JP4853551B2 - Data communication apparatus and data communication method - Google Patents

Description

  The present invention relates to a data communication device, a data communication method, a communication terminal device and an access server used in a mobile communication system, and a computer program.

  In recent years, in mobile communication, data communication such as transmission / reception of mail using a mobile terminal, access to the Internet, and Web browsing has been actively performed. In order to realize such data communication, a point standardized by RFC1661 as disclosed in Non-Patent Document 1 for data communication between a mobile radio terminal and a data communication device (Packet Data Serving Node: hereinafter referred to as PDSN). It is known that the to Point Protocol (hereinafter referred to as PPP) is used. PPP consists of functions for negotiating link settings necessary for data communication, authenticating users to access, and notifying IP addresses and DNS server addresses.

  In addition, Internet Protocol (hereinafter referred to as IP) is used as a network layer to be transferred by PPP, and currently used IP is IPv4, and a 32-bit address (IP address) is used as a source / destination. ing.

  In Internet communication, a global IP address that uniquely assigns a 32-bit IP address to each source / destination is adopted, and each source / destination is determined according to the IP address. However, the Internet world is rapidly expanding, and the limited address space of IPv4, that is, the exhaustion of global addresses has become a problem.

  To solve this problem, the Internet Engineering Task Force (hereinafter referred to as IETF) has proposed a new Internet Protocol version 6 (hereinafter referred to as IPv6) that expands the IP address space from 32 bits to 128 bits as the next generation IP address. Yes.

  FIG. 8 is a diagram showing a format of an IPv6 address. The upper 64 bits of the IPv6 address are path information (Network Prefix: hereinafter referred to as Prefix) 2301, and the lower 64 bits are for identifying the network interface of the node in the subnetwork to which the node is connected. This is an interface identifier 2302 (hereinafter referred to as Interface ID). The Interface ID 2302 is unique within the subnetwork, and a MAC address or the like is used as the Interface ID.

  IPv6 communication using PPP is performed using the IPv6CP procedure defined in RFC2472, as disclosed in Non-Patent Document 2. This IPv6CP procedure includes a procedure for notifying the communication partner of the Interface ID 2302 of the IPv6 address.

  In the X.S0011-C reference model of 3rd Generation Partnership Project 2 (hereinafter referred to as 3GPP2), a mobile terminal, a radio network that is wirelessly connected to the mobile terminal, a PDSN that is PPP-connected to the mobile terminal, and a RADIUS that PDSN accesses during authentication, It consists of an internet provider and an IP network connected to the internet. When the PPP connection is completed between the mobile terminal and the PDSN, the mobile terminal can connect to the IP network via the provider network 140 and the PDSN, and can perform Internet communication and content browsing.

  When performing IPv6 connection, it is known that the PDSN must make the Prefix to be given to the mobile terminal unique for each PPP link, and the Prefix notifies the mobile terminal with a router advertisement (hereinafter referred to as Router Advertisement). It is also known.

  In addition, since the IPv6 packet transmitted and received between the mobile terminal and the IP network has a unique Prefix for each PPP link, the PDSN selects a route from the upper 64-bit Prefix 2301 of the IPv6 address shown in FIG. Transfer to the terminal and IP Network.

3GPP2 X. S0011-C cdma2000 Wireless IP network Standard RFC1661 Point to Point Protocol RFC2472 IP Version 6 over PPP RFC2865 Remote Authentication Dial In User Service (RADIUS) RFC3041 Privacy Extensions for Stateless Address Autoconfiguration in IPv6

  In the conventional network connection method shown in Non-Patent Document 1 described above, it is defined that Prefix is uniquely assigned to each PPP link, and for a downlink packet from IP Network to a mobile terminal, PDSN selects a route from Prefix. And transfer to the mobile terminal.

  If the Interface ID does not overlap, it can be arbitrarily assigned from RADIUS or PDSN, and the Interface ID can be designated from the mobile terminal.

  FIG. 6 illustrates an IPv6 connection sequence. The mobile terminal 100 first establishes a radio session 131 with the base station 120 and the radio management apparatus 130 when there is a connection request from the user. When the radio management apparatus 130 establishes the radio session 131, connection of the RP session 132 is started with the PDSN 200. The radio session 131 and the RP session 132 are dedicated signaling necessary for mobile communication.

  PPP consists of LCP negotiation 101, authentication 102, and IPv6CP negotiation 104. Upon authentication, PDSN 200 transmits Access-Request 501 to RADIUS 500, and if permitted, returns an authentication permission packet called Access-Accept 502 to PDSN 200. .

  In this Access-Accept packet, it is known that the Prefix of the IPv6 address assigned to this user is included as a Framed-IPv6-Prefix attribute. The PDSN 200 extracts the Prefix from the Framed-IPv6-Prefix, and notifies the mobile terminal 100 by including it in the Router Advertisement message.

  The Interface ID is notified to the mobile terminal 100 by IPv6CP negotiation. The mobile terminal 100 that has received the notification of the Prefix and the Interface ID generates an IPv6 global address and enables IPv6 communication to the IP Network 700.

  In the downlink IPv6 data packet transmitted from the IP network 700 to the mobile terminal 100, the PDSN 200 selects a route to the mobile terminal 100 by Prefix. Therefore, as shown in FIG. 6, when a packet 701 different from the Interface ID assigned to the mobile terminal 100 is sent from the IP Network 700 to the PDSN 200, the PDSN 200 transfers the packet to the mobile terminal 100 because the Prefix matches. Since the mobile terminal 100 is different from the assigned Interface ID, the packet 702 received from the PDSN 200 is discarded.

  However, PDSN 200 causes an accounting error for the transferred packet. In addition, illegal data distribution from the IP Network 700 causes a problem that traffic of unknown destination packets increases in the wireless link.

  Therefore, there is a need for the PDSN to implement a function of detecting an IPv6 address Prefix and Interface ID and filtering illegal packets.

  However, since an IPv6 Interface ID is generally generated using a MAC address, there is a possibility that the MAC address may be abused. To prevent this, a mechanism for periodically changing the Interface ID is RFC3041. (Hereinafter referred to as an IPv6 anonymous address).

  When the mobile terminal 100 having the IPv6 anonymous address function exists, the mobile terminal 100 periodically updates the Interface ID after PPP connection. However, since the PDSN sets the filter with the Interface ID determined at the time of PPP connection, when the mobile terminal periodically updates the Interface ID, the PDSN does not filter even if the IPv6 address originally has the correct Interface ID. Causes a problem of discarding.

  An object of the present invention is to provide a data communication apparatus provided with a filter that eliminates the above-mentioned drawbacks of the conventional techniques and can be applied to a mobile terminal having an IPv6 anonymous address function.

  To achieve the above object, a first invention of the present invention is a data communication apparatus for connecting a communication terminal apparatus to an IP network using a PPP (Point to Point Protocol) via a provider network, and the PPP connection is completed. Thereafter, in a communication terminal device having an IPv6 anonymous address function, a duplicate address detection (DAD: RFC 3041 duplicate address detection) unit for determining duplication of an Interface ID of an IPv6 address received from a mobile terminal, and an interface to be dynamically updated An IPv6 address filter function corresponding to the ID detection unit is provided.

  As described above, by using the means for solving the problem, even when the mobile terminal has an IPv6 anonymous address function, it is possible to filter illegal packets by the PDSN device.

  As a result, it is possible to prevent the PDSN device from being charged for an illegal packet, and further, it is possible to effectively use the resources of the radio link by preventing an increase in traffic due to the inflow of unknown destination packets in the mobile communication system. .

It is the figure which showed the mobile communication system to which the network model of 3GPP2 (3rd Generation Partnership Project 2) X.S0011-C in this invention is applied. It is the figure which showed the function structure of the data communication apparatus in this invention. It is the figure which showed the software structure of the data communication apparatus in this invention. It is the figure which showed the PPP session establishment process flow in this invention. It is a figure showing the conventional IPv6 packet format. It is the figure which showed the flow of the conventional PPP session establishment sequence and packet data. It is a figure showing the conventional Neighbor Solicitation message format. It is a figure showing the conventional IPv6 address structure. It is the figure which showed the structure of the IP process part of the data communication apparatus in this invention. It is the figure which showed the address filtering table of the data communication apparatus in this invention. It is a figure showing the IPv6 address duplication detection processing flow in this invention. It is a figure showing the IPv6 address filtering process flow of the data communication apparatus in this invention. It is the figure which showed the flow of the PPP session establishment sequence and data packet in this invention.

  Embodiments of the present invention will be described below.

  In the following, an embodiment of the invention using IPv6 packet communication in a communication system to which the network model shown in Non-Patent Document 1 is applied will be described.

  FIG. 1 is a diagram showing a mobile communication system to which the present invention is applied. A mobile station 100 and a base station 120 connected to the mobile terminal 100 via a radio link, a radio apparatus 130 that performs radio management, a PDSN 200 that is PPP-connected to the mobile terminal 100, and a Home-RADIUS 600 that the PDSN 200 accesses via the Proxy-RADIUS 500 during user authentication, It consists of IP Network 700.

  It goes without saying that the IP Network 700 requires an IPv6 router because IPv6 communication is performed. When the PPP connection 106 is completed, the mobile terminal 100 is connected to the radio management apparatus 120, the PDSN 200, and the IP network 700 (for example, the Internet), and can perform Internet communication and content browsing.

  The provider network 140 is a network managed by a general service provider, and the PDSN 200 and the Proxy-RADIUS 500 are often managed by the service provider. The mobile terminal 100 starts the PPP connection establishment 106 with respect to the PDSN 200 by performing a connection start operation, and can transmit and receive data after the PPP connection is completed.

  In the above embodiment, the case where a mobile terminal is used as the terminal has been described as an example. However, the present invention can also be applied to a wired terminal. In this case, the PDSN 200 is generally called an access server, and performs PPP communication between the wired terminal and the access server by the same processing as described above.

  FIG. 2 is a functional configuration diagram of the PDSN 200. The PDSN 200 includes network units 210 and 220 having an external interface with the provider network 140, a control unit 240 that performs protocol processing such as PPP, and a data storage unit 230 that stores necessary information such as statistical information and billing information.

  The network unit 210 includes a transmission path interface 211 and a bus controller 212, and has a function of transferring data received from the outside to the control unit 240 via the device bus 234. In addition, when data transmitted from the control unit 240 is transmitted to the external interface, the data is transferred via the network unit 210.

  The network unit 210 has one or a plurality of 220, and can select to separate or share the external interface for the provider network 140 and the IP network 700.

  The control unit 240 stores a bus controller 242 that performs access arbitration between the device bus 234 and the processor bus 235, a processor 243 that operates software, a work area necessary for software operation, table storage, program storage, and externally received packets. A memory 241 for improving the processor capacity, a cache memory 244 for improving the processor capacity, and a processor bus 235 for connecting them.

  The data storage unit 230 includes a bus controller 231 that performs access arbitration with the device bus 234, a hard disk or flash memory 232 that stores programs, and a disk control 233 that controls the hard disk or flash memory 232.

  FIG. 3 shows a software configuration 2000 that operates on a processor, and an RP session that establishes a PPP process 2100 that performs PPP negotiation on an operation system (hereinafter referred to as an OS) 2800 and an RP session 132 with the radio management apparatus 130. Processing 2400, authentication processing 2200 for performing authentication processing, charging processing 2300 for collecting charging information, IP processing 2500 for performing Router Advertisement processing, and Mobile IP processing 2600 for performing FA (Foreign Agent) processing are operating.

  The IP processing 2500 further includes an Ingress processing unit 2501 that processes a packet from the mobile terminal 100 and an Egress processing unit 2502 that processes a packet from the IP Network 700 as shown in FIG.

  The Ingress processing unit 2501 includes a data receiving unit 2503 that receives a packet from a mobile terminal, a header analyzing unit 2504 that analyzes the IP header of the packet, an IP packet processing unit 2505 that transfers the packet to the IP Network 700, a data transmitting unit 2507, and IPv6. A duplicate address detection unit 2506 is provided for detecting whether or not an address is duplicated when an interface ID update notification is received.

  The duplicate address detection unit 2506 uses the Neighbor Solicitation packet shown in FIG. 7, and performs duplicate address detection (DAD: duplicate address detection) defined in RFC3041 as disclosed in Non-Patent Document 5 to perform PDSN 200 from the Target Address field 1100. It is possible to prevent duplication of the Interface ID between the mobile terminal 100 and the PDSN 200. If there is no overlap, the interface ID is transferred to the IPv6 address filtering unit 2511 and updated.

  The egress processing unit 2502 includes a data receiving unit 2508 that receives a packet from the IP network 700, an IPv6 header analyzing unit 2509 that analyzes the header of the packet, a registered prefix search unit 2510 that detects whether the prefix is to be transferred to the mobile terminal, and an illegal address. And an IPv6 address filtering processing unit 2511 that filters packets, an IP packet processing unit 2512 that transfers packets to the mobile terminal 100, and a data transmission unit 2513.

  The IPv6 address filtering processing unit 2511 can compare the address in the Destination Address field 1000 of the IPv6 packet shown in FIG. 5 with the Interface ID, and filter a packet based on an illegal address.

  FIG. 10 shows the configuration of the duplicate address detection unit 2506 and the Egress filtering unit 2511. The egress filtering unit 2511 has an address registration table 2700 in which the prefix and interface ID of the mobile terminal are registered.

  The software in FIG. 3 performs processing for connection with the mobile terminal 100 in accordance with the flow procedure of FIG. First, when there is an RP session 132 request from the radio management apparatus 130, the process starts from 2001 and proceeds to step 2401.

  In step 2401, the RP session processing 2400 checks whether the PDSN 200 has a free capacity for accepting the connection of the mobile terminal 100 which is a new connection. The RP session processing 2400 proceeds to step 2402 if there is free space, and proceeds to step 2403 as rejection of acceptance if there is no free space.

  In step 2403, processing (Re-Direct) is performed to notify the radio management apparatus 130 that there is no free space in the PDSN 200, and the process proceeds to step 2002 and ends.

  On the other hand, if the process proceeds to step 2402, the connection process is started, and the RP session process 2402 is repeated until the RP session is established in step 2404. When the establishment is completed, the process proceeds to step 2101. In step 2101, PPP processing 2100 begins, and LCP negotiation is started first.

  When the LCP negotiation is completed, the process proceeds to the authentication process 2200 in step 2201. In the authentication process 2200, an authentication request is sent to Home-RADIUS via Proxy-RADIUS, and the process proceeds to Step 2202. If the authentication result is successful, the process proceeds to Step 2102. If authentication fails in step 2202, the process proceeds to step 2203 and disconnection or reconnection occurs, and the process proceeds to step 2002.

  Disconnection or reconnection is selected by device management. In step 2102, the process returns to the PPP processing 2100 and the IPv6CP negotiation starts. When the IPv6CP negotiation is completed, the process proceeds to step 2501.

  In step 2501, after the Interface-ID determined by the IP processing 2500 in step 2102 is set in the address registration table 2700 of the egress filtering unit 2511, the router advertisement is transmitted to the mobile terminal, and the process proceeds to step 2002 to establish connection. Complete. The Router Advertisement 105 has a role of notifying the mobile terminal 100 of the Prefix.

  Next, the connection sequence of FIG. 13 will be described. When the mobile terminal 100 performs a connection start operation, the mobile terminal 100 establishes a radio channel between the base station 120 and the radio management apparatus 130, and the process proceeds to the LCP negotiation 101.

  Thereafter, until the PPP connection is completed between the mobile terminal 100 and the PDSN 200, the PPP connection is performed according to the connection follow in FIG. During PPP connection, the Interface-ID determined in the IPv6CP negotiation 104 is set in the address registration table 2700 of the egress filtering unit 2511 by the IP processing 2500 of the PDSN 200.

  When IPv6 data arrives from the IP Network 700 after PPP connection, the IP processing unit 2500 determines whether to pass IPv6 to the mobile terminal according to the flow of FIG.

  In step 701, the received packet is discriminated. If it is an IPv6 packet, the process proceeds to step 702, where it is searched whether the received IPv6 prefix exists in the address registration table 2700 of the PDSN 200. If a matching Prefix is detected in step 703, the process proceeds to step 704.

  Step 704 is a process for checking ON / OFF of the filter effect, which is selected in advance by the system. When the filter effect is ON, the process proceeds to step 705, and when it is OFF, the process proceeds to step 706. If the process proceeds to step 705, it is determined in step 703 whether the Interface-ID of the terminal No. in which the prefix is matched matches the Interface-ID of the received IPv6 packet.

  As a result of the determination, if the Interface-IDs match, the process proceeds to step 706 to transmit the IPv6 packet 752 to the mobile terminal 100. As a result of step 705, if the Interface-IDs do not match, the process proceeds to step 707, where the received packet is discarded and the process ends.

  Next, when the anonymous address function of the mobile terminal 100 is activated and the Interface ID of the mobile terminal 100 is updated, the mobile terminal 100 sets the Target Address field 1100 in the Neighbor Solicitation message 754 (duplicate address search packet) in FIG. The interface ID to be updated is stored and notified to the PDSN 200. Upon receiving this Neighbor Solicitation message 754, the PDSN 200 updates the filter value 2502 in the flow of FIG.

  In step 751, if the received packet is an IPv6 packet, the process proceeds to step 753. If the packet received in Step 753 is Neighbor Solicitation and includes a Target Address, the process proceeds to Step 754, and Interface ID extraction is performed in the Target Address field 1100 of ICMPv6.

  If there is no Target Address, the process ends. Next, in step 755, it is checked whether the Interface ID of the PDSN 200 and the Interface-ID in the Target Address field 1100 overlap.

  As a result of the check, if there is no overlap, the process proceeds to step 757. In step 757, the interface ID in the address management table 2700 is rewritten to the interface ID 2600 extracted in step 754, and the process ends. On the other hand, when the processing proceeds to step 756, the mobile terminal is notified that the Interface ID is duplicated by transmitting a Neighbor Advertisement.

  Thereafter, the IPv6 packet transmitted from the IP network 700 to the mobile terminal 100 is allowed to pass if it is the updated interface ID 760, and is discarded if it is a different interface ID 762.

  Thus, even if the mobile terminal has an anonymous address function, the Neighbor Solicitation transmitted from the mobile terminal when changing the address is used to follow and update the PDSN filter, so that the mobile terminal address and A filter that synchronizes the PDSN filter can be realized. Furthermore, by providing an IPv6 filter in the PDSN, it is possible to prevent external impersonation (IPv6 address abuse) and to perform high-security communication, and it is possible to prevent erroneous charges by discarding illegal packets in the PDSN.

  Furthermore, by preventing the transmission of unknown packets to the provider network, there is an effect of improving the effective use of radio resources.

100 Mobile terminal (IPv6)
200 Data communication device 400 Router 500 Proxy Radius
600 Home Radius
700 IP Network
2000 Data communication device software 2500 IP processing

Claims (4)

Via the provider network, a data communication apparatus for performing IPv6 data packet communication with the communication terminal device and the public network,
A filtering table for filtering the IPv6 data packet with an IPv6 address, wherein the IPv6 address is an interface for identifying a communication terminal apparatus in a sub-network identified by the network prefix, and a network prefix portion representing route information; The network table of the communication terminal device and the interface identifier are registered in the filtering table.
During connection initiation, or upon receiving a setting notification of the connection after periodically communication terminal device or leprosy interface identifier, detects overlapping existence of the interface identifier of another communication terminal apparatus within the interface identifier and the sub-network, duplicate register the 該I interface identifier before notated I filter ring table if it does not,
A data communication apparatus for filtering an IPv6 data packet received from the public network based on an IPv6 address of the IPv6 data packet received from the public network and the filtering table. A data communication apparatus that connects a communication terminal apparatus having an IPv6 anonymous address function defined by RFC3041 (Privacy Extensions for Stateless Address Autoconfiguration in IPv6) and a public network, and transmits and receives IPv6 data packets.
A filtering table for filtering the IPv6 data packet with an IPv6 address;
When the interface identifier change notification periodically notified from the communication terminal device by the IPv6 anonymous address function is received, duplication detection defined in the RFC3041 is performed, and when there is no duplication, the filtering table is updated to update the IPv6 The interface identifier registered in the filtering table is updated by following the change of the interface identifier periodically performed in the communication terminal device by the anonymous address function, and based on the IPv6 address of the received IPv6 data packet and the filtering table And a packet communication apparatus for filtering IPv6 data packets received from the public network. Via the provider network, a data communication method in a data communication apparatus for IPv6 data packet communication with the communication terminal device and the public network,
A filtering table for filtering the IPv6 data packet with an IPv6 address, wherein the IPv6 address is an interface for identifying a communication terminal device in a network prefix portion showing route information and a subnetwork identified by the network prefix; The network table of the communication terminal device and the interface identifier are registered in the filtering table.
During connection initiation, or upon receiving a setting notification of the connection after periodically communication terminal device or leprosy interface identifier, detects overlapping existence of the interface identifier of another communication terminal apparatus within the interface identifier and the sub-network, duplicate register the 該I interface identifier before notated I filter ring table if it does not,
A data communication method for filtering an IPv6 data packet received from a public network based on an IPv6 address of the IPv6 data packet received from the public network and the filtering table. A data communication method in a data communication apparatus that connects a communication terminal apparatus having an IPv6 anonymous address function defined by RFC3041 (Privacy Extensions for Stateless Address Autoconfiguration in IPv6) and a public network and transmits and receives IPv6 data packets. ,
A filtering table for filtering the IPv6 data packet with an IPv6 address;
When the interface identifier change notification periodically notified from the communication terminal device by the IPv6 anonymous address function is received, duplication detection defined in the RFC3041 is performed, and when there is no duplication, the filtering table is updated to update the IPv6 The interface identifier registered in the filtering table is updated by following the change of the interface identifier periodically performed in the communication terminal device by the anonymous address function, and based on the IPv6 address of the received IPv6 data packet and the filtering table And a packet communication method for filtering IPv6 data packets received from the public network.

Images