JP2007028084A - Network and its management method - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To provide a highly convenient network by eliminating the problems of interference, leak, tapping, and band occupation, and the problem of network connection to one's own system in a shared space, and to provide its management method. <P>SOLUTION: A management server 1 registers relating information between additional information such as a VLAN tag or VPN header to be added to a packet and identification information such as an SSID, and writes the relating information in whole radio access points 3a-3d. Radio terminals 5a-5c, 5a', 5b' performs radio communication with one of the access points 3, so that the additional information such as the VLAN tag related to the identification information such as the SSID is added to the packet and transmitted to a backbone. On the contrary, when the communication is performed with the applicable radio terminal by using the identification information corresponding to the additional information of the packet received from the LAN in the system, the terminal becomes communicable with a server, etc. , which is connected to the LAN of one's own system. <P>COPYRIGHT: (C)2007,JPO&INPIT

Description

  The present invention relates to a network in which a part of a network is shared by a plurality of organizations and used mutually, and a management method thereof.

  In general, wireless LAN devices can be easily installed and can be easily set up until the start of use, so their use has been rapidly expanding in recent years.

  For example, wireless LAN devices are individually installed and set in units of organizations such as tenants in one office building or units such as departments in a company building.

  In a wireless LAN using such a wireless device, the following measures have been taken to avoid mutual interference with other adjacent wireless LAN devices.

  (1) A communication collision is avoided by the CDMA / CA method.

  (2) A distinction from other device groups is made, and a group identifier (ESSID) is set in order to avoid interference (see Non-Patent Document 1).

  (3) A function called FDMA automatically detects surrounding radio wave conditions and automatically sets available frequencies (channels). Alternatively, in a wireless LAN device without the function, the channel is manually set to a channel that seems to be not used much.

(4) A password is set in order to prevent others from using the encryption technology called WEP / WPA.
Incept Co., Ltd., IT Glossary “ESSID”, [online], [Search July 7, 2005], Internet <http://e-words.jp/w/ESSID.html>

  However, until now, for the purpose of use in each of the above-mentioned organizations, each organization has individually set up and installed a wireless LAN without being conscious of the wireless LANs installed in other organizations. Therefore, the following problems have become apparent.

  (1) Even with the above-described functions for preventing interference of conventional wireless LAN devices, mutual interference occurs depending on the increase in the number of wireless LAN devices and the operation method.

  (2) The wireless space cannot be used effectively and is wasteful. Therefore, the response is lowered.

  (3) When a problem occurs in a network using a wireless LAN, the partner to be adjusted is not clear.

  (4) Even if interference with other wireless LAN devices in the vicinity is obvious, secrets of each other are easily leaked during adjustment with the other party. It is also necessary to make adjustments (contracts) for the number of combinations of organizations. For example, if six tissues are adjacent, adjustment of 6 * 5/2 = 15 is necessary.

  (5) It is difficult to accommodate a bandwidth (communication speed) or the like according to the usage status of the wireless LAN.

  (6) It is necessary for each organization to maintain the operation of the network and to ensure safety. If the network is expanded or used without having the correct knowledge, there is a risk of eavesdropping.

  (7) Since the communication band (speed) occupies as much as possible without being interchanged with each other, it is difficult to create a mechanism that bears the cost according to the amount used, such as electricity and gas. It is.

  (8) For example, a network cannot be used in a space shared by a plurality of organizations.

  The above-described problem has been described mainly with respect to the use of a wireless LAN, but the same problem as in the above (8) also occurs in a wired LAN.

  SUMMARY OF THE INVENTION An object of the present invention is to provide a network and a management method thereof that have improved the convenience by solving the various problems described above.

In order to solve the above-described problem, the present invention is configured as follows.
(1) In a network in which terminals belonging to a plurality of organizations and LANs in each organization are connected to the backbone, additional information (VLAN tag or VPN header that encapsulates an IP packet) added to the packet is identified. A management server that stores association information with information (SSID, user ID) is connected to the backbone, and identification information (SSID, user ID, etc.) sent from the terminal based on the association information from the management server Or additional information corresponding to the authentication result (MAC address or the like) from the means for authenticating the identification information is added to the packet received from the terminal and sent to the backbone and received from the LAN in the organization. Using the identification information corresponding to the additional information added to the received packet. Terminal communication means (access point, authentication switching HUB, etc.), and additional information representing the organization is added to the packet received from the LAN in the organization, and the additional information of the packet received from the backbone is removed and the packet is removed. Organization LAN communication means (VLAN HUB, VPN router, etc.) for sending out to the LAN in the organization.

  (2) The identification information sent from the terminal is a user ID and an authentication key, and the management server stores the association between the organization domain name included in the user ID and the additional information, and based on the identification information For example, an authentication server that authenticates according to IEEE802.1X is connected to the backbone, and the terminal communication means performs authentication with the authentication server based on the identification information sent from the terminal.

  (3) The identification information sent from the terminal includes the MAC address of the terminal, and the management server associates the MAC address of the terminal authenticated by the authentication server with the additional information. That is, user authentication and MAC authentication are combined.

  (4) The terminal is a wireless terminal, the terminal communication means is a wireless access point that communicates with the wireless terminal, and the identification information is a wireless identification code (SSID).

  (5) The backbone is the Internet, the management server is connected to the Internet, and the terminal communication means is a VPN-compatible wireless router connected to the Internet.

  (6) The management server includes means for extracting information relating to the communication packet amount from the terminal communication means and obtaining billing data corresponding to the communication packet amount, and means for outputting the billing data. .

  (7) The terminal communication means includes means for performing communication quality (QoS) control, and the management server includes means for setting information relating to communication quality (QoS) to the terminal communication means.

  (8) According to the network management method of the present invention, a plurality of wireless devices (access points) that use the same wireless space are connected to the wireless terminal so that a wireless communication environment with little interference is obtained. Communication) between the wireless terminal and a node connected to the LAN in the organization to which the wireless terminal belongs via the wireless device (access point) and the wireless device (access point). A virtual line is configured to perform charging according to the use status of the communication.

  (9) Further, the network management method of the present invention provides a wireless communication environment in which a plurality of wireless devices (access points) that use the same wireless space have a low interference with a wireless terminal. (Access point) is arranged and set, and the wireless device (access point) and the wireless device (access point) are connected between the wireless terminal and a node connected to the LAN in the organization to which the wireless terminal belongs. A virtual circuit for performing communication is configured, and communication parameters of the wireless device (access access point) are set in accordance with a usage contract for the virtual circuit.

(1) Based on the association information from the management server, the terminal communication means adds additional information corresponding to the identification information sent from the terminal to the IP packet received from the terminal and sends it to the backbone, and the LAN in the organization Additional information representing the organization in the IP packet received from the LAN in the organization by the organization LAN communication means to communicate with the corresponding terminal using the identification information corresponding to the additional information added to the packet received from the organization Since the additional information of the packet received from the backbone is removed and the packet is sent out to the organizational LAN, the terminal can connect to the LAN in the organization to which the terminal belongs only by communicating with the terminal communication means. Can do. In this way, a virtual circuit is configured by associating the additional information of the packet with the identification information of the terminal, and each virtual circuit can be assigned to each organization.
(2) The terminal communication means uses the user ID and authentication key sent from the terminal as identification information, and the authentication server performs authentication based on the identification information based on the user ID and the authentication key. By associating with the additional information, the terminal can connect to the LAN in its own organization through any terminal communication means using the user ID and the authentication key.

  (3) The identification information sent from the terminal includes the MAC address of the terminal, and the management server associates the MAC address of the terminal authenticated by the authentication server with the additional information. After being authenticated, the terminal can connect to the LAN in its own organization via the virtual circuit based on the MAC address.

  (4) The terminal is a wireless terminal, the terminal communication means is a wireless access point that communicates with the wireless terminal, and the identification information is a wireless identification code, so that wireless communication is performed within the service area of the wireless access point. It is possible to connect to the local organization LAN simply by using a terminal.

  (5) Since the backbone is the Internet, the management server is connected to the Internet, and the terminal communication means is a VPN-compatible wireless router connected to the Internet, each organization is connected to the Internet. Under such circumstances, each wireless terminal can connect to a LAN in each organization using VPN.

  (6) Since the management server extracts information related to the amount of communication packets from the terminal communication means and obtains charging data according to the information, it is possible to provide a service that charges according to the use status of the communication. Become.

  (7) By configuring the terminal communication means to perform communication quality control and setting the management server to set information related to communication quality for the terminal communication means, the network can be used efficiently for each organization. Each organization can use the network bandwidth effectively.

  (8) A wireless device is arranged and set so that a plurality of wireless devices using the same wireless space do not interfere with each other with the wireless terminal, and the wireless terminal and the organization to which the wireless terminal belongs A wireless circuit and a virtual circuit that communicates with the node connected to the LAN are configured, and charging is performed according to the use status of the communication. For example, electricity, gas, As with telephones, services such as network segmentation sales can be provided.

  (9) The wireless device is arranged and set so that a plurality of wireless devices using the same wireless space do not interfere with each other with the wireless terminal, and the wireless terminal and the organization to which the wireless terminal belongs By configuring the wireless device and a virtual circuit for communication via the wireless device with a node connected to the internal LAN, and setting communication parameters of the wireless device in accordance with the usage contract for the virtual circuit The communication quality according to the contract (fee) can be ensured, and for example, the problem that the use efficiency (communication quality) of another organization is reduced due to the exhaustion of a network bandwidth by one organization can be solved.

A network according to the first embodiment will be described with reference to FIGS.
First, FIG. 1 shows an example of an organization and a configuration example of a wireless LAN in a building or one floor of a building, for example. (A) is a conventional example. In this way, when the six organizations of the Human Resources Department, General Affairs Department, Development Department, Research Department, Sales Department, and Corporate Planning Department each independently install and set up wireless LAN devices, their access points and wireless terminals ( If the channels used with a notebook computer or the like are the same, mutual interference becomes a problem.

  On the other hand, in the embodiment of the present invention, as shown in (B), the wireless space used in each organization is managed, and each organization maximizes the wireless space without knowing the state of the wireless device of the adjacent organization. Make it available effectively.

  The network according to the first embodiment performs communication between a wireless terminal and a node connected to a LAN of an organization to which the wireless terminal belongs by effectively using a wireless space using an SSID and a VLAN. It is set and operated as follows.

(1) Assign an SSID for each organization to be carved.
(2) A virtual LAN (hereinafter referred to as “VLAN”) is allocated to each organization to be separated.
(3) A management VLAN (for example, “VLAN2”) is allocated to the management server.

(4) Build a backbone LAN for wireless LAN.
Wireless access points (hereinafter referred to as “AP”) are collectively installed on a wired communication network for wireless LAN that can recognize VLAN tags. Install in the same way in each organization and common space. APs are arranged and set so that wireless communication can be performed best without being restricted by an organization.

(5) Connect the wired LAN and wireless LAN backbone LAN in each organization.
At the connection point between the wired LAN and the wireless LAN backbone LAN in each organization, the VLAN tag packet of the organization to which it belongs is accepted, and the VLAN tag is removed and returned to the standard LAN packet. A device (usually a switching hub with a VLAN function or an L3 switch) having a function of sending to a wired LAN is installed. Also, with this device, a VLAN tag of the corresponding organization is attached to a packet sent to the wireless LAN.

(6) The AP communicates by associating the SSID and the VLAN tag.
The AP associates the SSID and the VLAN tag in accordance with the instruction of the management server that communicates with the “VLAN 2”.
For example,
A packet from “VLAN3” is sent to the wireless terminal of SSIDA, and a packet from SSIDA is sent to “VLAN3”.
A packet from “VLAN4” is sent to the wireless terminal of SSIDB, and a packet from SSIDB is sent to “VLAN4”.
A packet from “VLAN5” is sent to the SSIDC wireless terminal, and a packet from SSIDC is sent to “VLAN5”.
The VLAN 2 is handled by the AP itself as a management communication LAN.

(7) The wireless terminal communicates with the SSID of the organization to which it belongs.
That is,
Wireless terminals belonging to the organization A communicate with each other using SSIDA.
Wireless terminals belonging to the organization B communicate with each other through SSIDB.
Wireless terminals belonging to the organization C communicate with each other by SSIDC.
As a result, any access point is connected to the LAN of its own organization.

  Since this relationship does not change even in a common space, it can be used as if it is in the organization's room as long as the radio is collectively managed.

(8) The management server manages the wireless state and each VLAN.
The management server performs the following processing.
Manage backbone, AP, and wireless space.
Management of association between SSID and VLAN.
Check the usage status of the VLAN assigned to each organization.
Billing data is generated from the usage status.

Hereinafter, a specific configuration for realizing the above mechanism will be described.
FIG. 2 is a diagram illustrating a configuration of the entire network. Here, the VLAN-HUB 2 is a HUB constituting a backbone LAN, and other VLAN-HUBs 4a to 4d, wireless access points 3a to 3d, and the management server 1 are connected to the backbone LAN.

  The VLAN-HUB 4a is a HUB used in the organization A, and is connected to other normal (non-VLAN compatible) HUBs and personal computers. Similarly, the VLAN-HUBs 4b and 4c are also used by the organization B and the organization C, and other normal HUBs and nodes are connected. The VLAN-HUB 4d is a HUB used in a shared space, and a wired terminal (for example, a personal computer) of each organization is connected to the VLAN-HUB 4d.

  The notebook personal computers 5a, 5b, 5c, 5a ', and 5b', which are wireless terminals, wirelessly communicate with any of the access points 3a to 3d and function as one node of the LAN within the organization. For example, if the notebook personal computers 5a and 5a 'belong to the organization A, they communicate with the nodes (for example, servers) on the LAN connected to the VLAN-HUB 4a of the organization A by communicating via the access point 3d. Can communicate. Similarly, the notebook personal computers 5b and 5b 'belonging to the organization B communicate with the nodes (for example, servers) on the LAN connected to the VLAN-HUB 4b of the organization A by communicating via the access point 3d. It can be performed.

  FIG. 3 is a diagram showing a virtual line of the network. If the notebook personal computers 5a and 5a ', which are wireless terminals, belong to the organization A, they are connected to the LAN in the organization A via the virtual circuit A (VLAN 3). If the notebook personal computers 5b and 5b 'belong to the organization B, they are connected to the LAN in the organization B via the virtual circuit B (VLAN 4). Similarly, if the notebook personal computer 5c belongs to the organization C, it is connected to the LAN in the organization C via the virtual circuit C (VLAN 5).

  Thus, the wireless LAN belonging to each organization can be connected to the LAN in each organization by the VLAN function of the backbone LAN and the VLAN-HUB provided in each organization. Therefore, association information between the VLAN tag and the wireless identification code SSID is written in the access points 3a to 3d of each wireless LAN.

  FIG. 4 is a diagram showing the relationship between VLAN tags and SSIDs in which the management server 1 is set. In this embodiment, since three organizations (organization A to organization C) are managed, three pairs of VLAN tags and SSIDs are registered.

  FIG. 5 shows communication quality (QoS) for each organization managed by the management server 1, communication packet amount, and billing data based thereon. For example, QoS is set according to the communication quality grade contracted in advance. In addition, packet amount data of the wireless access point is extracted, and charging data corresponding to it is obtained.

  FIG. 6 shows a difference between a normal packet propagating on the Ethernet (registered trademark) and a packet for configuring the VLAN. (A) is a normal packet, which is basically an IP packet consisting of an IP header and a real data part with an Ethernet (registered trademark) header. On the other hand, the VLAN tag is added to the packet for configuring the VLAN. This VLAN tag is a tag for identifying each group for setting a virtual group of terminals independently of a physical connection form.

  7 to 11 are flowcharts showing main processing contents of the management server, the access point, and the wired LAN node of each organization.

  FIG. 7 is a flowchart for setting association information between a VLAN tag and an SSID. The management server writes (updates) the VLAN tag and SSID pair input from the outside (console) in the association information table shown in FIG. Then, the association information is written to all access points (APs). In response to this, the access point stores the association information.

  FIG. 8 is a flowchart of communication processing between the wireless terminal and the access point. The wireless terminal accesses the access point with the SSID set in the wireless terminal and performs wireless communication. As a result, the access point adds a VLAN tag corresponding to the SSID received from the wireless terminal to the packet and sends it to the backbone LAN.

  FIG. 9 is a flowchart illustrating a procedure of communication processing between the wired LAN node of each organization and the access point. When a VLAN-tagged packet is sent from a wired LAN node of an organization to an access point, the access point removes the VLAN tag from the packet and returns it to a normal packet, and wirelessly communicates with the wireless terminal using the corresponding SSID.

  In this way, the wireless terminal can communicate with the wired LAN node of its own organization through any access point. Therefore, for example, even if a wireless terminal belonging to the organization A is used in the room of the organization B, the wireless terminal can communicate with the wired LAN node of the organization A.

  FIG. 10 is a flowchart showing the processing contents of the communication quality setting performed by the management server. First, the QoS for each SSID input from the outside (console or the like) is read and written (updated) in the control information table shown in FIG. Then, the QoS information is written to all access points.

  Accordingly, the wireless terminal can perform wireless communication with QoS according to the SSID.

  FIG. 11 is a flowchart showing the contents of accounting management performed by the management server. The management server calculates billing according to QoS and packet amount or according to a charge (course). Further, the accounting information is transmitted to an e-mail address designated by the customer as required, such as an instruction from the outside. Or debit from the bank debit account specified by the customer.

  Next, a network according to the second embodiment will be described with reference to FIGS.

  The network according to the second embodiment is a combination of IEEE 802.1X user authentication and VLAN. Therefore, it is set and operated as follows.

(1) Assign an SSID for each organization to be carved.
(2) A virtual LAN (hereinafter referred to as “VLAN”) is allocated to each organization to be separated.
(3) A management VLAN (for example, “VLAN2”) is allocated to the management server.

(4) Build a backbone LAN for wireless LAN.
Wireless access points (hereinafter referred to as “AP”) are collectively installed on a wired communication network for wireless LAN that can recognize VLAN tags. Install in the same way in each organization and common space. APs are arranged and set so that wireless communication can be performed best without being restricted by an organization.

(5) Connect the wired LAN and wireless LAN backbone LAN in each organization.
At the connection point between the wired LAN and the wireless LAN backbone LAN in each organization, the VLAN tag packet of the organization to which it belongs is accepted, and the VLAN tag is removed and returned to the standard LAN packet. A device (usually a switching hub with a VLAN function or an L3 switch) having a function of sending to a wired LAN is installed. Also, with this device, a VLAN tag of the corresponding organization is attached to a packet sent to the wireless LAN.

(6) Each user has a user ID and an authentication key for connecting to the wireless LAN.
Each user has a user ID and an authentication key in the format of “user name @ organization domain name”. The authentication key is typically a password, passphrase, one-time password, electronic certificate or the like. For example, the user ID of the user ID “taro” (Taro) belonging to the organization A is “taro @ A”.

(7) The AP authenticates the user ID.
A terminal that has made a wireless connection is authenticated in accordance with IEEE 802.1X. At that time, the organization domain name portion of the user ID is looked at to determine the VLAN with the RADIUS server that inquires the authentication key and the VLAN to be connected after authentication. The relationship between the domain name and the VLAN follows the instruction of the management server communicated through “VLAN2”.

  Assuming that the organization A has an authentication server based on an electronic certificate and the others are entrusted with authentication based on password authentication, the following is performed.

  For example, when the wireless terminal requests connection with the user ID “taro @ A”, the AP communicates the organization domain name A with the management server connected with VLAN 2. Thereby, it is instructed to authenticate through “VLAN3”, and based on this, it communicates with the authentication server of the organization A through VLAN3 and determines the authentication key.

  Further, for example, when the wireless terminal requests connection with the user ID “jiro @ B”, the AP communicates the organization domain name B with the management server connected to “VLAN2”. As a result, it is instructed to authenticate through “VLAN6”, and based on this, it communicates with the authentication server for entrusted authentication through “VLAN6” and determines the authentication key.

(8) The AP communicates by associating the organization domain name with the VLAN tag.
For example,
A packet from “VLAN3” is sent to a wireless terminal authenticated in organizational domain A, and a packet from a wireless terminal authenticated in organizational domain A is sent to VLAN3.
A packet from “VLAN4” is sent to a wireless terminal authenticated in organizational domain B, and a packet from a wireless terminal authenticated in organizational domain B is sent to VLAN4.
A packet from “VLAN5” is sent to the wireless terminal authenticated in the organization domain C, and a packet from the wireless terminal authenticated in the organization domain C is sent to the VLAN5.
The VLAN 2 is handled by the AP itself as a management communication LAN.

(9) The wireless terminal authenticates with the user ID and the authentication key, and communicates with a common SSID.
Wireless terminals belonging to the organization A authenticate with a user ID including the organization domain A and communicate with a common SSID. As a result, the wireless terminal is connected to the LAN of its own organization regardless of which access point is connected.

  Since this relationship does not change even in a shared space, it can be used as it is in the organization as long as the radio is managed collectively.

(10) The management server manages the wireless state and each VLAN.
The management server performs the following processing.
Manage backbone, AP, and wireless space.
Manages association between organization domain name and VLAN.
Check the usage status of the VLAN assigned to each organization.
Billing data is generated from the usage status.

  The network according to the second embodiment is the same as that shown in FIGS. 2 and 3. However, the authentication server (RADIUS server) is connected to the backbone LAN or to the LAN in each organization.

  FIG. 12 is a flowchart showing the processing contents related to the association between the organization domain name and the VLAN tag in the network according to the second embodiment. The management server sends association information between the organization domain name and the VLAN tag to all access points. As in the association information shown in FIG. 4 in the first embodiment, this association information is registered in the management server with the organization domain name paired with the VLAN tag, and the management server associates the access information with the access point. Is to transfer.

  The access point receives and stores association information between the organization domain name and the VLAN tag from the management server.

  FIG. 13 is a flowchart showing the processing content related to communication between the wireless terminal and the access point. The wireless terminal sends a user ID and password (according to a request from the access point) to the access point. The access point authenticates with the corresponding authentication server (RADIUS server) based on the organization domain name portion of the user ID received from the wireless terminal. More specifically, from the organization domain name, a VLAN having a RADIUS server inquiring whether authentication is possible is determined, and the RADIUS server is inquired of whether the connection is possible via the VLAN.

  FIG. 14 is a flowchart illustrating communication between a wired LAN node and an access point of each organization. The wired LAN node of each organization sends a packet with a VLAN tag to the access point. As a result, the access point sends a packet from each VLAN to the wireless terminal authenticated by the corresponding organization domain name. At that time, a common SSID is used.

  FIG. 15 is a flowchart illustrating communication after authentication between a wireless terminal and an access point. The wireless terminal communicates with the access point using a common SSID. The access point sends a packet to the VLAN corresponding to the authenticated organization domain name. As described above, any access point can communicate with the LAN in its own organization using IEEE 802.1X and VLAN.

  In the examples described above, an example is shown in which communication is performed between a wireless terminal and a LAN node in each organization. However, a wired LAN can also be managed in a substantially similar framework. For example, there is a case where a terminal such as a notebook PC is connected to the VLAN-HUB 4d provided in the shared space shown in FIG. 2 and communication is performed with a server connected to the LAN in its own organization. However, since there is no SSID in the case of a wired LAN, the association information between the organization domain name and the VLAN tag shown in the second embodiment is set in the VLAN-HUB 4d shown in FIG. Then, the same processing as the wireless access point is performed. That is, authentication is performed by the corresponding authentication server based on the organization domain name of the user ID received from the terminal connected to the VLAN-HUB 4d.

  In the second embodiment, IEEE 802.1X authentication is used, but this may be performed by a user authentication + MAC authentication method. That is, it is assumed that the identification information sent from the terminal (wireless terminal or wired terminal) includes the MAC address of the terminal, and the management server associates the MAC address of the terminal authenticated by the authentication server with the VLAN tag.

  This method can be applied to a terminal that does not support IEEE 802.1X. That is, if a user name and password are input from the keyboard of the terminal, the management server performs the authentication, and registers the MAC address of the authenticated terminal in a wireless access point or HUB. Thereafter, the wireless access point or HUB should only be configured to communicate only valid packets by looking at the MAC address.

  Next, a network according to the third embodiment will be described with reference to FIGS.

  FIG. 16 is a diagram illustrating a configuration of the entire network. The management server 1 is connected to the Internet via a router 11. The organization A includes a wireless router 13a and a normal HUB 14a. The organization B includes a wireless router 13b and a HUB 14b. Similarly, the organization C includes a wireless router 13c and a HUB 14c. These HUBs 14a, 14b and 14c are connected to nodes such as servers and personal computers used in the respective organizations. A wireless router 13d is provided in the common space. These wireless routers 13 a to 13 d are connected to the Internet via the line terminator 10.

  In both the first and second embodiments, a virtual LAN is configured using a VLAN. In the third embodiment, a VPN is used. The wireless routers 13a to 13d and the router 11 are all VPN-compatible routers, and can configure a virtual private network. In other words, in the first and second embodiments, the virtual circuit is configured by the ear 2 of the OSI reference model, but in this third embodiment, the virtual circuit is configured by the layer 3 thereof. Therefore, the LAN as the backbone shown in the first and second embodiments is the Internet in this third embodiment, and the HUB and access point corresponding to the VLAN shown in the first and second embodiments are this first. In the third embodiment, a VPN-compatible wireless router is replaced.

  FIG. 17 shows a difference between a normal packet propagating on the Ethernet (registered trademark) and a packet for configuring the VPN. (A) is a normal packet, which is basically an IP packet consisting of an IP header and a real data part with an Ethernet (registered trademark) header. On the other hand, a packet for configuring a VPN is obtained by encrypting the packet or leaving it in plain text and adding VPN information (global IP address) to it and encapsulating it. This VPN information is also used for identification of each group for setting a virtual group of terminals in the same manner as the handling of the VLAN tag shown in the first embodiment.

It is a figure which shows the structure in the building and one floor of a building, the conventional structure of wireless LAN, and the example of this invention structure. It is a figure which shows the structure of the network which concerns on 1st Embodiment. It is a figure shown about the virtual circuit of the network. It is a figure which shows the example of the association information of a VLAN tag and SSID with which a management server is equipped. It is a figure which shows the example of the content of the control information table with which the management server is equipped. It is a figure which shows the example of the packet which propagates VLAN and non-VLAN. It is a flowchart which shows the processing content of the management server and access point regarding the setting of association information. It is a flowchart which shows the processing content of communication between a radio | wireless terminal and an access point. It is a flowchart which shows the content of the communication process between the node of wired LAN of each organization, and an access point. It is a flowchart which shows the processing content of the management server regarding communication quality setting. It is a flowchart which shows the processing content which a management server performs regarding charge management. It is a flowchart which shows the content of the communication process between the management server and access point in the network which concerns on 2nd Embodiment. It is a flowchart which shows the content of the communication process between a radio | wireless terminal and an access point. It is a flowchart which shows the content of the communication process between the node of wired LAN of each organization, and an access point. It is a flowchart which shows the content of the communication process between a radio | wireless terminal and an access point. It is a figure which shows the structural example of the network which concerns on 3rd Embodiment. It is a figure which shows the example of the packet and VPN packet which transmit within the LAN.

Explanation of symbols

1-Management server 2-VLAN-HUB
3-Access point 4-VLAN-HUB
5-wireless terminal

Claims (9)

In a network in which terminals belonging to multiple organizations and LANs in each organization are connected to the backbone,
A management server for storing association information between additional information added to a packet and identification information is connected to the backbone;
Based on the association information from the management server, additional information corresponding to the identification information sent from the terminal is added to the packet received from the terminal and sent to the backbone and received from the LAN in the organization. A terminal communication means for communicating with the corresponding terminal using identification information corresponding to the additional information added to the packet;
Organization LAN communication means for adding additional information representing the organization to the packet received from the LAN in the organization, removing the additional information of the packet received from the backbone, and sending the packet to the LAN in the organization;
A network characterized by comprising The identification information sent from the terminal is a user ID and an authentication key, and the management server stores an association between the organization domain name included in the user ID and the additional information,
An authentication server that authenticates based on the identification information is connected to the backbone,
The network according to claim 1, wherein the terminal communication unit performs authentication by the authentication server based on identification information transmitted from the terminal.   The identification information sent from the terminal includes the MAC address of the terminal, and the management server associates the MAC address of the terminal authenticated by the authentication server with the additional information. network.   The network according to claim 1, wherein the terminal is a wireless terminal, the terminal communication unit is a wireless access point that communicates with the wireless terminal, and the identification information is a wireless identification code.   The network according to claim 1, wherein the backbone is the Internet, the management server is connected to the Internet, and the terminal communication means is a VPN-compatible wireless router connected to the Internet.   6. The management server according to claim 1, further comprising: means for extracting information related to a communication packet amount from the terminal communication means to obtain charging data corresponding to the communication packet amount; and means for outputting the charging data. The network according to any one of them.   The said terminal communication means is provided with a means to perform communication quality control, The said management server is provided with the means to set the information regarding communication quality with respect to the said terminal communication means. network. Arrangement and setting of the wireless device so that a plurality of wireless devices using the same wireless space is a wireless communication environment that does not interfere with each other with the wireless terminal,
A virtual circuit that performs communication via the wireless device and the wireless device is configured between the wireless terminal and a node connected to a LAN in the organization to which the wireless terminal belongs,
A network management method for performing charging according to the communication usage status. Arrangement and setting of the wireless device so that a plurality of wireless devices using the same wireless space is a wireless communication environment that does not interfere with each other with the wireless terminal,
A virtual circuit that performs communication via the wireless device and the wireless device is configured between the wireless terminal and a node connected to a LAN in the organization to which the wireless terminal belongs,
A network management method for setting communication parameters of the wireless device according to a usage contract for the virtual circuit.

Images