JP2007013901A - Premium packet identification apparatus, terminal device, premium packet identification system and premium packet identification method - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To provide a premium packet identification apparatus and the like for identifying a premium packet transmitted from a terminal device of a premium packet service contractor. <P>SOLUTION: A terminal device 10 houses a mask pattern table 133 that is the same as a router 200, and creates a premium packet using a bit mask described on the table. If packets 300 (300A, 300B) are received from terminal devices 10, 20, the router 200 performs arithmetic processing using a bit mask selected from a mask pattern table 233 stored in the router 200 and a payload bit streams of the packets 300 with a pattern number of a bit mask contained in headers of the packets 300 as a key. If a value of an arithmetic processing result is the same as a value of an arithmetic processing result contained in the headers of the received packets 300, such packets 300 are defined as a premium packet and priority control is performed thereon. <P>COPYRIGHT: (C)2007,JPO&INPIT

Description

  The present invention relates to a premier packet identification device, a terminal device, a premier packet identification system, and a premier packet identification method.

  Conventionally, in an IP (Internet Protocol) network, by using DiffServ (see Non-Patent Document 1) and prioritizing IP packets, an IP packet of a premium packet service subscriber and an IP packet of a non-subscriber And preferentially control IP packets from subscribers of the premier packet service.

In this DiffServ, the node on the IP packet transmission side sends a TOS (Type of Service) field in the header of an IPv4 (Internet Protocol version 4) IP packet or a Traffic Class in the header of an IPv6 (Internet Protocol version 6) IP packet. A value indicating the priority of the IP packet is put in the field and transmitted. Then, a router that performs route control (transfer control) of the IP packet refers to the value of the TOS field or the Traffic Class field, and determines whether or not the IP packet is an IP packet (premier packet) to be preferentially controlled. Is identified.
"RFC2474: Definition of the Differentiated Services Field (DS Field) in the IPv4 and IPv6 Headers", [online], [Search June 3, 2005], Internet, <URL: http://www.ietf.org /rfc/rfc2474.txt>

  However, since the value of the TOS field and the traffic class field of the IP packet can be easily rewritten by a third party, for example, a value that allows a non-contractor of the premium packet service to perform priority control in the TOS field of the IP packet is written. Therefore, there is a possibility of spoofing IP packets. That is, there is a possibility that a non-contractor of the premier packet service spoofs the IP packet and receives the premier packet service.

  It is an object of the present invention to solve the above-described problems and provide a premium packet identification device and the like for identifying a premium packet transmitted from a terminal device of a subscriber of a premium packet service.

  In order to solve the above problems, the present invention provides a premier packet identification comprising: a terminal device that transmits a premier packet that is a high priority IP packet; and a premier packet identification device that identifies the premier packet from the received IP packet. A premier packet identification device used in the system includes a storage unit that stores a mask pattern table indicating a bit mask of one or more patterns, an input / output unit that inputs and outputs IP packets, and the input / output unit An IP packet is received and an operation is performed using a bit mask selected from the mask pattern table and a bit string of the payload of the IP packet, using the identification number of the bit mask pattern included in the header of the received IP packet as a key Processing, and the value of the operation processing result is received. A processing unit that identifies the IP packet as a premier packet and preferentially processes the IP packet identified as the premier packet when the value is the same as the value of the arithmetic processing result included in the header of the IP packet . Other configurations will be described in the embodiments described later.

According to the present invention, the terminal device of the subscriber of the premier packet service creates and transmits an IP packet based on the same mask pattern table as the mask pattern table of the premier packet identification device. Therefore, the premier packet identification device identifies whether or not the received IP packet is an IP packet (premier packet) from a terminal device of a true premier packet service subscriber by referring to its own mask pattern table. can do. In other words, it is possible to prevent a third party from misrepresenting a premier packet.
In addition, since the premier packet identification device of the present invention rewrites the value of the TOS field or the traffic class field of a true premier packet (a premier packet that is not spoofed) with a high priority value, Priority control of the premier packet can be performed.

  Furthermore, conventionally, the identification of the premier packet by the router or the like has been performed by referring to the IP address of the node (terminal device) on the client side. However, according to the premier packet identification device of the present invention, the TOS field of the IP packet, It can be identified by referring to the value of the Traffic Class field or the Flow Label field. That is, the premium packet can be identified without depending on the IP address.

  The best mode (hereinafter, referred to as an embodiment) for carrying out the present invention will be described with reference to the drawings.

<< First Embodiment >>
First, a first embodiment of the present invention will be described. The first embodiment is characterized in that the router connected to the network (premier packet identification device in the claims) identifies whether or not the IP packet received from the node (terminal device) is a premier packet. To do. Note that the premier packet (premier IP packet) in the present embodiment is different from other IP packets in that a node (router or server) connected to the network processes preferentially over other IP packets. An IP packet to be processed. In the following description, an IP packet is abbreviated as a packet as appropriate.

(overall structure)
The overall configuration of the premium packet identification system according to the first embodiment will be described with reference to FIG. FIG. 1 is a diagram showing an overall configuration of the premium packet identification system according to the first embodiment. The premier packet identification system according to the present embodiment includes terminal devices 10 and 20, a network 700 such as the Internet or a LAN (Local Area Network), and a router 200 that connects the terminal devices 10 and 20 and the network 700. Is done. The terminal apparatuses 10 and 20 and the router 200 are connected via a transmission line such as a LAN, and the terminal apparatuses 10 and 20 and the router 200 transmit and receive data (packets 300) via this transmission line. Moreover, the terminal devices 10 and 20 are not limited to the number shown in FIG.

The terminal devices 10 and 20 are computers such as PCs (Personal Computers), and communicate via the router 200 and the network 700.
The terminal device 10 is a terminal device of a subscriber of the premier packet service, and stores the same mask pattern table 133 as the bit mask pattern table (mask pattern table) 233 stored in the router 200. This mask pattern table 133 shows a bit mask used for calculating a value to be written in the header of the premier packet and a pattern number of the bit mask.
The terminal device 20 is a terminal device of a non-contractor of the premier packet service and does not store the mask pattern table 133. Here, the premier packet transmitted from the terminal device 10 is referred to as a packet 300A, and the packet transmitted from the terminal device 20 is referred to as a packet 300B.
The mask pattern table 233 corresponds to the first mask pattern table in the claims, and the mask pattern table 133 corresponds to the second mask pattern table in the claims.

  When transmitting the packet 300A, the terminal device 10 selects an arbitrary bit mask from the mask pattern table 133, and performs an arithmetic process using this bit mask and the bit string of the payload of the packet 300A to be transmitted. Do. The arithmetic processing at this time is, for example, a logical product of the bit string of the payload of the packet 300A and the bit string of the bit mask. Then, the terminal device 10 writes the identification number (pattern number) of the selected bit mask pattern and the value of the operation processing result in the header of the packet 300 </ b> A, and transmits the result to the router 200. Details of the transmission procedure of the packet 300A (premier packet) at this time will be described later with reference to the drawings.

  The router 200 transfers the packet 300 (300A, B) transmitted from the terminal devices 10 and 20 to the network 700. At this time, the router 200 refers to the mask pattern table 233 stored in itself and the header information of the packet 300 transmitted from the terminal devices 10 and 20 to determine whether or not the packet 300 is a premier packet. (Identify). Here, when the router 200 determines that the packet 300 is a premier packet, priority control is performed on the packet 300. On the other hand, when the router 200 determines that the packet 300 is not a premium packet, priority control is not performed on the packet 300. Note that the priority control at this time may be such that the router 200 rewrites the value of the TOS field or the Traffic Class field of the packet 300 to a value having a high priority.

  Thus, in order for the router 200 to perform priority control of the packet 300, it is a condition that the terminal device that transmits the packet 300 includes the same mask pattern table 133 as that of the router 200. Therefore, a terminal device of a non-contractor who does not have this mask pattern table 133 cannot pretend a premier packet.

(Terminal device)
Next, the configuration of the terminal device 10 will be described using FIG. 2 with reference to FIG. 2A is a block diagram showing the hardware configuration of the terminal device of the subscriber of the premium packet service of FIG. 1, and FIG. 2B is a block diagram showing the terminal device of FIG. FIG.

  As shown in FIG. 2A, the terminal device 10 includes a CPU (Central Processing Unit) 110 that is an arithmetic processing unit, a main memory 120 that is a storage unit that the CPU 110 uses for arithmetic processing, and a CPU 110 that uses the arithmetic processing. A storage unit 130 that stores various data, a network interface 140 that is a communication interface with the router 200 in FIG. 1, and an input / output interface 150 are provided. The input / output interface 150 receives an input from an input device such as a keyboard and a mouse connected to the terminal device 10 and transfers the input to the CPU 110, the main memory 120, the storage unit 130, and the like. The input / output interface 150 outputs various data output from the CPU 110 to an output device such as a liquid crystal monitor. The main memory 120 is realized by a RAM (Random Access Memory) or the like, and the storage unit 130 is realized by a hard disk device or the like.

  The storage unit 130 stores a communication program 131 for the terminal device 10 to communicate and a premier packet creation program 132. In addition, a mask pattern table 133 is provided in a predetermined area. The mask pattern table 133 is a table in which a bit mask (a combination of data of “1” and “0”) is recorded for each pattern number (pattern identification information) of the bit mask.

  The premier packet creation program 132 and the mask pattern table 133 are distributed to the terminal device 10 by a network 700 or a computer-readable storage medium. The premium packet creation program 132 and the mask pattern table 133 are stored in the storage unit 130 via the network interface 140 and the input / output interface 150.

  The CPU 110 reads the communication program 131, the premier packet creation program 132, and the mask pattern table 133 in the storage unit 130 onto the main memory 120, and creates a packet 300A. The created packet 300A is transmitted to the router 200 via the network interface 140.

  Next, functions of the terminal device 10 will be described. As shown in FIG. 2B, the function of the terminal device 10 is divided into a storage unit 130, a processing unit 160, and an input / output unit 170.

  The storage unit 130 stores a mask pattern table 133. The processing unit 160 includes a packet creation processing unit 410, creates a premium packet (packet 300A) with reference to the bit mask of the mask pattern table 133, and sends the packet 300A via the input / output unit 170 to the router 200 of FIG. Send to. The packet creation processing unit 410 is realized by the CPU 110 executing the communication program 131 and the premium packet creation program 132. The input / output unit 170 controls input / output of data between the input device and output device connected to the terminal device 10 and the router 200. The input / output unit 170 is realized by the network interface 140 and the input / output interface 150.

(Premium packet creation procedure)
Here, a procedure in which the packet creation processing unit 410 in FIG. 2B creates a premium packet will be described with reference to FIG. FIG. 3 is a diagram illustrating a procedure in which the packet creation processing unit in FIG. 2B creates a premium packet.

  Here, the packet creation processing unit 410 creates an IPv4 packet 300. When the packet creation processing unit 410 creates a premier packet, the pattern number of the selected bit mask is written in the upper 4 bits of the TOS field (8 bits) of the packet 300, and the result of the arithmetic processing by the selected bit mask Is written in the lower 4 bits of the TOS field. In the present embodiment, an area in which a bit mask pattern number is written is referred to as a mask pattern field, and an area in which a value of an arithmetic processing result of the selected bit mask is written is referred to as an arithmetic processing result field. The mask pattern field and the operation processing result field are collectively referred to as an identification field.

  First, when receiving a premium packet creation command from the input / output unit 170 or the like, the packet creation processing unit 410 selects a bit mask from the mask pattern table 133 (S301). The selection of the bit mask here may be arbitrary.

The mask pattern table 133 stores bit masks of the number of patterns that can be expressed in the mask pattern field for each pattern number of the bit mask. Here, since the mask pattern field of the packet 300 is 4 bits, 2 ⁴ = 16 bit masks are stored in the mask pattern table 133. Each bit mask includes a bit (“1”). The number of bits (“1”) is the number that can be expressed in the operation processing result field. Here, since the calculation processing result field has 4 bits, a bit mask including 2 ⁴ = 16 “1” s is stored. That is, the mask pattern table 133 stores 16 patterns of bit masks including 16 “1” s.
For example, in the mask pattern table 133 of FIG. 3, the bit mask whose pattern number is “4” is “1110101010100011100011111000”. The number of digits (bit number) of the entire bit mask is 30 digits (30 bits) here, but is not limited to this.

For example, when the packet creation processing unit 410 selects a bit mask having a bit mask pattern number “4”, the packet creation processing unit 410 performs arithmetic processing using this bit mask and the bit string of the payload of the packet 300A to be transmitted. Here, the logical product of the bit mask and the bit string of the payload of the packet 300A to be transmitted is calculated. Then, the number of bits that are “1” as a result of the logical product is counted (S302). That is, when the logical product of the bit string of the payload of the packet 300A and the bit mask of the bit mask pattern number “4” is “100010101010100011000000111000”, the number of bits that are “1” is “11” "
Then, the packet creation processing unit 410 writes the bit mask pattern number “4” and the number of bits “11”, which is “1” as a result of the logical product, in the TOS field of the packet 300, and the premier packet (packet 300A) is created (S303). Then, the packet 300A is transmitted to the router 200 via the input / output unit 170 (S304).

Note that the bit string of the payload of the packet 300A used for the arithmetic processing by the packet creation processing unit 410 may be a bit string of a part (predetermined area) of the payload or the entire bit string.
Incidentally, when the terminal device 10 (and the router 200) performs arithmetic processing using a bit string of a part of the payload of the packet 300 (predetermined area), the area used for the arithmetic processing (for example, 30 bits) is in the bit string. Is determined between each node (the terminal device 10 and the router 200). Then, the storage unit 130 of the terminal device 10 stores information regarding which region in the bit string is used for the calculation process, and the same information is also stored in the storage unit 230 of the router 200. Then, the terminal device 10 and the router 200 refer to this information and set the bit string area used for the arithmetic processing to the same area.

FIG. 4A is a diagram illustrating the configuration of an IPv4 premier packet, and FIGS. 4B to 4D are diagrams illustrating the configuration of an IPv6 premier packet.
In the above description, an example in which the packet creation processing unit 410 writes the bit mask pattern number and the operation processing result in the TOS field (8 bits) of the IPv4 packet 300 as shown in FIG. However, the present invention is not limited to this.

For example, when the terminal device 10 transmits an IPv6 packet 300, the packet creation processing unit 410 includes a Traffic Class field (8 bits), a Flow Label field (20 bits), or a Traffic Class field (20 bits) of the IPv6 packet 300. The pattern number of the bit mask and the operation processing result are written in a field (28 bits) that is a combination of the 8 bits) and the Flow Label field (20 bits) (FIGS. 4B, 4C, and 4C). d)). For example, as shown in FIG. 4C, when 10 bits of the Flow Label field (20 bits) are allocated as the mask pattern field and the calculation result field, 2 ¹⁰ = 1024 patterns are used in total for the bit mask. And up to 1024 arithmetic processing results can be written.

(Router)
Next, the configuration of the router 200 will be described using FIG. 5 with reference to FIGS. FIG. 5A is a block diagram showing a hardware configuration of the router of FIG. 1, and FIG. 5B is a block diagram showing a functional development of the router of FIG.

  As shown in FIG. 5A, the router 200 includes a CPU 210 that is an arithmetic processing unit, a storage unit 230 that stores various data used by the CPU 210 for arithmetic processing, and a communication interface between the terminal device 10 and the network 700 shown in FIG. And a network interface 240.

The storage unit 230 includes a transfer control program 231 and a routing table 234 for performing transfer control of the packet 300 received by the CPU 210, a premier packet identification program 232 for determining whether or not the packet 300 is a premier packet, and And a mask pattern table 233. The mask pattern table 233 is the same as the mask pattern table 133 of the terminal device 10.
Various data stored in the storage unit 230 is input by the network 700 or a terminal device (such as a terminal device of a premium packet service provider) connected to the router 200.

  Next, the function of the router 200 will be described. As shown in FIG. 5B, the function of the router 200 is divided into a storage unit 230, a processing unit 260, and an input / output unit 270.

  The storage unit 230 stores a mask pattern table 233 and a routing table 234. The input / output unit 270 manages data input / output via the network 700 and data input / output between the terminal devices 10 and 20. The input / output unit 270 is realized by the network interface 240. The processing unit 260 identifies a premium packet and performs priority control (priority processing) of the identified premium packet. Therefore, the processing unit 260 includes a premier packet identification unit 241 and a transfer control unit 242.

When receiving the packet 300 via the input / output unit 270, the premier packet identification unit 241 identifies (verifies) whether or not the packet 300 is a premier packet with reference to the bit mask of the mask pattern table 233. Specifically, the premium packet identification unit 241 has the following functions.
(1) The value of the identification field in the header of the received packet 300 is checked, and the pattern number of the bit mask and the value of the operation result are read out.
(2) A bit mask corresponding to the read pattern number of the bit mask is selected from the mask pattern table 233. Next, arithmetic processing (for example, logical product operation) is performed using the bit string of the payload of the received packet 300 and the selected bit mask. Then, the calculation result value is compared with the calculation result value read from the packet 300. For example, when the arithmetic processing is a logical product, the number of bits that are “1” by the logical product of the bit mask read from its own mask pattern table 233 and the bit string of the payload of the packet 300, and read from the packet 300 Compare the logical product values.
(3) As a result of the comparison, if the value of the result of the arithmetic processing is the same, the packet 300 is determined to be a premium packet. On the other hand, if both values are not the same, the packet 300 is not determined to be a premier packet.

  The transfer control unit 242 refers to the routing table 234 and performs transfer control of the packet 300 (300A, B). Further, in the transfer control at this time, the transfer control unit 242 performs priority control (priority processing) for the packet 300 identified as the premium packet by the premium packet identification unit 241. This priority control is, for example, rewriting the value of the TOS field or the Traffic Class field of the header of the packet 300 to a value having a high priority, and then transmitting it to the network 700 via the input / output unit 270.

  Next, the operation procedure of the terminal device 10 and the router 200 will be described using FIG. 6 with reference to FIGS. FIG. 6 is a flowchart showing the operation of the terminal device and the router of FIG.

  First, the packet creation processing unit 410 of the terminal device 10 starts creating a premium packet based on an instruction input or the like input via the input / output unit 170.

  The packet creation processing unit 410 that has received an instruction input via the input / output unit 170 selects a bit mask from the mask pattern table 133 (S601).

  Next, arithmetic processing is performed using this bit mask and the bit string of the payload of the packet 300 to create a premium packet (packet 300A) (S602).

  The packet creation processing unit 410 transmits the created premium packet to the router 200 via the input / output unit 170 (S603).

  When receiving the packet 300 from the terminal device 10 via the input / output unit 270, the premier packet identification unit 241 of the router 200 refers to the mask pattern table 233 and identifies whether or not the packet 300 is a premier packet. (S611). The identification procedure at this time is as described above.

  Next, the transfer control unit 242 performs transfer control on the received packet 300 with reference to the routing table 234. Here, when the packet 300 is a premier packet (Yes in S612), the transfer control unit 242 performs priority control on the packet 300 (S613). Specifically, the transfer control unit 242 rewrites the value of the TOS field or the Traffic Class field of the packet 300 to a value with high priority, and then transmits the value to the network 700 via the input / output unit 270.

  On the other hand, when the received packet 300 is not a premier packet (No in S612), the transfer control unit 242 rewrites the value of the TOS field or the Traffic Class field of this packet 300 to a value with a low priority (S614). The data is transmitted to the network 700 via the output unit 270.

  As described above, the router 200 identifies a true premier packet among the received packets 300. Therefore, the router 200 can provide a premium packet service such as priority control of the packet 300 to a true subscriber of the premium packet service.

  In S601 of FIG. 6, the packet creation processing unit 410 may select a different bit mask each time a premium packet is created, or the same bit mask is used until communication with the router 200 is completed. You may do it. Even if the packet creation processing unit 410 uses the same bit mask until the communication is completed, the bit string of the payload of the packet 300 is different for each packet 300, so the possibility that the premier packet is spoofed is extremely low. . Further, if the packet creation processing unit 410 selects a different bit mask each time a premium packet is created, the possibility that the premium packet is spoofed can be further reduced.

In the above-described embodiment, the transfer control unit 242 rewrites the value of the TOS field or the Traffic Class field of the header of the packet 300 identified as the premier packet with a high priority value, and performs priority control in the network 700. However, it is not limited to this.
For example, information on the network (or server 80) to which the premium packet is transferred is written in the routing table 234, and the transfer control unit 242 refers to the routing table 234 to send the premium packet to a predetermined network (or server). 80).

The configuration of the premium packet identification system at this time will be described with reference to FIG. 7 (see FIGS. 1 to 6 as appropriate). FIG. 7 is a diagram showing a modification of the premium packet identification system of FIG. Constituent elements similar to those of the above-described embodiment are denoted by the same reference numerals and description thereof is omitted.
Note that the servers 80 (80A, B) in FIG. 7 are computers (for example, Web servers) connected to the network 700 via the router 200. The server 80A is a server that processes the packet 300A transmitted from the terminal device 10 of the subscriber of the premium packet service, and the server 80B is a server that processes other packets 300 (300B).

  For example, when the router 200 receives the packet 300A that is a premier packet, the packet 300A is transferred to the server 80A (or the network to which the server 80A belongs) with reference to the routing table 234 in FIG. On the other hand, when the router 200 receives the packet 300B other than the premier packet, the router 200 refers to the routing table 234 and transfers it to the server 80B (or the network to which the server 80B belongs). That is, it is determined whether or not the packet 300 received by the router 200 is a premier packet, and the transfer destination of the packet 300 is distributed according to the result.

  By doing so, for example, the packet 300A transmitted from the terminal device 10 of the subscriber of the premier packet service is processed by the server 80A for the service subscriber, for example, the distribution of the access destination of the packet 300, Restrictions can be made.

<< Second Embodiment >>
Subsequently, a second embodiment of the present invention will be described. FIG. 8 is a diagram illustrating a configuration of the premium packet identification system according to the second embodiment. Constituent elements similar to those in the first embodiment described above are denoted by the same reference numerals, and description thereof is omitted.

  The premium packet identification system according to the second embodiment is characterized in that a server 90 such as a Web server identifies a premium packet instead of the router 200 according to the first embodiment. That is, the terminal device 10 stores the same mask pattern 133 as the mask pattern table 233 of the server 90. Then, the server 90 (the premier packet identification device in the claims) refers to the mask pattern table 233 to identify whether or not the packet 300 (300A, B) received from the terminal device 10, 20 is a premier packet. Do. Then, the server 90 preferentially processes the packet 300 (300A) identified as the premier packet, or executes a predetermined process in response to a command based on the premier packet. Further, when the server 90 receives a packet 300 (300B) other than the premier packet, the server 90 may not perform preferential processing on the packet 300 (300B) or may restrict access. The terminal devices 10 and 20 and the server 90 are not limited to the number shown in FIG.

(server)
The configuration of the server 90 will be described with reference to FIG. FIG. 9A is a block diagram showing the hardware configuration of the server of FIG. 8, and FIG. 9B is a block diagram showing the function of the server of FIG.

  The server 90 includes a CPU 910, a main memory 920, a storage unit 930 that stores various data used by the CPU 910 for arithmetic processing, a network interface 940 that is a communication interface with the network 700 in FIG. 8, and an input / output interface 950. Prepare.

  The storage unit 930 stores a mask pattern table 233 for a communication program 931 for the server 90 to communicate via the network 700 and a premier packet identification program 232. The mask pattern table 233 is the same as the mask pattern table 133 of the terminal device 10 shown in FIG. Various data stored in the storage unit 930 is input by the network 700 or an input device connected to the server 90.

  The function of the server 90 having such a configuration is divided into a storage unit 930, a processing unit 960, and an input / output unit 970, as shown in FIG. 9B.

The storage unit 930 stores a mask pattern table 233.
The input / output unit 970 manages data input / output via the network 700. The input / output unit 970 is realized by the network interface 940 and the input / output interface 950.
The processing unit 960 identifies the premier packet and performs preferential processing of the premier packet. Therefore, the processing unit 960 includes a premier packet identification unit 241 and a packet processing unit 942. The premium packet identifying unit 241 refers to the mask pattern table 233 as in the first embodiment, and identifies whether or not the received packet 300 is a premium packet. The processing unit 960 is realized by the CPU 910 executing each program in the storage unit 930.

  The packet processing unit 942 preferentially processes the packet 300 (300A) identified as the premier packet by the premier packet identification unit 241 over the other packet 300 (300B), or the command transmitted by the packet 300 (300A). A predetermined process is executed according to the above. For example, when a data transmission request is made by the packet 300 (300A), data stored in the storage unit 930 is read in response to the request and transmitted to the terminal device 10 or a program stored in the storage unit 930 Start up or execute. Further, when a packet 300B other than the premier packet is received, access restriction may be performed on the packet 300B, and when a premier packet (packet 300A) is received, access restriction may not be performed.

  In this way, by allowing the server 90 to identify the premier packet, it is possible to provide the premier packet service to the terminal device 10 of the subscriber of the true premier packet service. That is, it is possible to prevent a non-contractor of the premier packet service from spoofing the packet 300 and receiving the premier packet service.

  Further, according to the above-described embodiment, the router 200 and the server 90 can provide services to subscribers of the premium packet service regardless of the IP address of the transmission source included in the packet 300. In other words, the premium packet service can be provided to the subscriber regardless of the network or line to which the terminal device 10 of the subscriber of the premium packet service belongs.

  In the above-described embodiment, as shown in FIGS. 4A and 4B, the TOS field (8 bits) of the header of the IPv4 packet 300 or the Traffic Class field (8 bits) of the header of the IPv6 packet 300 is used. In the above description, the upper 4 bits are assigned to the mask pattern field and the lower 4 bits are assigned to the operation processing result field. However, the present invention is not limited to this as long as the total number of bits assigned to each field is 8 bits.

For example, the number of bits assigned to the mask pattern field may be 3 bits, and the number of bits assigned to the operation processing result field may be 5 bits. In this case, the number of bit mask patterns stored in the mask pattern tables 133 and 233 is 2 ³ = 8 patterns, and the total number of “1” bits stored in each bit mask is 2 ⁵ = 32. Just keep it.

  Also, when the Flow Label field (20 bits) of the IPv6 packet 300 is used as the identification field, the total number of bits allocated to the mask pattern field and the operation processing result field may be 20 bits. The total number of bits allocated to the mask pattern field and the calculation processing result field is also used when a field (28 bits) that is a combination of the Traffic Class field (8 bits) and the Flow Label field (20 bits) of the IPv6 packet 300 is used. The value may be 28 bits. That is, the number of bit mask patterns stored in the mask pattern tables 133 and 233 and the number of “1” bits stored in each bit mask may be determined in accordance with the number of bits assigned to each field. .

  In addition, the arithmetic processing performed for the premier packet creation by the terminal device 10 and the premier packet identification by the router 200 or the server 90 is simple arithmetic processing such as logical product of the bit string of the bit mask and the bit string of the payload of the packet 300. It is preferable to do this. When the terminal device 10 creates a premier packet, or when the router 200 or the server 90 identifies a premier packet, the processing load can be reduced if simple arithmetic processing such as logical product is performed. Because. In particular, if the terminal device 10 changes the bit mask each time a premier packet is created and wants to lower the probability that the premier packet is spoofed, if the processing load per premier packet is reduced, a large amount of This reduces the processing load when transmitting a premier packet. Further, although these arithmetic processes have been described as being performed by program execution processes by the CPUs 110, 210, and 910, they may be performed by a dedicated circuit or the like.

  Further, the terminal device 10 accepts a selection input as to whether or not to transmit a premier packet from an input device or the like, and in response to this, transmits a premier packet or a normal packet 300 (a packet 300 that is not a premier packet). Or send it. That is, the subscriber of the premier packet service may selectively input to the terminal device 10 so that the terminal device 10 can switch between communication using the premier packet service and communication not using the premier packet service. . Other modifications can be made without departing from the spirit of the present invention.

It is the figure which showed the whole structure of the premium packet identification system of 1st Embodiment. (A) is the block diagram which showed the hardware constitutions of the terminal device of the subscriber of the premium packet service of FIG. (B) is the block diagram which expanded and showed the function of the terminal device of (a). It is the figure explaining the procedure in which the packet preparation process part of FIG.2 (b) produces a premier packet. (A) is the figure which illustrated the structure of the premium packet of IPv4. (B)-(d) is the figure which illustrated the structure of the premium packet of IPv6. FIG. 2A is a block diagram illustrating a hardware configuration of the router in FIG. 1. (B) is a block diagram showing a functional expansion of the router of (a). It is the flowchart which showed operation | movement of the terminal device and router of FIG. It is the figure which showed the modification of the premium packet identification system of FIG. It is the figure which showed the structure of the premium packet identification system of 2nd Embodiment. It is the block diagram which showed the hardware constitutions of the server of FIG. (B) is the block diagram which expanded and showed the function of the server of (a).

Explanation of symbols

10,20 terminal device 80 (80A, B), 90 server 110,210,910 CPU
120,920 Main memory 130,230,930 Storage unit 131,931 Communication program 132 Premier packet creation program 133 Mask pattern table (second mask pattern table)
233 mask pattern table (first mask pattern table)
140,940 Network interface 150,950 Input / output interface 160,960 Processing unit 170,270,970 Input / output unit 200 Router 231 Transfer control program 232 Premier packet identification program 234 Routing table 240 Network interface 241 Premier packet identification unit 242 Transfer control unit 260,960 processing unit 300 (300A, B) packet 410 packet creation processing unit 700 network 942 packet processing unit

Claims (10)

A premier packet identification device used in a premier packet identification system comprising a terminal device that transmits a premier packet, which is a high priority IP packet, and a premier packet identification device that identifies the premier packet from the received IP packet,
A storage unit for storing a mask pattern table indicating bit masks of one or more patterns;
An input / output unit for inputting / outputting IP packets;
The IP packet is received via the input / output unit, and the bit mask selected from the mask pattern table is used as an identification number of the bit mask pattern included in the header of the received IP packet, and the IP packet An arithmetic processing is performed using a bit string of the payload, and when the value of the arithmetic processing result is the same as the value of the arithmetic processing result included in the header of the received IP packet, the IP packet is identified as a premier packet. A processing unit for preferentially processing the IP packet identified as the premier packet;
A premier packet identification device comprising: Preferential processing of IP packets by the processing unit is as follows:
The value of the TOS (Type of Service) field or the Traffic Class field of the IP packet identified as the premier packet is rewritten to a high priority value, and the rewritten IP packet is transferred to the network via the input / output unit. The premier packet identification apparatus according to claim 1, which is a process. A terminal device used in a premier packet identification system comprising a terminal device that transmits a premier packet, which is a high priority IP packet, and a premier packet identification device that identifies the premier packet from the received IP packet,
An input / output unit for inputting / outputting IP packets;
A storage unit for storing a second mask pattern table indicating a bit mask of one or more patterns same as the first mask pattern table stored in the premier packet identification device;
The arithmetic processing is performed based on the bit mask selected from the second mask pattern table and the bit string of the payload of the IP packet to be transmitted as a premier packet, the value of the arithmetic processing result, and the bit mask used for the arithmetic processing A packet creation processing unit that transmits an IP packet in which the identification number of the pattern is written in the header to the premier packet identification device via the input / output unit;
A terminal device comprising: The packet creation processing unit
The value of the arithmetic processing result and the identification number of the bit mask pattern used for the arithmetic processing are written in the TOS (Type of Service) field, the Traffic Class field, or the Flow Label field of the header of the IP packet. The terminal device according to claim 3.   A premium packet identification system comprising the premium packet identification device according to claim 1 or 2 and the terminal device according to claim 3 or claim 4.   6. The premium packet identification system according to claim 5, wherein the arithmetic processing is a logical product of a bit string of the bit mask and a bit string of a predetermined area in the payload of the IP packet. A premier packet identification method for identifying a premier packet which is a high priority IP packet from received IP packets,
An input / output unit that performs input / output of an IP packet, a storage unit that stores a mask pattern table indicating a bit mask of one or more patterns, and identifies the premium packet with reference to the mask pattern table, and the premium packet A premier packet identification device comprising a processing unit that preferentially processes IP packets identified as
Receiving, via the input / output unit, an IP packet including an identification number of a pattern of a bit mask and a value of an arithmetic processing result using the bit mask and a bit string of a payload of its own IP packet in a header;
A step of performing arithmetic processing using a bit mask selected from the mask pattern table and a bit string of the payload of the received IP packet, using the identification number of the bit mask pattern included in the header of the received IP packet as a key When,
Identifying the received IP packet as a premier packet when the value of the operation result is the same as the value of the operation result included in the header of the received IP packet;
Preferentially processing IP packets identified as the premier packets;
A premier packet identification method comprising: Preferentially processing the IP packet comprises:
Rewriting the value of the TOS (Type of Service) field or the Traffic Class field of the IP packet identified as the premier packet to a high priority value, and transferring the rewritten IP packet to the network. The premier packet identification method according to claim 7.   9. The premium packet identification method according to claim 7, wherein the arithmetic processing is a logical product of a bit string of the bit mask and a bit string of a predetermined area in the payload of the IP packet. A premier packet identification method using a terminal device that transmits a premier packet, which is a high-priority IP packet, and a premier packet identification device that identifies the premier packet from the received IP packet,
An input / output unit for inputting / outputting an IP packet, and a storage unit for storing a second mask pattern table indicating a bit mask of one or more patterns same as the first mask pattern table stored in the premier packet identification device And a terminal device comprising a packet creation processing unit that creates a premium packet with reference to the second mask pattern table,
Selecting a bit mask from the second mask pattern table;
Performing arithmetic processing using the selected bit mask and a bit string of a payload of an IP packet to be transmitted as a premier packet;
Transmitting the IP packet in which the identification number of the pattern of the bit mask used for the arithmetic processing and the value of the arithmetic processing result are written in a header to the premier packet identification device via the input / output unit;
Run
An input / output unit for inputting / outputting an IP packet, a storage unit for storing the first mask pattern table, a premium packet is identified with reference to the mask pattern table, and the IP packet identified as the premium packet is A premier packet identification device comprising a processing unit for preferential processing;
Receiving an IP packet via the input / output unit;
Using a bit mask pattern identification number included in the header of the received IP packet as a key, an operation is performed using the bit mask selected from the first mask table pattern table and the bit string of the payload of the received IP packet Processing steps;
Identifying the received IP packet as a premier packet when the value of the operation result is the same as the value of the operation result included in the header of the received IP packet;
Preferentially processing IP packets identified as the premier packets;
A premier packet identification method comprising:

Images