JP3819804B2 - Communication system using network interface having IP network connection function and apparatus thereof - Google Patents

Description

[0001]
BACKGROUND OF THE INVENTION
The present invention relates to an access technology to an IP network, and more particularly to a communication method using a network interface for accessing an IP network and an apparatus therefor.
[0002]
[Prior art]
Today, the use of IP networks including the Internet is becoming widespread. There are various methods for connecting to this IP network.
For example, in the case of via Ethernet, the network administrator assigns a fixed IP address, and the user manually sets necessary information by himself / herself, and the necessary information such as the IP address is obtained from the network by DHCP. There are a method of dynamically acquiring, automatically setting and connecting, a method of connecting via PPP by PPPoE, a method of acquiring information such as an IP address by IPCP, and setting and connecting automatically.
[0003]
Further, in the case of via a public telephone network, there is a method of connecting via dial-up PPP, acquiring information such as an IP address by IPCP, automatically setting and connecting.
In addition, many companies tend to construct closed IP networks called intranets that enhance security while taking advantage of the convenience of wide-area IP networks. For connection to the closed IP network via the wide area IP network, there is a method using a protocol called VPN protocol such as L2TP, PPTP, IPSec, etc. in addition to the connection to the above IP network.
[0004]
As described above, there are various methods for connecting to the IP network depending on the network environment. As described above, there are two methods for providing a terminal device and a method for providing a relay device in the related art in a situation where various connection methods to IP networks exist.
[0005]
The method provided in the terminal device is a method of supporting various connection methods in the OS of the terminal device. This is a method in which the user performs settings according to the network environment and connects to the IP network. At present, there are a large number of methods that assign IP addresses in a fixed manner, methods that assign IP addresses by DHCP, and OSs that support dial-up PPP.
[0006]
The method provided in the relay device is a method for supporting various connection methods in the router as the relay device. The terminal device to the relay device are connected by the method provided in the above terminal device, and the router connects to the target IP network by changing the connection method ahead of the terminal device. For example, a router equipped with PPPoE called a broadband router takes over the function of connecting via PPPoE via PPP. Further, a router having an L2TP LAC function takes over the function of connecting with L2TP.
[0007]
[Problems to be solved by the invention]
In order to connect to an IP network in various environments, a connection method to the IP network according to the network environment is required. As a method for realizing this, in the conventional technique, there are two methods, that is, a method provided in the terminal device and a method provided in the relay device. However, there is a problem in both methods.
[0008]
In the method provided in the terminal device, there are problems that the setting method is different in each OS, and that the connection method to the IP network supported by the OS is different. For this reason, in one network environment, there is a problem that one OS can connect but the other OS cannot connect.
[0009]
In the method with which the relay device is provided, the relay device is required at all locations that are connected to the IP network. Also, depending on the OS of the terminal device, there are those that require the function of the relay device and those that do not need it, but it becomes necessary to separate them and use them. In addition, when an encryption function such as IPSec related to security is taken over by the relay device, security depends on the administrator of the relay device.
[0010]
[Means for Solving the Problems]
The present invention solves the above problem by adding the following functions to the network interface. Note that the network interface is always used when connecting to the IP network.
-Function to connect to IP network-Function to provide terminal device with same connection method independent of connection method to IP network-Function to relay between terminal device and IP network The only requirement is to support the most common connection method to an IP network. By using this interface, it is possible to connect to an IP network that requires various connection methods. It is possible to eliminate the dependency of the terminal device on the OS and the assistance of the relay device.
[0011]
Further, by concealing information related to security in the network interface, this network interface serves as a security token. Therefore, when accessing the target IP network, authentication and secret communication can be performed without depending on the terminal device and the relay device.
[0012]
DETAILED DESCRIPTION OF THE INVENTION
Hereinafter, the present invention will be described according to embodiments.
The description will be made assuming a PC card type wireless LAN interface, but the scope of the present invention is not limited to this.
[0013]
(1) Hardware Configuration FIG. 1 shows a hardware configuration of one embodiment of the present invention. As shown in FIG. 1, the hardware configuration is composed of three points: a control unit, an interface logic unit, and a radio unit.
[0014]
The control unit is a main body that controls the interface logic unit and the radio unit, and includes a central control unit (CPU), a main memory (memory), and an auxiliary storage medium (flash memory). A program stored in the auxiliary storage medium is expanded on the main memory and operated by the central control unit.
[0015]
The interface logic unit includes a PC card interface logic and a radio interface logic.
In the PC card interface logic, a standard Ethernet interface (NE2000 compatible Ethernet interface) is emulated on the terminal device (PC) side.
In the radio interface logic, the communication between the control unit and the radio unit is relayed via the (PCI) bus.
[0016]
The wireless unit is a part that performs wireless LAN communication. Here, a wireless LAN chip set such as 802.11b is used. The chipset can be controlled via the (PCI) bus.
[0017]
When the PC card is inserted (when the power is turned on), the central controller reads the program from the auxiliary storage medium, expands it into the main memory, and starts execution. Also, the terminal device recognizes it as a standard (NE2000 compatible) Ethernet interface.
[0018]
In addition, by making the control unit into a single chip, concealing confidential information such as an encryption key in the auxiliary storage medium so that the confidential information is not exposed outside the chip such as a bus in encryption processing, etc. Realizes the same function as a token.
[0019]
(2) Software configuration Using hardware as described above, each function is realized by software. FIG. 2 shows a software configuration of an embodiment of the present invention.
First, the OS that is the basis of the software configuration will be described. The OS includes standard task management, memory management, a scheduler, and the like. As an essential function of this OS, a wireless network device on the wireless side (hereinafter referred to as wlan0) can be handled via a device driver. Next, as an indispensable function, packets are transmitted to and received from the terminal device via the PC card interface logic. A device driver for the PC card interface logic is called an Ethernet device (hereinafter referred to as eth0) from the OS. ).
[0020]
A function for connecting to the IP network listed as a function by a program that controls the devices eth0 and wlan0, a function for providing the same connection method independent of the connection method to the IP network, and the terminal device; A function to relay between IP networks is realized. In addition, a function of generating a protocol stack by combining dynamically according to the connection destination is also realized.
[0021]
The program consists of the following parts.
-Protocol Stack Unit The protocol stack unit is a part that establishes a connection to a destination IP network and communicates with a terminal device. It is also a part that generates a protocol stack according to the connection destination described below.
-User interface part The user interface part is a part that accepts a request from the terminal device to connect to or disconnect from the IP network. Communication with the terminal device is performed using the HTTP protocol over the IP protocol.
-Address management part This part manages the IP address assigned to the terminal device.
[0022]
(2-1) Communication Method This section specifically describes a communication method for realizing connection to the IP network.
1. First, setting in the initial state will be described.
As shown in FIG. 3, an IP address 10.0.0.1/8 is assigned for an application on the OS.
Further, the ARP in eth0 is operated as a proxy-ARP so that all packets other than those addressed to the terminal device are received by eth0.
[0023]
2. Next, in response to a setting request by DHCP from the terminal device, the address management unit assigns an address by responding with the DHCP protocol. Here, 10.0.0.5/8 is assigned.
As described above, the terminal device and the user interface unit can communicate by IP.
[0024]
3. The terminal device and the user interface unit communicate by IP to determine a connection destination IP network and make a connection request.
Here, FIG. 4 describes a diagram assuming that connection by Point-to-Point is performed using PPPoE.
[0025]
4). The user interface unit operates the protocol stack unit, generates a protocol stack by the method described below, and connects to the target IP network. Here, it is assumed that the IP address 129.60.0.1/16 is assigned by connection as shown in FIG.
[0026]
5). The packet transmitted from the terminal device reaches the protocol stack unit and is processed by the IP protocol processing unit shown in (*) of FIG. Check the destination address of the packet and operate as follows.
If it is addressed to 10.0.0.1/8, it is sent to the application side on the OS.
When the address is not addressed to 10.0.0.1/8, address / port conversion processing by NAT / NAPT is performed, converted to a global address (129.60.0.1), put on a PPP / PPPoE frame, and external (wireless Side).
[0027]
6). A packet sent from an application on the OS reaches the protocol stack unit and is processed in the IP protocol processing unit shown in (*) of FIG. Check the destination address of the packet and operate as follows.
If addressed to 10.0.0.5/8, send to terminal device.
If the address is not addressed to 10.0.0.5/8, address / port conversion processing by NAT / NAPT is performed, converted to a global address (129.60.0.1), put on the PPP / PPPoE frame, and external Sent to (wireless side).
[0028]
7). The packet received from the outside (wireless side) reaches the protocol stack part, and after the address / port conversion by NAT / NAPT is performed in the IP protocol processing part shown in (*) of FIG. It checks the destination address and operates as follows.
If it is addressed to 10.0.0.1/8, it is sent to the application side on the OS.
If addressed to 10.0.0.5/8, send to terminal device.
[0029]
FIG. 5 shows a derived form. This is a method of assigning a connection destination IP address (global address) to a terminal device.
1. ~ 4. The process is the same as above.
[0030]
4 '. The IP address assigned to the terminal device is changed to a global address. That is, change from 10.0.0.5 to 129.60.0.1.
Regarding the IP address change, use the DHCP protocol FORCERENEW to forcibly change it, or set the lease time short and return a NAK in response to a lease extension request to obtain a new IP address. There is a method to make it.
[0031]
5 '. The packet transmitted from the terminal device reaches the protocol stack unit and is processed in the IP protocol processing unit shown in (*) of FIG. Check the destination address of the packet and operate as follows.
If it is addressed to 10.0.0.1/8, it is sent to the application side on the OS.
If the address is not addressed to 10.0.0.1/8, it is sent to the outside (wireless side) in a PPP / PPPoE frame without being converted.
[0032]
6 '. A packet sent from an application on the OS reaches the protocol stack unit and is processed in the IP protocol processing unit shown in (*) of FIG. Check the destination address of the packet and operate as follows.
If addressed to 129.60.0.1, send to terminal device.
If the address is not addressed to 129.60.0.1, address / port conversion processing by NAT / NAPT is performed, converted to a global address (129.60.0.1), put on a PPP / PPPoE frame, and external (radio side) Is sent to.
[0033]
7 '. A packet received from the outside (wireless side) reaches the protocol stack unit, and after the address / port conversion by NAT / NAPT is performed in the IP protocol processing unit shown in (*) of FIG. It checks the destination address and operates as follows.
If it is addressed to 10.0.0.1/8, it is sent to the application side on the OS.
If addressed to 129.60.0.1, send to terminal device.
[0034]
(2-2) Protocol Stack Generation Method In this section, a framework for generating a protocol stack corresponding to a connection destination will be described.
By realizing the following two, it is possible to dynamically generate a protocol stack according to the connection destination.
[0035]
(I) Object each protocol and unify its interface. A framework capable of forming a protocol stack by flexibly connecting instances of protocol objects is provided.
(Ii) An interface capable of direct access to each protocol object instance is prepared, and a framework capable of direct operation and the like is provided.
[0036]
TCP_0, TCP_1, IP_1, PPP_1, IP_0, and 802.3_0 in FIG. 6 represent protocol instances, and are combined (stacked) to form a protocol stack.
[0037]
(A) Protocol Instance The actual state of each protocol object is a protocol instance, which is configured as shown in FIG. By creating / destroying a protocol object, a protocol instance is created / destroyed.
[0038]
(A-1) The external interface protocol instance has three types of interfaces.
a. uppper interface: An interface that receives packets from an upper protocol interface.
b. lower interface: An interface that receives packets from a lower protocol interface.
c. control interface: An interface for receiving control packets for management.
[0039]
(A-2) The functions provided by the external function protocol object / instance are as follows.
-Create / destroy: A function for creating / destroying a protocol instance.
-Connect / disconnect: A function that generates an upper interface or a lower interface to connect / disconnect between protocol instances.
-Activate / deactivate: A function for enabling / disabling a protocol instance.
-Config: A function for setting a protocol instance.
−notify: A function for performing notification from a protocol instance.
-Recv: A function for receiving a message from the interface.
[0040]
(A-3) Internal function In the protocol instance, the following functions are provided for protocol processing.
-Queue: It may be necessary to keep the packet for fragemet or retransmit.
In order to perform such processing, a queue function is provided.
-Database: Sometimes requires a database, such as routing or arp.
In order to perform such processing, a database function is provided.
-Timer: Provides a timer function to perform timeout processing.
[0041]
(B) Generation of protocol stack A protocol stack is dynamically generated using the protocol object / instance described above. The protocol stack generation order is basically generated sequentially from lower protocol instances.
A. ~ D. By repeating the above, the protocol stack is assembled.
[0042]
a. create
A protocol instance is generated by executing create of the protocol object (see FIG. 8). In addition, a timer, database, and queue are created if necessary.
(The following operations are performed via the control interface.)
[0043]
b. connect
In connect, protocol instances are connected as follows (see FIG. 9).
1. Directs transmission in the upper protocol instance to the upper interface of the lower protocol instance.
2. Direct the transmission in the lower protocol instance to the lower interface of the upper protocol instance.
[0044]
c. config
In config, a protocol instance is set (as required) (see FIG. 10).
[0045]
d. activate
In activate, the protocol instance is activated as follows (see FIG. 11).
1. Enable the protocol instance. Specifically, the protocol status is started.
[0046]
(C) Deletion of protocol stack When the protocol stack is no longer necessary, the protocol stack is deleted in the following procedure.
The protocol stack disappears in the order, but basically, it disappears in order from the upper protocol instance. Contrary to generation, the following is performed in order from the top.
[0047]
e. deactivate
In deactivate, the protocol instance is invalidated as follows (see FIG. 12).
1. Disable the protocol instance. Specifically, the protocol status is completed.
[0048]
f. disconnect
In disconnect, the protocol instances are disconnected as follows (see FIG. 13).
1. The transmission directed to the lower protocol instance lower interface in the lower protocol instance is deleted.
2. The transmission intended for the lower protocol instance upper interface in the upper protocol instance is deleted.
[0049]
g. destroy
By executing the destroy of the protocol object, the protocol instance (see FIG. 14) disappears. If necessary, delete timer, database and queue.
A protocol stack corresponding to the connection destination is generated using the framework for generating the protocol stack as described above.
[0050]
As mentioned above, the invention made by the present inventor has been specifically described based on the above embodiment, but the present invention is not limited to the above embodiment, and various modifications can be made without departing from the scope of the invention. Of course. For example, it is obvious that a plurality of IP networks can be connected simultaneously using the PC card of the above embodiment.
[0051]
【The invention's effect】
According to the present invention, the terminal OS can be transparently accessed to the IP network without having a protocol for accessing the IP network such as PPPoE, L2TP, and IPSec. Further, it becomes possible to transparently access the IP network without requiring a special device in the intermediate node (router).
[0052]
Further, by using information related to security concealed in the interface, this network interface serves as a hardware token, and communication with high authentication and secrecy becomes possible.
[0053]
Access to an IP network with authentication is possible without depending on the OS of the terminal device. For example, online authentication by single sign-on is possible by performing authentication when connecting to an IP network such as a shopping mall. Become.
As described above, the present invention can be used as a means for constructing a new information distribution platform for IP networks.
[Brief description of the drawings]
FIG. 1 is a diagram illustrating a hardware configuration according to an embodiment.
FIG. 2 is a diagram illustrating a software configuration according to an embodiment.
FIG. 3 is a diagram for explaining communication between a terminal device and a user interface unit;
FIG. 4 is a diagram for explaining communication between a terminal device, a user interface unit, and an IP network.
FIG. 5 is a diagram illustrating a software configuration of a derived embodiment.
FIG. 6 is a diagram illustrating an example of a stack of protocol instances.
FIG. 7 is a diagram illustrating an example of a protocol instance.
FIG. 8 is a diagram for explaining generation of a protocol instance.
FIG. 9 is a diagram for explaining connection between protocol instances.
FIG. 10 is a diagram for explaining setting of a protocol instance.
FIG. 11 is a diagram for explaining the validation of a protocol instance.
FIG. 12 is a diagram for explaining invalidation of a protocol instance.
FIG. 13 is a diagram for explaining disconnection between protocol instances.
FIG. 14 is a diagram for explaining the disappearance of a protocol instance.

Claims (4)

When connecting to an IP network from a terminal device via a network interface, a function for connecting to the IP network using authentication information necessary for connection hidden in the network interface, and the terminal device a communication system using the function of providing the same connection method that does not depend on the method of connecting to the IP network, a network interface having a function of relaying between the terminal devices and the IP network, the ability to connect to the IP network A communication method using a network interface, characterized in that a protocol stack is generated by dynamically combining protocols necessary for connecting to an IP network according to a connection destination . When connecting to an IP network from a terminal device via a network interface, a function for connecting to the IP network using authentication information necessary for connection hidden in the network interface, and the terminal device A communication method using a network interface having a function of providing the same connection method independent of a connection method to an IP network and a function of relaying between the terminal device and the IP network, the terminal device and the IP network A network interface characterized in that a request from a terminal device is terminated by an application in the network interface, the application communicates via the IP network, processes the request, and sends a response to the terminal device. for Communication system that. When connecting to an IP network from a terminal device via a network interface, a function for connecting to the IP network using authentication information necessary for connection hidden in the network interface, and the terminal device , a network interface apparatus having the function of providing the same connection method that does not depend on the method of connecting to the IP network, a function of relaying between the terminal devices and the IP network, as a function of connecting to the IP network, IP A network interface device, wherein a protocol stack is generated by dynamically combining protocols necessary for connecting to a network according to a connection destination . When connecting to an IP network from a terminal device via a network interface, a function for connecting to the IP network using authentication information necessary for connection hidden in the network interface, and the terminal device A network interface device having a function of providing the same connection method independent of a connection method to the IP network and a function of relaying between the terminal device and the IP network, and relaying between the terminal device and the IP network A network interface device characterized in that a request from a terminal device is terminated by an application in the network interface, the application communicates via an IP network, processes the request, and returns to the terminal device.

Images