JP2017085494A - Packet transfer device, packet transfer system, and packet transfer method - Google Patents

Abstract

PROBLEM TO BE SOLVED: To enable a plurality of radio terminals to connect with a plurality of networks through the same access point.SOLUTION: A packet transfer device includes a packet processing unit 67 for transferring packets 51 received from radio terminals MS1 to MS4 through the same access point AP1. The packet processing unit performs: processing that, when a destination shown by a first destination identifier 56 of a packet 51 exists in a first network NW4, transfers the packet 51 to the first network NW4; and processing that, when the destination shown by the first destination identifier 56 exists in a second network NW1 and the radio terminals MS1 to MS4 have an access right to the second network NW1, converts the first destination identifier 56 to a second destination identifier 81 for uniquely identifying the destination in the second network NW1 to transfer the packet 51 to the second network NW1.SELECTED DRAWING: Figure 16

Description

  The present invention relates to a packet transfer device, a packet transfer system, and a packet transfer method.

  With the spread of wireless communication infrastructure such as a wireless local area network (LAN), opportunities to connect to various networks through wireless communication are increasing. In order to connect to a network by wireless communication, a wireless terminal may be connected to an access point belonging to the network.

  However, if an access point is provided for each network, when changing the network to which the wireless terminal is connected, the wireless terminal must be reconnected from the currently connected access point to another access point. The convenience is bad.

JP, 2014-221507, A

  In one aspect, the disclosed technology aims to allow a plurality of wireless terminals to connect to a plurality of networks from the same access point.

  In one aspect, a packet having a first destination identifier uniquely identifying each destination in the first network and the plurality of second networks is sent from the plurality of wireless terminals to the same access point. And a packet transfer processing unit that transfers the packet received by the receiving unit to the first network or the second network, and the packet transfer processing unit includes: When the destination indicated by one destination identifier exists in the first network, the processing for transferring the packet to the first network, and the destination indicated by the first destination identifier is the second network. If the wireless terminal is authorized to access the second network, the destination in the second network is uniquely identified. When the first destination identifier is converted to the second destination identifier and the packet is transferred to the second network, and the destination indicated by the first destination identifier exists in the second network And when the said radio | wireless terminal does not have the access authority to a said 2nd network, the packet transfer apparatus which performs the process which discards the said packet is provided.

  Multiple wireless terminals can connect to multiple networks from the same access point.

FIG. 1 is a functional configuration diagram of an ICT unit in which a network and a server are packaged. FIG. 2 is a functional configuration diagram of an ICT unit that does not require an access point to be changed. FIG. 3 is a functional configuration diagram of another ICT unit that does not require an access point to be changed. FIG. 4 is a schematic diagram for explaining the ICT unit according to the present embodiment. FIG. 5 is a system configuration diagram of each of the ICT unit and the slave unit according to the present embodiment. FIG. 6 is a diagram schematically showing a construction method of each of the virtual server, the individual network, and the common network in the present embodiment. FIG. 7 is a hardware configuration diagram of the ICT unit according to the present embodiment. FIG. 8 is a diagram illustrating an example of the format of an IP packet transmitted from an access point in the present embodiment. FIG. 9 is a functional configuration diagram of the ICT unit according to the present embodiment. FIG. 10 is a diagram illustrating an example of the routing table according to the present embodiment. FIG. 11 is a diagram illustrating an example of the format of an IP packet to which a VLAN number is added in the present embodiment. FIG. 12 is a diagram showing an example of the destination conversion table according to the present embodiment. FIG. 13 is a diagram showing an example of a permission list according to the present embodiment. FIG. 14 is a diagram showing an example of the VLAN table according to the present embodiment. FIG. 15 is a diagram illustrating a hardware configuration of the packet transfer apparatus according to the present embodiment. FIG. 16 is a schematic diagram for explaining the outline of the packet transfer method according to the present embodiment. FIG. 17 is a schematic diagram for explaining an outline of routing according to the present embodiment. FIG. 18 is a schematic diagram for explaining the outline of the address conversion according to the present embodiment. FIG. 19 is a flowchart of the packet transfer method according to the present embodiment. FIG. 20 is a functional configuration diagram of an ICT unit according to a modification.

  Prior to the description of the present embodiment, considerations made by the present inventor will be described.

  When a disaster such as an earthquake occurs, a network used in an organization such as a public office or company may become unusable. In such a disaster, it is effective to install an ICT (Information and Communication Technology) unit that can be moved by an automobile or the like in a disaster-stricken area and to construct a network, a server, or the like in the ICT unit.

  FIG. 1 is a functional configuration diagram of an ICT unit in which a network and a server are packaged in this way.

  The ICT unit 1 includes a plurality of individual networks NW1 to NW3 and one common network NW4 that are independent from each other.

  Among these, the individual networks NW1 to NW3 are networks managed by different managers, and each has access restrictions.

  Each of the individual networks NW1 to NW3 is connected with dedicated access points AP1 to AP3 and servers SVR1 to SVR3 of these networks.

  As managers of the individual networks NW1 to NW3, organizations such as local governments, police, and fire departments that handle personal information and secret information are assumed. In the case of a local government, for example, the individual network NW1 and the server SVR1 are used to manage personal information such as the names of evacuation shelters and victims in the shelters.

  Each of the access points AP1 to AP3 performs authentication with an SSID (Service Set Identifier) notified from the wireless terminals MS1 to MS3, and only the wireless terminal that has succeeded in authentication permits access to the own network. Such access restriction can be provided to each of the individual networks NW1 to NW3 by authentication using the SSID.

  On the other hand, the common network NW4 is a network managed by the administrator of the ICT unit 1, and no access restriction is provided.

  A dedicated access point AP4 and a server SVR4 are also connected to the common network NW4.

  For example, when a disaster occurs, a service is provided by the common network NW4 and the server SVR4 so that the victims can talk with each other using an IP (Internet Protocol) telephone.

  In order to allow any wireless terminal MS1 to MS3 to access the common network NW4, in this example, the user is informed of the SSID of the access point AP4 in advance. Thereby, arbitrary radio | wireless terminals MS1-MS3 can connect to access point AP4 by the SSID.

  By the way, in this example, as described above, dedicated access points AP1 to AP4 are provided in the individual networks NW1 to NW3 and the common network NW4, respectively, thereby realizing the access restriction of the individual networks NW1 to NW3.

  However, this method causes various problems as follows.

  For example, when the access points AP1 to AP4 are provided for each of the networks NW1 to NW4 in this way, a plurality of physical resources called access points must be prepared, and resources are wasted.

  In particular, it is difficult to provide access points AP1 to AP4 for each of the networks NW1 to NW4 in a state where the equipment that can be used is limited as in a disaster.

  Moreover, for example, when the connection destination of the wireless terminal MS1 is changed from the network NW1 to the network NW2, the wireless terminal MS1 must be disconnected from the access point AP1 and reconnected to the access point AP2 using the SSID, which is inconvenient. It is.

  Such inconvenience may also occur when the connection destination of the wireless terminal MS2 is changed from the common network NW4 to the individual network NW2.

  FIG. 2 is a functional configuration diagram of the ICT unit 1 in which there is no need to change the access point in this way.

  In FIG. 2, the same elements as those described in FIG. 1 are denoted by the same reference numerals as those in FIG. 1, and description thereof is omitted below.

  In the example of FIG. 2, routing is performed between the individual network NW1 and the individual network NW2, so that IP packets can be transferred along the path I between the individual networks NW1 and NW2.

  According to this, the wireless terminal MS1 can connect to both the network NW1 and the network NW2 via the access point AP1 without leaving the access point AP1.

  FIG. 3 is a functional configuration diagram of another ICT unit 1 that does not require an access point to be changed.

  In the example of FIG. 3, by performing routing between the individual network NW3 and the common network NW4 in the same manner as in FIG. 2, it is possible to transfer IP packets along the path I between these networks NW3 and NW4.

  Thereby, since the wireless terminal MS3 can be connected to both the individual network NW3 and the common network NW4 via the access point AP3, the access point AP4 for the common network NW4 becomes unnecessary.

  However, in order to set the route I between different networks as shown in FIG. 2 and FIG. 3, it is necessary for the administrators of each network to set the routing table by adjusting each other. .

  Furthermore, if the access point AP4 is omitted as shown in FIG. 3, a wireless terminal that is not authorized to access the individual network NW3 cannot connect to the access point AP3. Therefore, there also arises a problem that the wireless terminal cannot be connected to the common network NW4 via the access point AP3.

  Hereinafter, this embodiment will be described.

(This embodiment)
In this embodiment, a case where an ICT unit is used in an emergency such as a disaster will be described as an example. However, the usage scene of the ICT unit according to the present embodiment is not limited to this, and the ICT unit can be used even during normal times.

[overall structure]
FIG. 4 is a schematic diagram for explaining the ICT unit according to the present embodiment.

  The ICT unit 30 is movable by a car or the like, and provides an access area AE1 such as a wireless LAN and a plurality of services. As the base L1 where the ICT unit 30 is installed, for example, there is a refuge at the time of disaster.

  In addition, a portable handset 31 may be installed at the base L2 away from the ICT unit 30.

  The base L2 is, for example, a private house or a small office, and an access area AE2 such as a wireless LAN is provided by the slave unit 31 around the base L2. The subunit | mobile_unit 31 and ICT unit 30 can perform wireless communication by BWA (Broadband Wireless Access), and can receive the service which the ICT unit 30 provides by this in base L2.

  FIG. 5 is a system configuration diagram of each of the ICT unit 30 and the slave unit 31.

  As shown in FIG. 5, the ICT unit 30 includes a power source 35, L2 switches SW1 and SW2, a packet transfer device 38, a physical server 39, a BWA communication device 40, and an access point AP1.

  Among these, the power source 35 is a generator or a rechargeable battery, for example, and supplies power to each device in the ICT unit 30 in an emergency. Note that the power source 35 is not necessary when a power source can be secured from a wall outlet of the building.

  The packet transfer device 38 is, for example, a modular gateway (MGW: Modular Gateway), and routes the IP packet received by the access point AP1 and converts the IP packet to the physical server 39. Forward.

  The resources 47 are provided by the cooperation of the devices of the ICT unit 30.

  The resources 47 include individual networks NW1 to NW3, a common network NW4, and virtual servers SVR1 to SVR4.

  Among these, the common network NW4 is an example of a first network. Each of the individual networks NW1 to NW3 is an example of a second network.

  The virtual servers SVR1 to SVR4 belong to each of the individual networks NW1 to NW3 and the common network NW4, and are activated by executing a virtualization program in the physical server 39.

  These virtual servers SVR1 to SVR4 provide various services in an emergency.

  For example, the common network NW4 and the server SVR4 provide a service for citizens to make an IP phone call when a disaster occurs.

  Further, the individual network NW1 and the virtual server SVR1 provide a service used by local government staff in an emergency. Similarly, services used by police officers in an emergency are provided by the individual network NW2 and the virtual server SVR2, and services used by fire department staff are provided by the individual network NW3 and the virtual server SVR3.

  The wireless terminals MS1 to MS4 used by the user can access each of the individual networks NW1 to NW3 and the common network NW4 by wireless communication via the access point AP1. Here, a wireless LAN such as WiFi (registered trademark) is adopted as the wireless communication method.

  Note that the wireless terminals MS1 to MS4 are, for example, smartphones, tablet terminals, and notebook personal computers.

  However, access to the individual network NW1 is restricted, and only the terminals that are permitted to access in advance among the wireless terminals MS1 to MS4 can access the individual network NW1. The same applies to the individual networks NW2 and NW3.

  On the other hand, the common network NW4 can be accessed from any wireless terminal MS1 to MS4.

  For example, when a disaster occurs, a service is provided by the common network NW4 and the server SVR4 so that the victims can communicate with each other by IP telephone.

  Further, the BWA communication device 40 communicates with the child device 31 by BWA. Note that the BWA communication device 40 is not required when the child device 31 is not used.

  The subunit | mobile_unit 31 has the power supply 41, access point AP2, and the BWA communication apparatus 42. FIG.

  The power source 41 is a generator or a rechargeable battery that supplies power to the access point AP2 and the BWA communication device 42 in an emergency. Note that the power supply 41 is not required when the power supply can be secured from the wall outlet of the building.

  Then, the BWA communication device 42 relays the access point AP2 and the ICT unit 30 by communicating with the BWA communication device 40 of the ICT unit 30 by BWA. Thereby, the radio terminals MS1 to MS4 can access the ICT unit 30 by radio communication via the access point AP2.

  FIG. 6 is a diagram schematically illustrating the respective construction methods of the virtual servers SVR1 to SVR4, the individual networks NW1 to NW3, and the common network NW4.

  In the example of FIG. 6, by copying the configuration information of the physical server managed by the city hall to the virtual server SVR1, the virtual server SVR1 has the same function as the physical server before copying. The same applies to the physical servers of the police station and the fire station.

  Further, the L2 switches SW1, SW2, the packet transfer device 38, and the physical server 39 are connected with cables or VLANs (Virtual) so that the logical configuration of the individual network NW1 is the same as that of the local government network in the city hall. LAN). The same applies to the police and fire department networks.

  As a result, the services provided by the city hall, the police station, and the fire station can be realized in the ICT unit 30 as well.

  Here, each network of a city hall, a police station, and a fire department is managed by a different manager, and an IP address in each network is set by the manager.

  The IP address is set by an administrator of the network so as to uniquely identify a destination in one network. However, since the method of setting the IP address is different for each administrator, it is assumed that the address spaces of multiple networks overlap.

  Since each of the individual networks NW1 to NW3 takes over this IP address, it is assumed that the address spaces of the individual networks NW1 to NW3 also overlap.

  Hereinafter, the IP address uniquely assigned to each of the individual networks NW1 to NW3 is referred to as a physical address.

  The physical address is an example of a second destination identifier, and although the destination in one individual network among the individual networks NW1 to NW3 can be uniquely identified, the physical address may be duplicated among a plurality of individual networks. There is.

  On the other hand, the manager of the ICT unit 30 manages the address space of the common network NW4. Then, the administrator of the ICT unit 30 sets the IP address in the common network NW4 so as not to overlap with the physical addresses of the individual networks NW1 to NW3.

  FIG. 7 is a hardware configuration diagram of the ICT unit 30.

  In FIG. 7, the same elements as those shown in FIG. 6 are denoted by the same reference numerals, and description thereof will be omitted below.

  Moreover, the case where the ICT unit 30 is used independently without using the subunit | mobile_unit 31 (refer FIG. 5) below is demonstrated. Therefore, in FIG. 7, the BWA communication device 40 for performing communication with the child device 31 by BWA is omitted.

  As shown in FIG. 7, the ICT unit 30 includes a physical server 39 and a packet transfer system 100.

  Among these, the physical server 39 is a server for starting the virtual servers SVR1 to SVR4.

  In the example of FIG. 7, the virtual servers SVR1 to SVR4 are activated on one physical server 39, but the virtual servers SVR1 to SVR4 may be activated on a plurality of physical servers 39.

  Furthermore, instead of the virtual servers SVR1 to SVR4, physical servers having the same functions as these may be provided.

  On the other hand, the packet transfer system 100 is a system that transfers IP packets received from the wireless terminals MS1 to MS4 to the virtual servers SVR1 to SVR4, and includes the access point AP1, the L2 switches SW1 and SW2, and the packet transfer device 38 described above. .

  In this example, a plurality of wireless terminals MS1 to MS4 are connected to one access point AP1 using the same SSID. If the number of access points AP1 does not matter, a plurality of access points AP1 may be provided.

  The access point AP1 adds an Ethernet (registered trademark) header to the IP packet received from each of the wireless terminals MS1 to MS4, and transfers the IP packet to the L2 switch SW1.

  FIG. 8 is a diagram illustrating an example of a format of an IP packet transmitted from the access point AP1.

  As shown in FIG. 8, an Ethernet header 52 is added to the IP packet 51.

  The Ethernet header 52 includes a source MAC address 53 for specifying each of the wireless terminals MS1 to MS4.

  On the other hand, the IP packet 51 is an IP packet received by the access point AP1 from each of the wireless terminals MS1 to MS4, and has an IP header 54 and data 55.

  The IP header 54 includes a destination IP address 56.

  The destination IP address 56 is an example of a first destination identifier, and is an identifier that uniquely identifies all the destinations of the individual networks NW1 to NW3 and the common network NW4.

  For example, as the destination IP address 56 that designates a destination in the common network NW4, the IP address of the common network NW4 is designated.

  Further, as an IP address 55 that designates a destination in the individual networks NW1 to NW3, a logical address described later is designated.

  As a result, the data 55 is delivered to the destination designated by the destination IP address 56.

  FIG. 9 is a functional configuration diagram of the ICT unit 30.

  As illustrated in FIG. 9, the access point AP <b> 1 includes a transmission / reception unit 61 and a LAN port 62.

  The transmitting / receiving unit 61 adds the above-described Ethernet header 52 to the IP packet 51 received from the wireless terminals MS1 to MS4, and transmits the IP packet 51 to the L2 switch SW1 via the LAN port 62.

  In this example, the access point AP1 is used in the AP mode, and each MAC address of each of the wireless terminals MS1 to MS4 passes through the access point AP1.

  On the other hand, the L2 switch SW1 has two LAN ports 63 and 64.

  The IP packet 51 received at the LAN port 63 is transferred from the LAN port 64 to the packet transfer device 38 without being changed in the source MAC address 53.

  The packet transfer device 38 includes LAN ports 65 and 66, a packet transfer processing unit 67, a routing table 68, a destination conversion table 69, and a permission list 70.

  Among these, the LAN port 65 is an example of a receiving unit, and receives the IP packet 51 from the L2 switch SW1.

  Then, the packet transfer processing unit 67 performs routing and address conversion on the IP packet 51 received by the LAN port 65, or discards the IP packet 51 that is not authorized to access the individual networks NW1 to NW3.

  The packet transfer processing unit 67 refers to the routing table 68 for routing, and refers to the destination conversion table 69 for address conversion. Further, the packet transfer processing unit 67 refers to the permission list 70 in order to confirm whether or not the IP packet 51 has an access authority to the individual networks NW1 to NW3.

  FIG. 10 is a diagram illustrating an example of the routing table 68.

  In the routing table 68, the network address of the destination network to which the destination IP address 56 (see FIG. 8) belongs and the interface connected to the destination network in the packet transfer device 38 are stored in association with each other.

  In this example, only the network address of the common network NW4 is stored as the network address of the destination network. The network addresses of the individual networks NW1 to NW3 are not stored in the routing table 68.

  The packet transfer processing unit 67 routes the IP packet 51 only when the network to which the received destination IP address 56 belongs exists in the routing table 68.

  Routing is a process of determining an interface (LAN port) that transmits the IP packet 51, and here, an interface corresponding to the destination network is determined.

  However, in this example, the packet transfer apparatus 38 has only one LAN port 66 on the server side, and a plurality of destination networks share one LAN port 66.

  Therefore, in the example of FIG. 10, routing is performed by adding the VLAN number of the VLAN to which the destination IP address 56 belongs to the packet 51.

  FIG. 11 is a diagram showing an example of the format of the IP packet 51 to which the VLAN number is added in this way.

  As shown in FIG. 11, a VLAN tag 59 for storing a VLAN number is added to the Ethernet header 52.

  On the other hand, FIG. 12 is a diagram illustrating an example of the destination conversion table 69.

  In the destination conversion table 69, the destination IP address 56, the network identifier 80, and the physical address 81 in the IP packet 51 are stored in association with each other.

  The IP address 56 is an address indicating the destination of each of the virtual servers SVR1 to SVR3 in the individual networks NW1 to NW3. As described above, this IP address 56 uniquely identifies all destinations of the individual networks NW1 to NW3 and the common network NW4.

  On the other hand, the physical address 81 is an address uniquely assigned by an administrator of each organization such as a local government that is the basis of the individual networks NW1 to NW3. For this reason, the physical addresses 81 may overlap in each of the individual networks NW1 to NW3. In this case, the physical addresses 81 also appear in the destination conversion table 69 in duplicate.

  In order to eliminate such ambiguity of the physical address 81, in this example, the destination of each of the virtual servers SVR1 to SVR3 is uniquely specified by the combination of the physical address 81 and the network identifier 80, and each combination is designated as IP. Corresponding to the address 56.

  The network identifier 80 is an identifier for identifying a network to which the IP packet 51 is transferred, and a VLAN number is adopted as the network identifier 80 in this embodiment.

  Hereinafter, the IP address 56 that uniquely identifies the destinations of all the networks NW1 to NW4 by corresponding to the network identifier 80 and the physical address 81 in this way is also referred to as a logical address.

  The packet transfer processing unit 67 performs address conversion when the destination IP address 56 of the received IP packet 51 exists in the destination conversion table 69 and transmits the IP packet 51 after the address conversion to the LAN port 66.

  In the address conversion, the packet transfer processing unit 67 specifies the network identifier 80 and the physical address 81 corresponding to the destination IP address 56. Then, the packet transfer processing unit 67 rewrites the destination IP address 56 with the specified physical address 81. Further, at the time of this address conversion, the packet transfer processing unit 67 adds a VLAN number as the network identifier 80 corresponding to the destination IP address 56 to the IP packet 51.

  The VLAN number is stored in the VLAN tag 59 of the Ethernet header 51 as shown in FIG.

  FIG. 13 is a diagram illustrating an example of the permission list 70.

  The permission list is a list of terminal identifiers of the wireless terminals MS1 to MS4 having the authority to access the individual networks NW1 to NW3, and is created in advance for each of the individual networks NW1 to NW3.

  The terminal identifier is an identifier that uniquely identifies each of the wireless terminals MS1 to MS4. For example, the source MAC address 53 (see FIG. 8) of each of the wireless terminals MS1 to MS4 can be adopted as the terminal identifier.

  Then, the packet transfer processing unit 67 discards the IP packet 51 when the transmission source MAC address 53 of the received IP packet 51 does not exist in the permission list 70.

  Refer to FIG. 9 again.

  The IP packet 51 to which the VLAN tag is added by the packet transfer processing unit 67 is transmitted to the L2 switch SW2 via the LAN port 66.

  The L2 switch SW2 includes LAN ports 73 to 76, an output destination selection unit 78, and a VLAN table 79.

  Among these, the LAN port 72 receives the IP packet 51 transferred from the packet transfer device 38 and transfers the IP packet 51 to the output destination selection unit 78.

  Then, the output destination selection unit 78 refers to the VLAN table 79.

  FIG. 14 is a diagram illustrating an example of the VLAN table 79.

  As shown in FIG. 14, the VLAN table 79 stores the VLAN number indicated by the VLAN tag and the port number belonging to the VLAN.

  In this example, it is assumed that port numbers 1 to 4 are assigned to the LAN ports 73 to 76, respectively.

  The output destination selection unit 78 refers to the VLAN table 79 to transfer the IP packet 51 to the port belonging to the VLAN indicated by the VLAN tag 59 among the LAN ports 73 to 76.

  Refer to FIG. 9 again.

  The L2 switch SW2 transfers the IP packet 51 to the physical server 39 via any one of the LAN ports 73 to 76.

  The physical server 39 has a LAN port 81 and receives an IP packet 51 from the LAN port 81.

  In the physical server 39, a virtual switch SW3, virtual servers SVR1 to SVR4, and data processing units 85 to 88 are activated.

  Among these, the virtual switch SW3 receives the IP packet 51 from the LAN port 81, and confirms the VLAN tag added to the IP packet 51.

  Then, the virtual switch SW3 transfers the IP packet 51 to the virtual server belonging to the VLAN corresponding to the VLAN tag among the virtual servers SVR1 to SVR4.

  Further, the data processing units 85 to 88 provide users with services corresponding to the virtual servers SVR1 to SVR4. For example, the data processing unit 88 provides a service for citizens to make an IP phone call when a disaster occurs.

  FIG. 15 is a diagram illustrating a hardware configuration of the packet transfer apparatus 38.

  As shown in FIG. 15, the packet transfer device 38 includes an auxiliary storage device 91, a main storage device 92, a CPU (Central Processing Unit) 93, and a network interface 94. These devices 91 to 94 are connected to the bus 95.

  Among these, the auxiliary storage device 91 is a hard disk, for example, and stores a packet transfer program for realizing a packet transfer method described later. The routing table 68, the conversion table 69, and the permission list 70 described above are also stored in the auxiliary storage device 91.

  The main storage device 92 is, for example, a RAM (Random Access Memory), on which a packet transfer program is developed.

  Then, the CPU 93 executes the aforementioned packet transfer program in cooperation with the main storage device 92 and realizes the function of the aforementioned packet transfer processing unit 67.

  The network interface 94 is connected to each of the L2 switches SW1 and SW2, and communicates with these L2 switches SW1 and SW2.

[Packet transfer method]
Next, the packet transfer method according to the present embodiment will be described.

  FIG. 16 is a schematic diagram for explaining the outline of the packet transfer method.

  As shown in FIG. 16, in this embodiment, when the wireless terminals MS1 to MS4 access the common network NW4, the packet transfer device 38 routes the IP packet 51 by routing the IP packet 51. To decide.

  On the other hand, when the wireless terminals MS1 to MS4 access each of the individual networks NW1 to NW3, the packet transfer device 38 performs address conversion of the IP packet 51 and transfers the IP packet 51 to each of the individual networks NW1 to NW3.

  FIG. 17 is a schematic diagram for explaining an outline of routing.

  As shown in FIG. 17, in routing, the packet transfer processing unit 67 refers to the routing table 68 to determine an interface (LAN port) for transmitting the IP packet 51.

  Thereafter, the packet transfer processing unit 67 transmits the IP packet 51 from the interface, thereby transferring the IP packet 51 to the common network NW4.

  FIG. 18 is a schematic diagram for explaining an outline of address conversion.

  As shown in FIG. 18, the packet transfer processing unit 67 refers to the destination conversion table 69 for address conversion. Then, the packet transfer processing unit 67 rewrites the destination IP address 56 of the IP packet 51 to the corresponding physical address 81 and adds a VLAN tag as the network identifier 80 to the IP packet 51.

  After the address conversion is performed in this way, the packet transfer processing unit 67 transfers the IP packet 51 to the first to third individual networks NW1 to NW3.

  Note that the packet transfer processing unit 67 determines whether or not the wireless terminals MS1 to MS4 have access authority based on the permission list 70. If it is determined that there is no access authority, the packet transfer processing unit 67 does not perform address conversion and performs the IP conversion. The packet 51 is discarded.

  The above-described processes of FIGS. 16 to 18 are specifically performed according to the flowchart of FIG.

  FIG. 19 is a flowchart of the packet transfer method according to the present embodiment.

  First, in step S1, the packet transfer processing unit 67 receives the IP packet 51 from the radio terminals MS1 to MS4.

  Next, proceeding to step S2, the packet transfer processing unit 67 confirms the destination IP address 56 of the IP packet 51.

  In step S3, the packet transfer processing unit 67 confirms whether the destination indicated by the destination IP address 56 is the individual network NW1 to NW3 or the common network NW4.

  If it is confirmed that the destination is the common network NW, the process proceeds to step S4.

  In step S4, the packet transfer processing unit 67 performs routing of the IP packet 51 by referring to the routing table 68 as shown in FIG. 17, and determines an interface for transmitting the IP packet 51.

  In step S5, the packet transfer processing unit 67 transfers the IP packet 51 from the determined interface to the common network NW4 to which the virtual server SVR4 belongs.

  On the other hand, if it is confirmed in step S3 that the destination is one of the individual networks NW1 to NW3, the process proceeds to step S6.

  In step S6, the packet transfer processing unit 67 determines whether or not the wireless terminals MS1 to MS4 that are the transmission sources of the IP packet 51 have access authority to the individual networks NW1 to NW3.

  This determination is made by the packet transfer processing unit 67 for each of the individual networks NW1 to NW3 by referring to the permission list 70 (FIG. 13). Then, the packet transfer processing unit 67 determines that there is an access authority (YES) when the transmission source MAC addresses 53 of the wireless terminals MS1 to MS4 are present in the permission list 70, and otherwise there is no access authority. Judge as (NO).

  If it is determined that the user has access authority (YES), the process proceeds to step S7.

  In step S7, the packet transfer processing unit 67 performs address conversion on the IP packet 51 by referring to the destination conversion table 69 as shown in FIG.

  Thereafter, the process proceeds to step S5, where the packet transfer processing unit 67 transfers the IP packet 51 to one of the corresponding individual networks NW1 to NW3.

  On the other hand, if it is determined in step S6 that there is no access authority (NO), the process proceeds to step S8.

  In step S8, the packet transfer processing unit 67 discards the IP packet 51.

  Thus, the basic steps of the packet transfer method according to the present embodiment are completed.

  According to the above-described embodiment, the packet transfer processing unit 67 transfers the IP packet 51 to each of the individual networks NW1 to NW3 and the common network NW4. Therefore, it is not necessary to provide a plurality of access points for each of the individual networks NW1 to NW3 and the common network NW4, and these networks can be accessed via only one access point AP1.

  Moreover, when the destination of the IP packet 51 is the individual networks NW1 to NW3, the packet transfer processing unit 67 discards the IP packet 51 transmitted from the wireless terminals MS1 to MS4 without access authority. Thereby, a plurality of users can securely share the limited resources of the virtual servers SVR1 to SVR3.

  Furthermore, a destination IP address 56 that uniquely identifies all destinations of the individual networks NW1 to NW3 and the common network NW4 is adopted, and the packet transfer processing unit 67 changes the physical address 81 to be unique to each of the individual networks NW1 to NW3. To do. Therefore, even when the physical addresses 81 of the individual networks NW1 to NW3 overlap, the IP packet 51 can be transferred to each of the individual networks NW1 to NW3.

  The IP address in the common network NW4 is set by the administrator so as not to overlap with the individual networks NW1 to NW3. Therefore, when the IP packet 51 is transferred to the common network NW4, the load on the packet transfer processing unit 67 can be reduced by adopting routing that is easier to process than address translation.

(Modification)
In FIG. 9, a plurality of virtual servers SVR1 to SVR4 are activated on one physical server 39. However, virtual servers SVR1 to SVR4 may be activated on each of the plurality of physical servers 39 as follows.

  FIG. 20 is a functional configuration diagram of an ICT unit 30 according to a modification.

  In FIG. 20, the same elements as those described in FIG. 9 are denoted by the same reference numerals as those in FIG. 9, and the description thereof is omitted below.

  In the example of FIG. 20, a plurality of physical servers 39 are prepared, and any one of the plurality of virtual servers SVR1 to SVR4 is activated for each.

  Then, each LAN port 81 of the plurality of physical servers 39 is connected to each of the LAN ports 73 to 76 of the L2 switch SW2. In addition, each of the LAN ports 73 to 76 is assigned to a different VLAN.

  Even in this case, the processing contents of the packet transfer device 38 are the same as those in the first embodiment.

  For example, when the packet transfer processing unit 67 transfers the IP packet 51 to the virtual server SVR4 in the common network NW4, a VLAN tag 59 (FIG. 11) indicating the common network NW4 is added as in the first embodiment. That's fine.

  Further, the address transfer of the IP packet 51 addressed to the virtual servers SVR1 to SVR3 in the individual networks NW1 to NW3 can be performed by the packet transfer processing unit 67 referring to the address conversion table 69 as in the first embodiment. For example, the VLAN number that is the network identifier 80 corresponding to the destination IP address 56 of the IP packet 51 is specified, and the VLAN number is stored in the VLAN tag 59 (FIG. 11). At the same time, the destination IP address 56 may be rewritten to the corresponding physical address 81.

  The following additional notes are disclosed for each embodiment described above.

(Supplementary Note 1) From each of a plurality of wireless terminals, a packet having a first destination identifier for uniquely identifying each destination in the first network and the plurality of second networks is sent to the same access point. A receiving unit for receiving via
A packet transfer processing unit that transfers the packet received by the receiving unit to the first network or the second network;
The packet transfer processing unit
When the destination indicated by the first destination identifier exists in the first network, the process of transferring the packet to the first network;
When the destination indicated by the first destination identifier exists in the second network, and the wireless terminal has access authority to the second network, the destination in the second network Converting the first destination identifier into a second destination identifier that uniquely identifies the packet and transferring the packet to the second network;
If the destination indicated by the first destination identifier exists in the second network, and the wireless terminal does not have access authority to the second network, the packet is discarded. A packet transfer apparatus that performs processing.

  (Supplementary Note 2) When the packet transfer processing unit converts the first destination identifier into the second destination identifier, the first destination identifier, the second destination identifier, and the transfer destination of the packet The first destination identifier is converted into the second destination identifier by referring to the destination conversion table in which each of the network identifiers for identifying the network is associated, and the first destination identifier corresponding to the first destination identifier is converted. The packet transfer apparatus according to appendix 1, wherein a network identifier is added to the packet.

  (Supplementary note 3) The packet transfer apparatus according to supplementary note 2, wherein the network identifier is a VLAN number.

(Supplementary Note 4) A terminal identifier for identifying the wireless terminal is added to the packet received from the wireless terminal,
The packet transfer processing unit determines whether the wireless terminal has the access authority to the second network based on the terminal identifier, according to any one of appendix 1 to appendix 3, The packet transfer apparatus described.

  (Supplementary note 5) The packet transfer apparatus according to any one of supplementary notes 1 to 4, wherein the second destination identifier is duplicated among a plurality of the second networks.

  (Supplementary note 6) Any one of Supplementary notes 1 to 5, wherein the packet transfer processing unit determines whether or not the wireless terminal has the access authority for each of the plurality of second networks. The packet transfer device according to claim 1.

(Appendix 7) An access point to which each of a plurality of wireless terminals is connected;
A packet having a first destination identifier that uniquely identifies each destination in the first network and the plurality of second networks is received from each of the plurality of wireless terminals via the access point. A packet transfer apparatus comprising: a receiving unit; and a packet transfer processing unit that transfers the packet received by the receiving unit to the first network or the second network;
The packet transfer processing unit
When the destination indicated by the first destination identifier exists in the first network, the process of transferring the packet to the first network;
When the destination indicated by the first destination identifier exists in the second network, and the wireless terminal has access authority to the second network, the destination in the second network Converting the first destination identifier into a second destination identifier that uniquely identifies the packet and transferring the packet to the second network;
If the destination indicated by the first destination identifier exists in the second network, and the wireless terminal does not have access authority to the second network, the packet is discarded. And a packet transfer system.

(Supplementary Note 8) A first destination identifier that uniquely identifies each destination in the first network and the plurality of second networks from each of the plurality of wireless terminals connected to the same access point is provided. Receive the packet,
If the destination indicated by the first destination identifier exists in the first network, the packet is forwarded to the first network;
When the destination indicated by the first destination identifier exists in the second network, and the wireless terminal has access authority to the second network, the destination in the second network Converting the first destination identifier to a second destination identifier that uniquely identifies the packet and forwarding the packet to the second network;
When the destination indicated by the first destination identifier exists in the second network, and the wireless terminal does not have access authority to the second network, the packet is discarded. A packet transfer method characterized by the above.

DESCRIPTION OF SYMBOLS 1, 30 ... ICT system, 31 ... Slave unit, 35, 41 ... Power supply, 38 ... Packet transfer device, 39 ... Physical server, 40, 42 ... BWA communication device, 47 ... Resource, 51 ... IP packet, 52 ... Ethernet header 53 ... Transmission source MAC address, 54 ... IP header, 55 ... Data, 56 ... Destination IP address, 59 ... VLAN tag, 61 ... Transmission / reception unit, 62-66, 72-76, 81 ... LAN port, 67 ... Packet transfer Processing unit, 68 ... Routing table, 69 ... Destination conversion table, 70 ... Permit list, 78 ... Output destination selection unit, 79 ... VLAN table, 80 ... Network identifier, 81 ... Physical address, 85-88 ... Data processing unit, 100 ... Packet transfer system, NW1 to NW3 ... Individual network, NW4 ... Common network, SVR1 to SVR4 ... Virtual server, SW1, SW2 ... L2 Switch, SW3 ... Virtual switch.

Claims (5)

From each of the plurality of wireless terminals, a packet having a first destination identifier that uniquely identifies each destination in the first network and the plurality of second networks is received via the same access point. A receiver,
A packet transfer processing unit that transfers the packet received by the receiving unit to the first network or the second network;
The packet transfer processing unit
When the destination indicated by the first destination identifier exists in the first network, the process of transferring the packet to the first network;
When the destination indicated by the first destination identifier exists in the second network, and the wireless terminal has access authority to the second network, the destination in the second network Converting the first destination identifier into a second destination identifier that uniquely identifies the packet and transferring the packet to the second network;
If the destination indicated by the first destination identifier exists in the second network, and the wireless terminal does not have access authority to the second network, the packet is discarded. A packet transfer apparatus that performs processing.   The packet transfer processing unit identifies the first destination identifier, the second destination identifier, and a network to which the packet is transferred when converting the first destination identifier into the second destination identifier. The first destination identifier is converted into the second destination identifier by referring to a destination conversion table in which each of the network identifiers is associated, and the network identifier corresponding to the first destination identifier is The packet transfer apparatus according to claim 1, wherein the packet transfer apparatus adds the packet to a packet. A terminal identifier for identifying the wireless terminal is added to the packet received from the wireless terminal,
The said packet transfer process part judges whether the said radio | wireless terminal has the said access authority to the said 2nd network based on the said terminal identifier, The Claim 1 or Claim 2 characterized by the above-mentioned. Packet transfer equipment. An access point to which each of a plurality of wireless terminals is connected;
A packet having a first destination identifier that uniquely identifies each destination in the first network and the plurality of second networks is received from each of the plurality of wireless terminals via the access point. A packet transfer apparatus comprising: a receiving unit; and a packet transfer processing unit that transfers the packet received by the receiving unit to the first network or the second network;
The packet transfer processing unit
When the destination indicated by the first destination identifier exists in the first network, the process of transferring the packet to the first network;
When the destination indicated by the first destination identifier exists in the second network, and the wireless terminal has access authority to the second network, the destination in the second network Converting the first destination identifier into a second destination identifier that uniquely identifies the packet and transferring the packet to the second network;
If the destination indicated by the first destination identifier exists in the second network, and the wireless terminal does not have access authority to the second network, the packet is discarded. And a packet transfer system. A packet having a first destination identifier for uniquely identifying each destination in the first network and the plurality of second networks is received from each of the plurality of wireless terminals connected to the same access point. ,
If the destination indicated by the first destination identifier exists in the first network, the packet is forwarded to the first network;
When the destination indicated by the first destination identifier exists in the second network, and the wireless terminal has access authority to the second network, the destination in the second network Converting the first destination identifier to a second destination identifier that uniquely identifies the packet and forwarding the packet to the second network;
When the destination indicated by the first destination identifier exists in the second network, and the wireless terminal does not have access authority to the second network, the packet is discarded. A packet transfer method characterized by the above.

Images