KR100363881B1 - ATM Firewall Structure and Operational Procedure of User Authentication Which is Based on the Internet Protocol Address Access Control List - Google Patents

Abstract

The present invention relates to an ATM firewall router based on an Internet address that can be accommodated in an Asynchronous Transfer Mode (ATM) based router that provides a connection service using a Switched Virtual Connection (SVC), and a call processing control method using the same. The conventional ATM-based firewall system uses a combination of ATM cells and then authenticates and retransmits the authenticated packet, or uses an ATM cell-level firewall that authenticates every flow of ATM cells in the ATM physical layer. . This approach places heavy loads on hardware or restricts data flow. According to the present invention, the source ATM address and the destination ATM address are determined from a signal message received when the ATM call connection is established in the ATM signal message processing block so that the Internet service can be authenticated in the ATM network providing the connection service using the SVC. Obtained and obtained ATM addresses are found using the ATM address resolution server to find the Internet address, process host authentication by referring to the list of the access control list database based on the obtained Internet address, and only if the host is authorized It proceeds with the connection and handles the call release process for hosts not authorized.

Description

ATM Firewall Structure and Operational Procedure of User Authentication Which is Based on the Internet Protocol Address Access Control List}

The present invention is the Asynchronous Transfer Mode (ATM: Asynchronous Transfer Mode) by applying the base of the firewall router system and an Internet address based on the access control processing method of the relates to a method for processing the ATM call connection set up, than In more detail the switched virtual The present invention relates to an ATM firewall router based on Internet address and a call processing control method that can be accommodated in an ATM based router providing a connection service using a switched virtual connection (SVC).

Conventionally, an internet router is used to access the Internet, and access control is performed using an Internet firewall to protect an internal network. The conventional ATM-based Internet firewall checks the destination address for each flow of the Internet stream. It combines ATM cells into packets and authenticates them, retransmits the authenticated packets, or at the ATM physical layer. ATM cell level firewall was used to verify authentication for each stream.

However, when an ATM router is used for external access in a local area network based on ATM, there is a problem in that an internet-based firewall cannot be applied. In addition, the ATM cell-level firewall examines all protocol data units flowing through the virtual channel and decides whether to discard the cell. However, the ATM firewall of this type is complicated by the hardware additional structure and the administrator is variable. There is a problem that it is difficult to modify the phosphorus. That is, the conventional ATM-based firewall system has a problem that puts a load on the hardware, or restricts the user data flow.

An object of the present invention for solving the problems of the prior art as described above, the ATM address router based on the Internet address that can be applied when interworking with the external network using the ATM router, and the Internet address-based access control method is applied To provide a call processing control method.

In addition, the other object of the present invention is that it is more efficient than the existing Internet firewall because it is applied only once upon initial call connection establishment rather than for each data flow, and it is faster than the Internet address based A because it uses cache information of addresses. It is to provide a TI firewall router and call processing control method.

In addition, another object of the present invention is to provide an ATM firewall router and call processing control method based on the Internet address that can be used for restricting access of rogue users when accessing content such as a web service because a user authentication procedure is performed. will be.

1 is a service configuration diagram of an ATM network including an ATM firewall router according to the present invention,

FIG. 2 is a block diagram illustrating the configuration of blocks for processing ATM call connection messages in the ATM firewall router shown in FIG.

3 is a flowchart illustrating a call processing control method using an AMT firewall system based on an Internet address according to an embodiment of the present invention.

※ Explanation of code about main part of drawing ※

200: signal message 210: signal message processing block

220: call control processing block 230: authentication access control processing block

240: IP address access control block 250: ATM address resolution client

260: address resolution cache list 270: ATM address resolution server

In order to achieve the above object, an ATM firewall router according to the present invention includes a signal message processing block for transmitting and receiving a received ATM signal message and detecting a destination ATM address in the received ATM signal message; A call control processing block for establishing a call connection internally based on a signal message, and an Internet address-based ATM router for interpreting and transmitting the Internet IP address corresponding to the ATM address when establishing the call connection to the call control processing block. In

An IP address access control list database for storing authorization of each Internet IP address; Query the ATM address resolution block for a source ATM address and a destination ATM address received through the call control processing block to obtain an Internet IP address corresponding to the ATM address, and convert the Internet IP address to the IP address access control list. An authentication access control processing block for determining whether to authorize the authentication of the Internet IP address by querying a database, wherein the call control processing block sets the call setting of the ATM signal message in accordance with the authentication permission of the authentication access control processing block; It keeps or disconnects.

In addition, the Internet address-based call processing control method according to the present invention stores an authentication permission for each Internet IP address, and when an ATM signal message is received, an Internet address for authentication access control processing using the ATM address of the signal message. A method for controlling call processing based on the method, comprising: a first step of obtaining an ATM address from the signal message when establishing a call connection; a second step of obtaining an Internet IP address from the ATM address; And a third step of determining whether to permit authentication of the Internet IP address obtained in the second step, and a fourth step of continuously maintaining or releasing the call setup according to whether the authentication of the third step is permitted. .

Hereinafter, with reference to the accompanying drawings will be described in more detail "ATM firewall router and call processing control method based on the Internet address" according to an embodiment of the present invention.

1 is a diagram illustrating a service connection between an ATM local area network and an ATM public network access point including an ATM firewall router according to the present invention. The high speed ATM local area network is connected to the ATM public network 110 through an ATM firewall router 120. The ATM firewall router 120 is directly connected to an ATM terminal 130 directly connected to another ATM terminal 170 via another ATM switch 160. And the ATM firewall router supports the connection with the Ethernet network 150, the host 140 is connected to the Ethernet network 150 is connected.

2 is a diagram illustrating a connection structure of the ATM firewall router, which receives an ATM signal message 200 from an external terminal or another switch requesting a call connection request, and includes a signal message processing block 210 and a call control. A processing block 220, an authentication access control processing block 230, an IP address access control list 240, an ATM address resolution client 250, an address resolution cache list 260, and an ATM address resolution server 270. do.

The signal message processing block 210 transmits and receives an ATM signal message 200, and the call control processing block 220 processes a system internal call connection setting based on an ATM signal message, and the call control processing block 220 Is linked with the authentication access control processing block 230 for authentication access control processing based on the source ATM address and the destination ATM address obtained from the signal message processing block 210. The authentication access control processing block 230 obtains the Internet IP address from the ATM address analysis server 270 through the ATM address analysis client 250 based on the obtained source ATM address and the destination ATM address. By storing the in the address resolution cache list 260, the next time the ATM address is retrieved from the address resolution cache list so that the Internet IP address can be known immediately. Based on the obtained Internet IP address, it is checked whether the host is authorized by comparing with the IP address access control database list 240.

3 is a flowchart illustrating a process of a method for controlling an Internet address based call processing according to the present invention.

First, when the signal message is received (S301), the signal message processing block performs the received signal checking process, and checks the basic matters of the received signal message (S302). In addition, the signal message processing block performs a process of acquiring an ATM address of a transceiver, and acquires a source ATM address and a destination ATM address of a received signal message and uses the destination routing when a call is connected (S303). Using the destination ATM address obtained in step S303, the signal message processing block requests connection establishment from the call control processing block (S304).

Then, the call control processing block performs an attempt to establish a connection, and first requests an access check to the authentication access control processing block (S306). Then, the authentication access control processing block makes an IP address cache information check request based on the destination ATM address (S307).

In response to the check request in step S307 above, if cache information does not exist (S308), the flow proceeds to step S309. The ATM address resolution client requests the ATM address resolution server to resolve the IP address using the ATM address (S309). Address analysis succeeds according to the analysis request in step S309, and if there is a result of the request response in step S310, the cache information is updated to reuse the information interpreted in step S311. If the address resolution fails in step S310 proceeds to step S315 to perform a call release process.

In addition, if cache information exists in step S308, the authentication check is performed based on the destination IP address of the IP access control list (S312). If the host is authenticated as a result of performing the authentication check in step S312 (S313), the call setup is continued (S314). If the host is not authenticated as a result of step S313, the call release process is performed (S315).

While the invention has been described above based on the preferred embodiments thereof, these embodiments are intended to illustrate rather than limit the invention. It will be apparent to those skilled in the art that various changes, modifications, or adjustments to the above embodiments can be made without departing from the spirit of the invention. Therefore, the protection scope of the present invention will be limited only by the appended claims, and should be construed as including all such changes, modifications or adjustments.

As described above, according to the present invention, since only the authenticated hosts proceed with the connection process of the signal messages requesting the connection setup in the ATM firewall router, it is faster than the conventional Internet firewall system. In addition, since the ATM firewall router of the present invention determines whether to establish an authentication connection through a single check during initial call connection establishment, the ATM firewall router is more efficient than using an existing Internet firewall in an ATM network, and has little effect on data flow. In addition, since the cache information of the IP address and the ATM address is retained, it is used at every connection establishment request, thereby minimizing the actual call connection delay. In addition, since the authentication process is processed based on the user access list, it can be used to restrict access of the rogue user when processing the content-based billing.

Claims (5)

A signal message processing block for transmitting and receiving a received ATM signal message and detecting a destination ATM address in the received ATM signal message, a call control processing block for establishing a call connection in the system based on the signal message, and the call connection In the ATM router based on the Internet address for parsing the Internet IP address corresponding to the ATM address when set to the call control processing block, An IP address access control list database for storing whether to permit authorization of each of the Internet IP addresses; Query the ATM address resolution block for a source ATM address and a destination ATM address received through the call control processing block to obtain an Internet IP address corresponding to the ATM address, and convert the Internet IP address to the IP address access control list. An authentication access control processing block for querying a database to determine whether to permit authorization of the Internet IP address; And the call control processing block maintains or disconnects the call setup of the ATM signaling message according to whether the authentication access control processing block is authorized. The method of claim 1, And an address resolution cache list database recording the analyzed ATM address and the corresponding internet IP address under the control of the authentication access control processing block. In the Internet address-based call processing control method for storing the authentication permission for each Internet IP address, and when the ATM signal message is received, the authentication access control process using the ATM address of the signal message, A first step of obtaining an ATM address from the signaling message when establishing a call connection; A second step of obtaining an Internet IP address from the ATM address, A third step of storing Internet IP address information authorized for authentication and determining whether to permit authentication of the Internet IP address obtained in the second step; and And a fourth step of continuously maintaining or releasing a call setup according to whether or not the third step is authorized for authentication. The method of claim 3, wherein A fifth step of storing the Internet IP address corresponding to the ATM address in a cache list; The second step checks whether the ATM address obtained in the first step exists in the cache list, and reads the Internet IP address corresponding to the ATM address from the cache list. Control method. The method of claim 3, wherein And wherein the second step analyzes the ATM address obtained in the first step to obtain an Internet IP address corresponding to the ATM address.