invention provides a method for constructing a VPN across a plurality of ISPs, and an interwork router for connecting the ISPs when constructing a VPN across a plurality of ISPs.

In order to solve the first problem, the function for determining the output route and generating the encapsulation header in the output side ISP network using the information of both the encapsulation header and the IP header, which are VPN identification numbers, is provided. Provided in work router equipment. The case where ISPs operating MPLS networks using ATM are connected to the lower layer will be described in detail by way of example. Header information such as ATM VPI and VCI, which are encapsulation headers used for VPN identification, and IP address Search for the key, generate header information such as ATM VPI, VCI, etc. used for VPN identification in the next route and the next network, and add the header information generated when sending it to the subsequent network Send it out.
As a result, VPN interworking can be realized, and a VPN configuration on the Internet can be configured for an area spanning a plurality of ISPs.

  In order to solve the second problem, the field value representing the QoS of the encapsulation header area on the input side is mapped to the value of the field representing the QoS of the encapsulation header area on the output side. Thereby, the quality information of both networks can be transferred transparently.

  According to the present invention, a VPN network spanning a plurality of ISPs can be constructed. In addition, QoS information can be interworked between a plurality of VPN networks.

  Embodiments of the present invention will be described below with reference to the drawings.

  A configuration method of a VPN separated by a lower layer extending over a plurality of ISPs according to the present invention and the role of the interwork router will be described with reference to FIGS. Here, the lower layer refers to a protocol for encapsulating an IP packet. Even when an IP packet is encapsulated with an IP header, the capsule header is represented as a lower layer header.

  First, referring to FIG. 2, a problem when a VPN that spans a plurality of ISPs is configured using a conventional router will be described. In FIG. 2, ISP1 (2-1) and ISP2 (2-2) realizing VPN by encapsulating in the lower layer are interworked by the existing router (9). The ISP 1 is developing services in the A district, and accommodates LAN1 (1-1), LAN2 (1-2), and LANa (1-a). The ISP 2 develops services in the B area and accommodates LAN 3 (1-3), LAN 4 (1-4), and LANb (1-b). Further, LAN1, LAN2, LAN3, and LAN4 are LANs of the same company, and it is desired to configure a VPN. LANa and LANb are also LANs of the same company, and they want to configure a VPN. In such a case, in the same ISP, by establishing a capsule channel at the entrance of the network and the entrance of the network, it can be separated from the packets of other users, so that a network with high security can be constructed. However, when setting up VPN over ISP1 and ISP2, the existing router terminates the lower layer at the interface section on the input side, merges at the IP level, and then performs ring processing at the packet forward. There is a problem that user packets are mixed. In other words, packets in the VPN and other packets are mixed. Therefore, it is possible for a malicious user to intrude into the network with a false IP address. Furthermore, when two companies try to construct an in-house LAN using private addresses, the same IP address may be assigned because each company assigns an address independently. In this case, the existing router cannot correctly transfer the packet because of address batting.

  Next, the solution of the problem according to the present invention will be described with reference to FIG. For example, a case where communication is performed from LAN 1 of company A to LAN 3 of company A will be described. In this embodiment, ISP 1 realizes VPN by IP encapsulation, and ISP 2 realizes VPN by encapsulating by MPLS (based on ATM). When a packet arriving from the LAN 1 enters the ISP 1 (2-1), the ISP 1 performs IP encapsulation, and the packet arrives at the interwork router through the IP encapsulation logical channel (5-1). The interwork router (9) searches the output route from both the IP encapsulation header indicating the IP-encapsulated logical channel on which the packet is mounted and the original packet header, and creates the encapsulation header in ISP2. To do. In this embodiment, the ISP 2 provides services using MPLS, so an ATM header is created. The packet encapsulated by ATM is sent to the LAN 3 through the ATM logical channel (5-3). In the interwork router, the search is performed using the capsule header and the IP header, so that the company A and the company B can use the private addresses and transfer them to the correct destinations even when the IP addresses are batting. .

  In the present embodiment, as the encapsulation protocol, the IP encapsulation which is the IP layer encapsulation method and the method of performing the encapsulation using ATM have been described. Of course, encapsulation may be performed using a frame relay or HDLC protocol.

  FIG. 3 illustrates an embodiment of a VPN configuration method across a plurality of ISPs according to the present invention, using a network configuration and a protocol stack. Here, the encapsulation protocol is not limited. ISP1 (2-1) accommodates LAN1 (1-1) and LAN2 (1-2) through edge nodes (3-1, 3-2), respectively. Similarly, ISP 2 (2-2) accommodates a plurality of networks including LAN 3 (1-3) and LAN 4 (1-4) through edge nodes (3-3, 3-4), respectively. Also, each ISP transfers IP packets by encapsulating them with headers used in the network from the entrance to the exit of the own network. Then, by assigning the capsule header uniquely to the VPN, VPN traffic is identified from other traffic in the network, and a closed network related to VPN is configured. ISP1 (2-1) and ISP2 (2-2) are interworked by an interwork router (10), and traffic destined for the partner network is transferred to the partner network via the interwork router.

  For example, a description will be given of a case of configuring a VPN connecting LAN1 and LAN3 (referred to as VPN1). An IP packet addressed to LAN3 sent from LAN1 is searched by an IP address at an edge node (3-1). The packet is addressed to the interwork router belonging to, and a capsule header (103a in the layer diagram) destined for the interwork router (10) of VPN1 is given to reach the interwork router (10). The interwork router (10) is searched by the capsule header (103a in the layer diagram) and the IP address, and searches for the packet addressed to the edge node (3-3) belonging to VPN1, and the edge node ( 3-3) A capsule header (103b in the layer diagram) addressed is assigned, and the ISP2 is transferred to the edge node (3-3) according to the capsule header. The edge node (3-3) removes the capsule header and transfers the IP packet to the LAN 3. As a result, it is possible to transfer the VPN IP packet extending over both networks without being mixed with other traffic.

  Note that IP packets using global addresses are not dependent on lower layer information, but are determined as a whole by determining the transfer destination and capsule header (when using the capsule header) as a whole. You can make a transfer to.

The operation of the interwork router (10) will be described with reference to FIGS.
FIG. 4 is a processing flow of the conventional router device, and FIGS. 5 and 6 are processing flows of the interwork router (10) according to the present invention. In the conventional router, when a packet arrives, the physical layer used for forwarding in ISP1 (2-1) is terminated (201), the capsule header used for forwarding in ISP1 is removed (202), and then the IP A route search is performed based on the value of the header (203), and the route is transferred to the desired route via the switch (204). Thereafter, a capsule header used for transfer in ISP 2 is added (205), and then the physical layer is processed (206) and sent out from the transmission path. In this flow, since the capsule header of ISP1 is removed and the route is determined only by the IP header, traffics of a plurality of VPNs are merged once.
According to the interwork router of the present invention, such a problem can be avoided.

  3, when a packet that is an algorithm executed by the interwork router (10) of the present invention arrives, the physical layer used for the transfer in the ISP 1 (2-1) is terminated (211), and the transfer in the ISP 1 is performed. Based on the values of the capsule header and the IP header used, route search and generation of an encapsulation header in ISP2 are performed (212). Thereafter, the ISP1 capsule header is removed (213), a capsule header used for transfer in ISP2 is added (214), and the capsule header is transmitted to the switch. Then, it is transferred (215) to a desired route by the switch. Thereafter, the physical layer is processed (216) and sent out from the transmission path. As a result, traffic from another network can be separated. Further, since a bare IP packet from which the capsule header is removed does not flow through the switch, another person cannot insert it into the VPN from this portion. That is, an IP packet to which an internal header used in ISP2 is not added is not mixed and the packet does not flow into the VPN in ISP2. Therefore, safety is also increased.

  FIG. 6 will be described as another embodiment. The interwork router of the present embodiment includes a correspondence table of capsule header and IP header values used for transfer in ISP1, a capsule header index, a capsule header index and a capsule header used for transfer in ISP2. Has a correspondence table. When the packet arrives, the physical layer used for the transfer in ISP 1 (2-1) is terminated (221), the route search and the capsule header index are generated based on the values of the capsule header and the IP header used for the transfer in ISP 1. (222). Thereafter, the IP packet ISP1 capsule header is removed (223), the generated capsule header index is added to the removed IP packet, and the packet is transmitted to the switch, and transferred to a desired route by the switch (224). . Then, a capsule header used for transfer in ISP 2 is generated from the capsule header Index and attached (225). Thereafter, the physical layer is processed (226) and sent out from the transmission path. Also with this configuration, a highly secure closed network can be configured as in the case of FIG. That is, an IP packet to which no capsule header Index is assigned is not mixed in.

  Next, with reference to FIG. 7 to FIG. 10, a description will be given of a VPN implementation method and a packet configuration example spanning ISP 1 that supports VPN by MPLS and ISP 2 that supports VPN using IP capsule.

  FIG. 7 shows a network configuration and a protocol stack. Although FIG. 3 has been described without specifying an encapsulation method, FIG. 7 shows an example in which MPLS is adopted for ISP1 and IP encapsulation is adopted for ISP2. In the interwork router (10), forwarding is performed by a combination of the ATM layer (104a) and the IP layer (101), the IP capsule layer (104b), and the IP layer (101) corresponding to the encapsulated header, as in FIG. Accordingly, since each VPN uses a private address, it is possible to forward correctly even if the addresses overlap.

  A method of encapsulating IP packets with ATM will be described with reference to FIG. This encapsulation is a method standardized by RFC 1483 of IETF. An LLC / SNAP (253) is added to an IP packet composed of an IP header (250) and an IP payload (251), and an AAL5 header (252) and an AAL5 trailer (255) are added to form an AAL5 frame. PAD (254) inserts an AAL5 frame to make it a constant multiple of 48 octets, which is the payload (257) length of the ATM cell. The AAL5 trailer is divided into 48 octets, an ATM header (256) is added, and transfer is performed as one or a plurality of ATM cells.

FIG. 9 shows an IPv4 packet format indicated by RFC791.
When performing IP encapsulation, an IPv4 header is used as it is as a protocol for encapsulation, and an existing IPv4 router can be used as a router in the network.

  FIG. 10 shows an encapsulation method using an IP tunnel. An IP packet composed of an IP header (260) and an IP payload (261) transmitted by the user is encapsulated by an encapsulation header (264). The encapsulation header includes an IP header (262) and a tunnel header (263). Consists of This encapsulation header is used in the ISP 2 and can be uniquely identified in the network. Therefore, even when the user uses a private address, routing can be performed by the capsule header in the network, and the packet can be carried to a desired edge. In this example, an example of a tunnel header by RFC 1583 is shown, but other IP encapsulation includes GRE encapsulation (RFC1792) and IP mobile.

  In the interwork router (10), by performing the forwarding process by combining the capsule header shown in FIG. 8 or FIG. 10 and the user's IP address, a secure VPN can be configured across the ISP, and the user can also make a private A VPN can be constructed using an address.

  An embodiment of the interwork router (10) will be described with reference to FIGS.

  FIG. 11 shows an example of the configuration of the interwork router (10). The control unit (50) performs control of the entire apparatus and routing processing with other nodes. The core switch (51) is a switch that transfers packets between the packet layer processing units (52). The lower layer processing unit (ATM) (53) is an interface that accommodates the MPLS network of ISP1, and the lower layer processing unit (IP capsule) (54) is an interface that accommodates the IP capsule network of ISP2. The packet layer processing unit (52) receives lower layer information and IP packets from the lower layer processing units (53, 54), and determines a packet transfer destination based on a combination of the lower layer information and the IP packet header information.

  First, the processing flow in the reception direction will be described. FIG. 12 shows a block configuration of the lower layer processing unit (ATM) (53). A signal arriving from the ISP1 network first terminates the physical layer in the physical layer processing unit (150) and terminates the ATM layer in the ATM layer processing unit (151). At this time, the ATM header performing the VPN identification function on the receiving side is also sent to the VPN number assigning unit (152) together with the reconfigured IP packet. The VPN number assigning unit (152) generates a VPN number used for identifying the VPN in the apparatus from the ATM header. At this time, the receiving side VPN number table (153) is used. The VPN number and the IP packet are transferred to the packet layer processing unit via the packet processing unit IF (154).

  FIG. 13 shows a configuration example of the receiving side VPN number table (153). This table is composed of a pair of an input side ATM header (300) and an input side VPN number (303), and the input side ATM header serves as an input key to output the input side VPN number (303). As an input side ATM header serving as an input key, in addition to VPI / VCI (301), a CLP (Cell of Priority) bit (302) indicating a packet transfer priority may be used as a key. The input-side VPN number used for general purposes in the device may be provided with a field (305) indicating QoS (Quality of Service) in addition to the in-device VPN number (304). Further, a table for mapping CLP and QoS may be provided independently of this table for VPN identification.

  FIG. 14 shows an embodiment of the lower layer processing unit (IP capsule) (54). The signal coming from ISP2 terminates the physical layer in the physical layer processing unit (170), and then terminates the capsule header in the capsule layer reception processing unit (171). At this time, the terminated capsule header is sent to the VPN number assigning unit (172) together with the IP bucket. The VPN number assigning unit (172) generates a VPN number used for identifying the VPN in the apparatus from the ATM header. At this time, the receiving side VPN number table (173) is used. The VPN number and the IP packet are transferred to the packet layer processing unit via the packet processing unit IF (154).

  FIG. 15 shows a configuration example of the receiving side VPN number table (173). This table is composed of a pair of an input side capsule header (310) and an input side VPN number (303), and the input side ATM header serves as an input key and outputs the input side VPN number (303). As an input side IP capsule header serving as an input key, in addition to the source address (311) of the capsule header, a TOS (Type of Service) field (302) indicating a packet transfer priority may be used as a key. The input-side VPN number used for general purposes in the apparatus may be provided with a field (305) indicating QoS in addition to the in-apparatus VPN number (304).

  Further, a table for mapping ToS and QoS may be provided independently of this table for VPN identification.

  The process when the input side VPN number (303) and the IP packet reach the packet layer processing unit (52) by the method described with reference to FIGS. 12 to 15 will be described with reference to FIG. When the route search / VPN processing unit (181) receives the input side VPN number (304) and the IP packet via the lower layer processing unit (180), the IP header and the IP header and the route search / VPN table (182) are used here. The route search and the output side VPN number are determined using both the input side VPN number as a key. As a result, the output route, the output side VPN number, and the IP packet are sent to the core switch via the core switch IF and reach the desired packet layer processing unit.

  FIG. 17 shows a configuration example of the route search / VPN table. A search is performed using the input side VPN number (320) and the IP header (323) as input keys, and the output route number (325) and the output side capsule number (326) are output. The output route number (326) is an in-device identifier for transferring a packet to a desired interface by the core switch and others, and the output side capsule number (326) is assigned a capsule header in the lower layer processing unit on the output side It is an in-device identifier for the capsule header for The output side capsule number (326) may be provided with QoS (328) in addition to the capsule number (327) to perform priority control.

  Next, processing in the transmission direction will be described. A processing example of the packet layer processing unit (52) will be described with reference to FIG. When the output side capsule number (326) and the IP packet are received via the core switch IF (184), these pieces of information are transferred to the lower layer processing units (53, 54) via the lower layer processing unit IF.

  The operation of the lower layer processing unit (ATM) (53) will be described with reference to FIG. The lower layer processing unit (ATM) (53) receives the output side capsule number (326) and the IP packet from the packet layer processing unit (52) via the packet layer processing unit IF (159). Next, the ATM header determination unit (157) generates an ATM header corresponding to the capsule header from the output side capsule number (326) using the header generation table (158). The ATM header and IP packet generated in this way are transformed into ATM cells by the ATM layer transmission processing unit (156) and transmitted to the ISP1 network through the physical layer transmission processing unit (155).

  FIG. 18 shows the configuration of the header generation table. The output side ATM header is output using the output side capsule number as a key. Thereby, the output side ATM header can be obtained from the output side capsule number.

  Similarly, the operation of the lower layer processing unit (IP capsule) (54) will be described with reference to FIG. The lower layer processing unit (IP capsule) (54) receives the output side capsule number (326) and the IP packet from the packet layer processing unit (52) via the packet layer processing unit IF (159). Next, the capsule header determination unit (177) uses the header generation table (178) to generate an IP capsule header and an output MAC address corresponding to the capsule header from the output capsule number (326). The IP capsule header, the output side MAC address, and the IP packet generated in this way are encapsulated by the capsule layer transmission processing unit (176) and transmitted to the ISP1 network through the physical layer transmission processing unit (175).

  FIG. 19 shows the configuration of the header generation table. The output-side IP capsule header and the output-side MAC address are output using the output-side capsule number as a key.

  An example of the configuration of the interwork router device has been described above. In the present embodiment, an example is shown in which the input side VPN number (320) and the output side capsule number (326) that are unified internally are used for the processes on the input side and the output side. However, the input key of the route search / VPN table may be an input side capsule header, or an output side capsule header may be directly generated as an output.

  The table shown in this embodiment is a logical table, and as a table search method, a method of obtaining an address by using a search algorithm typified by a tree structure and obtaining a desired output may be adopted. A configuration using CAM or a method of sequentially searching the table may be adopted.

FIG. 23 shows an example of an MIB (Management Information Base) configuration that is an interface for issuing an instruction from the NMS to the apparatus for setting the table of the present embodiment, and in which an agent is mounted on the control unit 50. The input capsule header Entry (500) is an MIB for setting the receiving side VPN table shown in FIG.
Similarly, the VPN cross-connect entry (501) is an MIB for setting the route search / VPN table (182) shown in FIG. Similarly, the output side capsule header Entry (502) is an example of the configuration of the header generation table. Information set in these MIBs is set from the NMS to the control unit (50), and the control unit (50) sets a table in each part in the interwork router.

Up to this point, the VPN interworking has been described focusing on the device configuration.
An application example of the interwork router in the network will be described with reference to FIGS.

  FIG. 20 shows an example in which two ISPs are connected via two interwork routers owned by each ISP. Between the two interwork routers, each VPN is identified by encapsulation (103b). Then, in each interwork router (10a, 10b), as described up to FIG. 19, the routing process is performed by the combination of the capsule header (103a, 103b, 103c) and the IP address.

  FIG. 21 shows an example in which two ISPs have their own interwork routers and are connected via IX that performs layer 3 processing. Each interwork router and IX are configured to identify each VPN by encapsulation (103b). In the interwork router (10a), IX (10c), and the interwork router (10b), as described up to FIG. 19, forwarding processing is performed by the combination of the capsule header (103a, 103b, 103c) and the IP address.

  FIG. 22 shows an example in which two ISPs have their respective interwork routers and the two ISPs are connected via IX. Here, IX is composed of a layer 2 device that does not perform layer 3 processing. Also in this case, each VPN is identified between each interwork router and IX by encapsulation (103b). In the interwork router (10a) and the interwork router (10b), as described up to FIG. 19, forwarding processing is performed using a combination of the capsule header (103a, 103b, 103c) and the IP address. IX performs forwarding by layer 2 forwarding.

  In the present invention, a VPN connection method between a plurality of ISPs has been described. However, even when there are a plurality of encapsulation areas in the same ISP, it is necessary to connect the VPNs with the same node configuration. Even in that case, the VPN can be connected by the method described in the present invention.

It is a conceptual diagram of the operation | work of the interwork router by this invention. It is the figure explaining the interwork system between several ISP in the case of using the conventional router. It is the figure explaining operation | movement of the interwork router by this invention using the protocol stack. It is a flowchart explaining the ISP interwork processing system by the conventional router. It is a flowchart explaining the operation | movement of the interwork router by this invention. It is a flowchart explaining the operation | movement of the interwork router by this invention. It is the figure explaining the connection form of the MPLS network by this invention and an IP encapsulation network using a protocol stack. It is a figure explaining ATM cell conversion of the IP packet by RFC1483. It is a figure explaining the IP packet format by RFC791. It is a figure explaining the structure of the IP tunnel packet by RFC1853. It is a figure explaining one structural example of the interwork router by this invention. It is a figure explaining 1 structural example of the lower layer process part of the interwork router by this invention. It is a figure explaining the structural example of the receiving side VPN number table in the lower layer process part by this invention. It is a figure explaining 1 structural example of the lower layer process part of the interwork router by this invention. It is a figure explaining the structural example of the receiving side VPN number table in the lower layer process part by this invention. It is a figure explaining 1 structural example of the packet layer process part of the interwork router by this invention. It is a figure explaining the structural example of the route search VPN table in the packet layer process part by this invention. It is a figure explaining the structural example of the header production | generation table in the lower layer process part by this invention. It is a figure explaining the structural example of the header production | generation table in the lower layer process part by this invention. It is a figure explaining the example of 1 application in the network of the interwork router by this invention. It is a figure explaining the example of 1 application in the network of the interwork router by this invention. It is a figure explaining the example of 1 application in the network of the interwork router by this invention. This is an interface for issuing an instruction from the NMS to the apparatus for setting the table of this embodiment.

Explanation of symbols

DESCRIPTION OF SYMBOLS 2 ... ISP network, 3 ... Edge node, 10 ... Interwork router apparatus, 50 ... Control part, 51 ... Core switch, 52 ... Packet layer processing part, 53 ... Lower layer processing part (ATM), 54 ... Lower layer processing part (IP capsule), 152 ... VPN number assigning unit, 153 ... receiving side VPN number table, 157 ... ATM header determining unit, 158 ... header generation table, 172 ... VPN number assigning unit, 173 ... receiving side VPN number table, 177 ... Capsule header determination unit, 178... Header generation table.

Claims (42)

A first communication network for providing a packet communication service to a user who performs communication using variable-length packets;
Similarly, there is a first communication network for providing a packet communication service to users who communicate with variable-length packets.
In the first communication network, in order to construct a closed network that does not mix a packet of a specific user with a packet of another user, it is special in order to transfer a variable length packet in the communication network. The first capsule header to be assigned to is attached at the entrance of the net and deleted at the exit of the net,
Similarly, in the second communication network, in order to configure a closed network that does not mix a packet of a specific user with a packet of another user, in the communication network, a variable length packet is transferred within the network. The second capsule header is added to the network at the entrance of the network and deleted at the exit of the network.
At a connection point between the first communication network and the second communication network, a first capsule header and variable are set for a specific user packet transferred from the first communication network to the second communication network. From the combination of long packet headers, generate a second capsule header for use in the second communication network and route selection to the second communication network.
For a specific user packet transferred from the second communication network to the first communication network, the route selection to the second communication network is made by the combination of the second capsule header and the header of the variable length packet. And generating a second capsule header for use in the first communication network,
A VPN (Virtual Private Network) configuration method using variable-length packet communication, characterized in that a closed network spanning the first network and the second network is configured.   2. The VPN configuration method according to claim 1, wherein an internet protocol is used for the variable-length packet communication method. 3. The VPN configuration method according to claim 2, wherein a capsule header according to the Internet protocol is used as an encapsulation header of the first network or the second network.   3. The VPN configuration method according to claim 2, wherein a header of an ATM communication method corresponding to a lower layer of the Internet protocol is used as an encapsulation header of the first network or the second network.   3. The VPN configuration method according to claim 2, wherein a header of an HDLC (PPP, frame relay) communication method corresponding to a lower layer of the Internet protocol is used as an encapsulation header of the first network or the second network.   3. The VPN configuration method according to claim 2, wherein a header of an MPLS (Multi-Protocol Layer Switching) communication method corresponding to a lower layer of the Internet protocol is used as an encapsulation header of the first network or the second network. . In order to provide a packet communication service for users who communicate using variable-length packets and to configure a closed network that does not mix packets of specific users with packets of other users, variable-length packets are used inside the communication network. On the other hand, there are multiple communication networks that have a configuration in which the first capsule header that is specially assigned to transfer in the network is assigned at the network entrance and deleted at the network exit, and a closed network can be configured ,
At each connection point, for a specific user packet transferred from the first communication network to the second communication network, the combination of the first capsule header and the header of the variable-length packet causes the second communication. Select a route to the network and generate a second capsule header to be used in the second communication network, and for a specific user packet transferred from the second communication network to the first communication network, Closed area spanning two communication networks by selecting a route to the second communication network and generating a second capsule header to be used in the first communication network from a combination of two capsule headers and variable length packet headers A VPN configuration method characterized by forming a closed network that spans multiple networks by configuring a network.   8. The VPN configuration method according to claim 7, wherein an Internet protocol is used for the variable-length packet communication method.   9. The VPN configuration method according to claim 8, wherein a capsule header based on an Internet protocol is used as an encapsulation header used in each network.   9. The VPN configuration method according to claim 8, wherein a header of an ATM communication method corresponding to a lower layer of the Internet protocol is used as an encapsulation header used in each network.   9. The VPN configuration method according to claim 8, wherein a header of an HDLC (PPP, frame relay) communication method corresponding to a lower layer of the Internet protocol is used as an encapsulation header used in each network.   9. The VPN configuration method according to claim 8, wherein a header of an MPLS (Multi-Protocol Layer Switching) communication method corresponding to a lower layer of the Internet protocol is used as an encapsulation header used in each network.   The encapsulation header used in each network has a packet transfer priority class, and at the connection point between the two networks, the encapsulation header used in the first network to which the packet has been transferred The VPN configuration according to claim 1, wherein the priority class information is mapped to a priority class area in the encapsulation header used in a second network to which packets are transferred. method.   The encapsulation header used in each network has a packet transfer priority class, and at the connection point between the two networks, the encapsulation header used in the first network to which the packet has been transferred 9. The VPN configuration according to claim 8, wherein the priority class information is mapped to a priority class area in the encapsulation header used in a second network to which packets are transferred. method. A first communication network for providing a packet communication service to a user who performs communication using variable-length packets;
Similarly, there is a first communication network for providing a packet communication service to users who communicate with variable-length packets.
In the first communication network, in order to construct a closed network that does not mix a packet of a specific user with a packet of another user, it is special in order to transfer a variable length packet in the communication network. The first capsule header to be assigned to is attached at the entrance of the net and deleted at the exit of the net,
Similarly, in the second communication network, in order to configure a closed network that does not mix a packet of a specific user with a packet of another user, in the communication network, a variable length packet is transferred within the network. The second capsule header is added to the network at the entrance of the network and deleted at the exit of the network.
An interwork router belonging to both networks is placed at the connection point of both networks,
In the interwork router device, for a specific user packet transferred from the first communication network to the second communication network, the combination of the first capsule header and the header of the variable length packet, Select a route to the communication network and generate a second capsule header to be used in the second communication network,
For the packet of a specific user transferred from the second communication network to the first communication network, the route selection to the first communication network is made by the combination of the second capsule header and the header of the variable length packet. And generating a first capsule header for use in the first communication network,
A VPN (Virtual Private Network) configuration method using variable-length packet communication, characterized in that a closed network spanning the first network and the second network is configured. A first communication network for providing a packet communication service to a user who performs communication using variable-length packets;
Similarly, there is a first communication network for providing a packet communication service to users who communicate with variable-length packets.
In the first communication network, in order to construct a closed network that does not mix a packet of a specific user with a packet of another user, it is special in order to transfer a variable length packet in the communication network. The first capsule header to be assigned to is attached at the entrance of the net and deleted at the exit of the net,
Similarly, in the second communication network, in order to configure a closed network that does not mix a packet of a specific user with a packet of another user, in the communication network, a variable length packet is transferred within the network. The second capsule header is added to the network at the entrance of the network and deleted at the exit of the network.
The connection points of both networks take the form in which interwork routers are arranged and the two interwork routers are connected to each other, and packets of specific users that connect to other networks are sent between the two interwork routers to other users. Transfer using an interwork capsule header to separate
For packets sent from the first network to the second network:
In the interwork router device of the first network, for a specific user packet transferred from the first communication network to the second communication network, a combination of the first capsule header and the header of the variable length packet More, the route selection to the second communication network and the interwork capsule header is generated and transferred to the interwork router device of the second network,
In the second network interwork router device, a route selection to the second communication network and a second capsule header used in the second communication network are generated from the interwork capsule header and the header information of the variable length packet,
For packets sent from the second network to the first network:
In the interwork router device of the second network, for a specific user packet transferred from the second communication network to the first communication network, a combination of the second capsule header and the header of the variable length packet More, the route selection to the first communication network and the interwork capsule header is generated and transferred to the interwork router device of the first network,
The first network interwork router device selects the route to the first communication network and generates the first capsule header to be used in the first communication network from the interwork capsule header and variable length packet header information. By
A VPN (Virtual Private Network) configuration method using variable-length packet communication, characterized in that a closed network spanning the first network and the second network is configured. A first communication network for providing a packet communication service to a user who performs communication using variable-length packets;
Similarly, there is a first communication network for providing a packet communication service to users who communicate with variable-length packets.
In the first communication network, in order to construct a closed network that does not mix a packet of a specific user with a packet of another user, it is special in order to transfer a variable length packet in the communication network. The first capsule header to be assigned to is attached at the entrance of the net and deleted at the exit of the net,
Similarly, in the second communication network, in order to configure a closed network that does not mix a packet of a specific user with a packet of another user, in the communication network, a variable length packet is transferred within the network. The second capsule header is added to the network at the entrance of the network and deleted at the exit of the network.
The connection points of both networks take the form in which interwork routers are arranged and both the interwork routers are connected via IX that identifies variable-length packets. To transfer a specific user's packet to be separated from other users' packets using an interwork capsule header,
For packets sent from the first network to the second network:
In the interwork router device of the first network, for a specific user packet transferred from the first communication network to the second communication network, a combination of the first capsule header and the header of the variable length packet From IX, select the route to the communication network and generate the interwork capsule header and transfer it to IX.
In IX, from the combination of the interwork capsule header and the variable length packet header, the route selection to the second communication network and the interwork capsule header are generated and transferred to the second interwork router,
In the second network interwork router device, a route selection to the second communication network and a second capsule header used in the second communication network are generated from the interwork capsule header and the header information of the variable length packet,
For the packet of a specific user transferred from the second communication network to the first communication network, the route selection to the first communication network is made by the combination of the second capsule header and the header of the variable length packet. And generate the interwork capsule header and transfer it to IX,
In IX, from the combination of the interwork capsule header and the variable length packet header, the route selection to the first communication network and the interwork capsule header are generated and transferred to the interwork router device of the first network,
The first network interwork router device selects the route to the first communication network and generates the first capsule header to be used in the first communication network from the interwork capsule header and variable length packet header information. By
A VPN (Virtual Private Network) configuration method using variable-length packet communication, characterized in that a closed network spanning the first network and the second network is configured. A first communication network for providing a packet communication service to a user who performs communication using variable-length packets;
Similarly, there is a first communication network for providing a packet communication service to users who communicate with variable-length packets.
In the first communication network, in order to construct a closed network that does not mix a packet of a specific user with a packet of another user, it is special in order to transfer a variable length packet in the communication network. The first capsule header to be assigned to is attached at the entrance of the net and deleted at the exit of the net,
Similarly, in the second communication network, in order to configure a closed network that does not mix a packet of a specific user with a packet of another user, in the communication network, a variable length packet is transferred within the network. The second capsule header is added to the network at the entrance of the network and deleted at the exit of the network.
The connection points of both networks take the form in which interwork routers are arranged, and both interwork routers are connected via IX that transfers by a lower layer without identifying variable-length packets. Then, in order to separate the packet of a specific user that connects to another network from the packet of another user, the packet is transferred using an interwork capsule header.
For packets sent from the first network to the second network:
In the interwork router device of the first network, for a specific user packet transferred from the first communication network to the second communication network, a combination of the first capsule header and the header of the variable length packet From IX, select the route to the communication network and generate the interwork capsule header and transfer it to IX.
In IX, with the interwork capsule header, the route selection to the second communication network and the interwork capsule header are generated and transferred to the second interwork router.
In the second network interwork router device, a route selection to the second communication network and a second capsule header used in the second communication network are generated from the interwork capsule header and the header information of the variable length packet,
For the packet of a specific user transferred from the second communication network to the first communication network, the route selection to the first communication network is made by the combination of the second capsule header and the header of the variable length packet. And generate the interwork capsule header and transfer it to IX,
In IX, with the interwork capsule header, the route selection to the first communication network and the interwork capsule header are generated and transferred to the interwork router device of the first network.
The first network interwork router device selects the route to the first communication network and generates the first capsule header to be used in the first communication network from the interwork capsule header and variable length packet header information. By
A VPN (Virtual Private Network) configuration method using variable-length packet communication, characterized in that a closed network spanning the first network and the second network is configured. Accommodates transmission lines connected to multiple networks, has a function to output variable length packets coming from each transmission line to the desired network,
At least two of the plurality of networks are encapsulated networks that encapsulate and transfer variable-length packets using a capsule header used inside the network,
When an encapsulated variable-length packet arrives from the first encapsulated network and is transferred to the second encapsulated network, the combination of the capsule header and variable-length packet header in the first network Encapsulation headers used in the second network are generated, output headers to the second network and encapsulation headers used in the second network are generated, and encapsulation headers used in the first network are deleted. An interwork router device, characterized by adding a header and outputting the second network.   20. The interwork router apparatus according to claim 19, wherein the variable length packet is an Internet protocol packet.   20. The interwork router apparatus according to claim 19, wherein an encapsulation protocol different from the encapsulation protocol of the first encapsulation network and the encapsulation protocol of the second encapsulation network are employed.   20. The interwork router apparatus according to claim 19, wherein a capsule header according to the Internet protocol is used as an encapsulation header of the first network or the second network.   20. The interwork router apparatus according to claim 19, wherein a header of an ATM communication system corresponding to a lower layer of the Internet protocol is used as an encapsulation header of the first network or the second network.   20. The interwork router apparatus according to claim 19, wherein a header of an HDLC (PPP, frame relay) communication method corresponding to a lower layer of the Internet protocol is used as an encapsulation header of the first network or the second network. .   20. The interwork router according to claim 19, wherein a header of an MPLS (Multi-Protocol Layer Switching) communication system corresponding to a lower layer of the Internet protocol is used as an encapsulation header of the first network or the second network. apparatus.   The encapsulation header used in each network has a packet transfer priority class, and at the connection point between the two networks, the encapsulation header used in the first network to which the packet has been transferred 20. The interwork router according to claim 19, wherein the priority class information is mapped to a priority class area in the encapsulation header used in a second network to which packets are transferred. apparatus.   Each transmission path is accommodated in the lower layer processing unit and connected to the core switch via the packet layer processing unit. The lower layer processing unit analyzes the capsule header of the arriving variable length packet. The in-device input VPN number to be used is generated from the capsule header, and the in-device VPN number and the variable length packet are transferred to the packet layer processing unit. The packet layer processing unit has the in-device input VPN number and the header of the variable length packet. The output route number and the in-device output capsule number are generated from the area information, and the core switch selects the packet layer processing unit connected to the desired transmission line according to the output route number, and the in-device output capsule number and The packet is transferred to the lower layer processing unit via the packet layer processing unit. Interwork router device according to claim 19, characterized in that the encapsulation by converting the capsule header for use in net output from the number.   A field for identifying QoS is provided in the in-device input VPN number and the in-device output VPN number, mapping is performed from the encapsulation header of the input side network to the QoS field of the input VPN number, and the packet layer processing unit receives the input VPN. The QoS field of the number is mapped to the QoS field of the output side VPN number, and the lower layer processing unit on the output side maps from the value of the QoS field of the output side VPN number to the field corresponding to the QoS of the output side encapsulation header 20. The interwork router apparatus according to claim 19, wherein the QoS information of the first network is transmitted to the QoS information of the second network by performing.   The CLP attached to the ATM header of variable length packets arriving from the first network, using an ATM header for the first network encapsulation protocol and IP encapsulation for the second network encapsulation protocol. The bit value is mapped to the TOS field of the IP capsule header on the second network side by the method described in claim 28, and the TOS value given to the IP capsule header of the variable-length packet coming from the second network is 29. The interwork router apparatus according to claim 28, wherein mapping is performed to the CLP field of the ATM header on the first network side by the method described in claim 28.   An IP packet is used as the variable-length packet, a fixed-length input VPN number is generated from the input encapsulation protocol, and an output route number and a fixed-length output VPN number are determined by a combination of the input VPN number and the header area of the IP packet. 20. The interwork router apparatus according to claim 19, wherein an encapsulation header is generated from the VPN number on the output side. Accommodates transmission lines connected to one network and has a function to output variable length packets coming from each transmission line to the desired network.
The one network is an encapsulated network that encapsulates and transfers variable length packets using a capsule header used inside the network,
When an encapsulated variable-length packet arrives and the packet is transferred to a desired route, the encapsulation used on the output-side transmission path and output side by combining the input-side capsule header and variable-length packet header An interwork router apparatus that generates a header, deletes an encapsulation header used on an input side, adds an encapsulation header used on an output side, and outputs the header to a second network. Accommodates transmission lines connected to multiple networks, has a function to output variable length packets coming from each transmission line to the desired network,
At least two of the plurality of networks are encapsulated networks that encapsulate and transfer variable-length packets using a capsule header used inside the network,
When an encapsulated variable-length packet arrives from the first encapsulated network and is transferred to the second encapsulated network, the combination of the capsule header and variable-length packet header in the first network Encapsulation headers used in the second network are generated, output headers to the second network and encapsulation headers used in the second network are generated, and encapsulation headers used in the first network are deleted. An interwork router device having a function of converting an encapsulation protocol by adding a header and outputting it to a second network. At the entrance of the first communication network, a packet having a header including destination information, to which a first capsule header used for configuring a closed network in the first communication network is added, is received, and the packet Is a packet communication method for transmitting to a second communication network,
When the packet with the first capsule header is received, the second capsule header used to configure a closed network in the second communication network from the header and the first capsule header. Produces
Removing the first capsule header from the packet provided with the first capsule header;
A packet communication method, wherein the second capsule header is added to the packet.   The packet communication method according to claim 33, wherein a route search is performed using the header and the first capsule header. At the entrance of the first communication network, a packet having a header including destination information, to which a first capsule header used for configuring a closed network in the first communication network is added, is received, and the packet Is transmitted to the second communication network, and when the packet with the first capsule header is received, the second communication network is received from the header and the first capsule header. Generating an index necessary for generating a second capsule header used to construct a closed network, removing the first capsule header from the packet provided with the first capsule header,
A packet communication method comprising: adding the second capsule header to the packet based on an index necessary for generating the second capsule header.   36. The packet communication method according to claim 35, wherein a route search is performed using the header and an index necessary to generate the second capsule header.   37. The packet communication method according to claim 33, wherein the packet is an IP (Internet Protocol) packet.   The packet communication method according to claim 37, wherein the first capsule header and the second capsule header use a capsule header according to an Internet protocol. In order to configure a closed network, a first communication network that adds a first capsule header to data to which a header including destination information is added, and destination information to configure the closed network therein A communication device that interconnects a second communication network that adds a second capsule header to data to which a header including
When the data with the first capsule header transmitted from the first communication network is received, a route search is performed using the header and the first capsule header, and the header and the first capsule are searched. A reception processing unit that generates the second capsule header from the header and removes the first capsule header and adds the generated second capsule header;
A communication apparatus comprising: a switch connected to the reception processing unit and transmitting data to which the second capsule header is attached in a route according to a result of the route search.   40. A transmission processing unit connected to the switch, wherein the data to which the second capsule header is attached is transmitted from the switch, and the data is transmitted to the second communication network. The communication device described. In order to configure a closed network, a first communication network that performs communication by adding a first capsule header to an IP (Internet Protocol) packet, and an IP packet to configure the closed network therein A packet relay device that mutually connects a second communication network that performs communication with a second capsule header attached thereto,
When receiving the IP packet with the first capsule header transmitted from the first communication network, the second capsule header is changed by the IP header in the IP packet and the first capsule header. Capsule header generation means to generate,
When receiving the IP packet to which the first capsule header is attached, which is connected to the capsule header creating means and is transmitted from the first communication network, the first capsule header is removed and the first capsule is removed. And a means for adding the second capsule header generated by the capsule header generation means to the IP packet from which the header has been removed. The capsule header generation means includes means for generating an index based on the IP header in the IP packet and the first capsule header, and the second capsule header according to the index generated by the means for generating the index. 42. The packet relay apparatus according to claim 41, further comprising: means for generating

Images