KR100562390B1 - Network Data Flow Identification Method and System Using Host Routing and IP Aliasing Technique - Google Patents

Abstract

The present invention provides a host routing function of a local host computer, IP aliasing capable of assigning one or more IP addresses to a network interface card (NIC), and a dynamic host configuration protocol (DHCP) that dynamically supports host configuration. Using the Dynamic Host Configuration Protocol, a small number of global IP addresses are shared by multiple local hosts so that full access between a local host and an external host can be achieved by simply referencing it, without translating the IP address / port of the packet header / payload. Full Access) The present invention relates to a method and apparatus having a feature supporting IPSec requiring communication and end-to-end secure communication.

In the present invention, the local host of the local network is assigned to each different local IP address for internal communication, the one assigned to the router / network equipment in charge of the internetworking between the local network and the global network for communication with the global network host A method and apparatus for identifying a data flow in which one or more local hosts transmit and receive with external global network hosts by sharing two or more global IP addresses through DHCP and then sharing these two IP addresses through IP aliasing. Assigning a global IP address via DHCP in addition to the respective IP addresses assigned to each; Transmitting and receiving using the global IP address as a source address of a data flow using a host routing table and a host routing function; And a data flow identification table including the Layer 2 address (local host MAC address, if Ethernet), the global IP address, the IP address of the external host, and the protocol number of the packet for the data flow. step; Identifying a data flow between the external host and the local host using at least some of the information stored in the identification table; Performing Layer 2 forwarding to transfer response data from the external host to the local host using the data flow identification table; Transmitting an ICMP Host Unreachable message to a host attempting to communicate if data flow identification cannot be supported using the data flow identification table; And communicating with a DHCP server to find a shared global IP address assigned to the local host. This enables full access communication by sharing a few global IP addresses assigned to routers / network devices that are responsible for the internetworking of local and global networks by different local hosts and packet header / pay for data flow identification. It supports data flow identification by reference only, without translating the load's IP address / port.

According to the present invention, it is possible to support not only general Internet applications but also Internet applications including IP address / port information of the local host in the payload of the packet without a separate application level gateway (ALG) software program, and modify the header / payload of the packet. Instead of identifying data flows by reference only, security applications such as IPSec, which require end-to-end connection integrity, have the advantage.

IP Address Sharing Technology, Network Address Translation (NAT), Home Networking, Host Routing, IP Aliasing                                    

Description

Method and System for data flow separation on network using Host routing and IP aliasing technique}

1 is a configuration diagram for schematically illustrating a system for identifying a data flow on a network according to a preferred embodiment of the present invention.

2 is a flowchart illustrating a data flow identification method on a network according to a preferred embodiment of the present invention.

3 shows an example of a data flow identification table.

4 is a flowchart illustrating a process of creating a DNS request queue for full access communication.

5 shows an example of a DNS request queue for full access communication.

The present invention relates to a network device and a networking method, and more particularly, a small number of global IPs assigned to routers / network devices in charge of internetworking of a local network and a global network. A data flow identification method and apparatus for supporting full access communication between a local host and an external host by reference only without sharing the address and translating the IP address / port of the packet header / payload.

Currently, all hosts on the Internet (TCP / IP network) must be assigned a globally unique IP address (IPv4) with a 32-bit addressing system to access the Internet. However, the emergence of the World Wide Web, the exponential quantitative expansion of Internet services, and the inefficient allocation of IP addresses have resulted in rapid depletion of the limited IP address space. As a result, IP addresses are very scarce worldwide. Depletion of global IP (or public IP) addresses is a serious problem in the face of the need to connect these large networks to the existing Internet as new large networks are created one after another.

 As a long-term solution to this problem of global IP address depletion, IPv6, a next-generation data transfer protocol with 128-bit addressing scheme, has been proposed, but it will take a long time to be used as a standard. Therefore, CIDR (Classless Inter-Domain Routing), Proxy, Dynamic Host Configuration Protocol (DHCP), and Network Address Translation (NAT) are used to solve the IP address shortage problem in IPv4. Various measures have been proposed. One of them is NAT. The NAT mechanism uses packet headers at routers / network devices that exist at the global and local network boundaries when each host on the network uses a local IP (or private IP) address when communicating with a global network, such as the Internet. Is a technique of translating addresses. NAT technique can be divided into Basic NAT technique for translating only IP address of network layer and NAPT (Network Address Port Translation) for translating port number of transport layer. Using the NAT scheme, a host of a local network can communicate with a global network using one or a few public IP addresses.

However, the biggest problem of the NAT scheme is that the IP layer information of the network layer and the port of the transport layer to support various Internet applications including local host identification information (local host IP address, local host port number) in the packet payload. In addition to number translation, you need an Application Level Gateway (ALG) that modifies the local IP address and port number of the packet's payload. Representative examples of such Internet applications include FTP, H.323, and MSN Messanger File Transfer. Another problem is that NAT does not provide the secure communication provided through the IP layer from end to end, such as IPSec. IPSec encrypts packets to secure end-to-end communications, so routers / network devices that perform network address translation do not know the decryption key, so they cannot interpret the payload of encrypted data packets and consequently pay the data packets. This is because the IP address / port information contained in the load cannot be handled properly. In addition, the NAT technique has a disadvantage in that additional processing such as a check sum is necessary because the IP address / port information of all packets' headers / payloads must be converted in a router / network device existing at a network boundary.

The technical problem to be achieved by the present invention is to share the packet header / page by different hosts of the local network share one or more global IP address assigned to the router / network equipment located at the network boundary by using local routing and IP aliasing via DHCP It provides a data flow identification method that supports IPSec applications that require Internet pool access communication and end-to-end secure communication between local and external hosts by reference only, without translating the load's IP address / port.

Another technical problem to be solved by the present invention is that different local hosts share a global IP address that is insufficient due to IP address depletion, so that the IP address / port of the packet header / payload is not converted, and only by reference, between the local host and the external host. It is to provide a data flow identification system that supports IPSec applications that require Internet full access communication and end-to-end secure communication.

The final technical problem to be achieved by the present invention is to solve the global IP address shortage problem that occurs during the evolution from IPv4 to IPv6 through the global IP sharing scheme and system provided in the present invention, and unlike the conventional NAT scheme, By identifying data flows by reference without modification, it supports IPSec, which supports a variety of Internet applications without additional ALGs, and requires full access and end-to-end secure communications.

In order to achieve the above technical problem, in the present invention, a local host has a different local IP address for communication in a local network, and a router / router responsible for internetworking between a local network and a global network to communicate with a host of a global network. After a global IP address is assigned by DHCP from a network device, it is shared through IP aliasing so that one or more local hosts can identify on the network the data flows to and from external global network hosts. Sharing a local IP address and a global IP address using IP aliasing for each of the local hosts; Transmitting and receiving using the global IP address as a source address of a data flow using a host routing table and a host routing function; Data flow identification including Layer 2 address (local host Medium Access Control (MAC) address of the Ethernet, MAC address), global IP address, IP address of the external host, and protocol number of the packet for the data flow Providing a table; Identifying a data flow between the external host and the local host using some or all of the information stored in the identification table; Performing Layer 2 forwarding to transfer response data from the external host to the local host using the data flow identification table; Transmitting an ICMP Host Unreachable message to a host attempting to communicate if data flow identification cannot be supported using the data flow identification table; And assigning a different shared global IP address by communicating with a dynamic host configuration protocol server to change the shared global IP address assigned to the local host.

Hereinafter, a method and apparatus for identifying a data flow on a network using host routing and IP aliasing according to a preferred embodiment of the present invention will be described in detail.

1 is a configuration diagram for schematically illustrating a system for identifying a data flow on a network according to a preferred embodiment of the present invention. Referring to FIG. 1, a local network is composed of local hosts 13, 14, and 15, and each local host 13, 14, and 15 is assigned a local IP address that is generally used only within the local network. Global IP addresses are assigned and local IP addresses are shared by different local hosts 13, 14, 15 using IP aliasing techniques. DHCP is a protocol widely used in the industry as a protocol for automatically setting a host's network environment to support a host on a network to communicate with other hosts through a network. The IP aliasing technique is a protocol for more than one interface on an interface. This is done by specifying two IP addresses on a LAN card called eth0, for example, to allow access to either IP address. DHCP and IP aliasing techniques are widely used in the prior art, and detailed description thereof will be omitted. The local hosts 13, 14, 15 are connected to the Internet 19 to send and receive data to and from the external hosts 16, 17, and 18 via a router 10, the router 10 being connected to the local network. Domain Name Server (hereinafter referred to as DNS) 11 including information on local IP address of each of the hosts 13, 14, and 15 and the domain name matched thereto, and various kinds of data flows for identification. A storage unit 12 for storing a table, a global IP address (168.188.46.46) set for connection to the Internet from the router 10, is connected to a DHCP server for dynamically allocating to a local host.

2 is a flowchart illustrating a data flow identification method on a network according to the present invention. Referring to FIG. 2, first, it is determined whether the data flow is outgoing (S201). If outgoing, it is determined whether the data flow requires routing (S202). As mentioned above, each local host 13,14,15 can use the global IP address assigned from the DHCP server to communicate with its own local IP address and global network using IP Aliasing technique. Network configuration is configured by IP address. For example, in the case of local host 1 13 of FIG. 1, it has 192.168.1.2 as a local IP address for identifying each host in the local network, and also communicates with other local hosts in the local network to communicate with the external network. It has a shared global IP address of 168.188.46.46. Local host 1 (13) communicates using the local IP address (192.168.1.2) when communicating with hosts that exist in the same local network. The communication within the local network is performed without the intervention of routers and network equipment existing between the local network and the external network as in the conventional NAT technique, and masks the destination address with its own local network address. If it is found that the host exists in the local network, it communicates using the local IP address among the IP addresses assigned to itself. If the host does not exist in the local network by masking the destination address with the local network address, it attempts to communicate using the assigned global IP address. If routing is not necessary in step S202, that is, communication within the local network, the data flow is L3 forwarded to the corresponding destination in step S216. On the other hand, when routing is necessary in step S202, that is, when communicating with external hosts 16, 17, and 18, an item matching the protocol number, source address, and destination address of the packet is searched in the data flow identification table (S203). . The table records a variety of information for identifying the data flow between the local host (13, 14, 15) and external hosts (16, 17, 18), the information recorded in the table is a protocol for the data flow Number, global IP address, external IP address, local host MAC address, and so on. An example of the identification table is shown in FIG. It is determined whether the information corresponding to the packet exists in the identification table (S204), and if it does not exist, storing data recording each item of the identification table based on the information of the outgoing packet (S205). After setting the timeout (S215) of this table, L3 forwarding (S216) is performed. However, if the identification table already exists, the source host MAC address of the packet is compared with the local host MAC address of the retrieved identification table (S206). If the two values compared in step S206 do not match, it means that there is another local host that is already communicating with the same destination address. Therefore, the communication connection request is rejected by sending an ICMP Host Unreachable message to the host to attempt a new communication (S208). If the values compared in step S206 coincide with each other, timeout is set (S215), and the packet is L3 forwarded (S216).

On the other hand, in step S201, when the data flow to be communicated is not outgoing, that is, incoming (Incoming), it is first determined whether routing is necessary (S209). Similar to the outgoing, if communication is in the local network, L3 forwarding is directly performed using the local IP address without the need for routing (S216). When routing is necessary, that is, a packet received from external hosts 16, 17, and 18, the identification table is searched for by the protocol number, source address, and destination address of the packet (S210). It is determined whether or not information on the packet is listed in the identification table (S211), and if present in the identification table, timeout is set for the packet (S215), and the packet is local host MAC address described in the identification table. Using L2 forwarding to the local host (S216). If the information on the packet is not listed in the identification table in step S211, it is determined whether the information on the packet exists in the DNS request queue (S212). The DNS request queue is a table for storing a record of the DNS request when the external hosts 16, 17, and 18 are connected to the local host 13, 14, and 15. More details will be described later with reference to FIG. Will be done. If information on the packet is not recorded in the DNS request queue, the packet is discarded because the destination is unknown. If the information on the packet is recorded in the DNS request queue, the items of the identification table are recorded by combining the <local host MAC address, global IP address> recorded in the DNS request queue and the information recognizable from the packet. (S213). Thereafter, a timeout is set for the packet (S215) and L2 forwarding (S216). When forwarding the packet in step S216, unlike the conventional NAT scheme, when transmitting and receiving data with the external hosts 16, 17, and 18, the router 10 does not change the IP address and / or the port number. It is to be noted that the communication by the global public IP address assigned to the local host (13, 14, 15).

4 is a flowchart illustrating a process of creating a DNS request queue. If one of the external hosts 16, 17, 18 makes a DNS query request (S41), the DNS request arrives at the DNS server 11 in charge of the local network by a conventional general method. DNS server 11 retrieves the local IP address for the domain name for the DNS request (S42). Thereafter, in order to find the MAC address of the host corresponding to the local IP address, the MAC address of the corresponding local host is searched using ARP (Address Resolution Protocol) (S43). In order to answer the global IP address for the DNS request, the local DHCP server is queried for the global IP address assigned to the host (S44). Thereafter, the searched content is stored in the form of <local host MAC address, global IP address> in the DNS request queue (S45). An example of the DNS request queue is shown in FIG. The DNS server 11 then returns the global IP address for the DNS request (S46).

In order to better understand the data flow identification method according to an embodiment of the present invention, when the external host X 16 is operated as a telnet server, and the local host 1 13 connects to the external host X 16, This will be explained.

First, the local IP address of local host 1 13 is 192.168.1.2, and the host to connect to is external host X 16, and its IP address is 211.113.146.144. The local host 1 is not the same as the local network address 192.168.1.0 because it masks the destination address 211.113.146.144 and the local network subnet mask 255.255.255.0 because it is 211.113.146.0. Therefore, it can be seen that the data to be transmitted and received is made between the local host and the external host. Since the local host 1 13 communicates with an external host, the local host 1 13 forwards the packet using the global IP address 168.188.46.46 as the source address among the IP addresses assigned to the host. The router 10 writes each item of the identification table from the information included in the forwarded packet. For example, 6 is recorded in the protocol number because the communication is made in TCP, and 168.188.46.46, which is the global IP address of the local host 1, is included in the global IP address, and a destination address of the packet, that is, external, is included in the external global host IP address. 211.113.146.144, the IP address of host X 16, is recorded and 00FF0A0E0F0A, the source MAC address of the packet, is recorded as the local host MAC address (see first column of FIG. 3). When the external host X 16 receives the forwarded packet, it exchanges the source address and the destination address of the received packet according to a general packet processing procedure, and also exchanges the source port and the destination port and transmits the packet. The router 10 receiving the packet searches the identification table by the protocol number, the source address, and the destination address of the packet, and finds a matching item from the information already recorded when outgoing. That is, a table having the protocol number, the global IP address, and the external host IP address corresponding to the protocol number, the destination address, and the source address of the incoming packet is searched for in the identification table. It is determined whether there is a matching item in the identification table, and if it does not exist, it is determined that an error has occurred due to a mismatch with information recorded during outgoing, and the packet is discarded. If a search item exists in the identification table, the packet is forwarded L2 to the local host having the local host MAC address corresponding to the item.

As another case, the case where the local host 1 13 operates as a telnet server and the external host X 16 connects to the local host 1 13 will be described.

First, a host on the external network, host X (211.113.146.144), issues a telnet command on the terminal using the domain name of the server host on the local network (for example, telnet telserver.com.com), then the IP address for the server. DNS query to get The DNS query (for example, Query: telserver.korea.com) is processed by the DNS server (not shown) of the host X. After passing through the general DNS processing path, the DNS server 11 of the router 10 is eventually processed. Will be sent until. General DNS processing paths are obvious to those skilled in the art, and thus detailed descriptions are omitted herein for the sake of simplicity.

Since the DNS server 11 already knows the address information for the local hosts, the IP address (192.168.1.2) of the local host 1 (13) corresponding to the received DNS query (for example, telserver.korea.com) is obtained. After performing ARP to retrieve the MAC address of the local host using this, it communicates with the local DHCP server to obtain the global IP address assigned to the host. Through this process, the global IP address (168.188.46.46) assigned to the local host 1 (13) and the MAC address (00FF0A0E0F0A) of the local host 1 (13) are bound, and the binding information is bound to the DNS request queue ( Request Queue) (see Fig. 5). Thereafter, the bound global IP address (168.188.46.46) is returned to the DNS server of the host X in a DNS response, and the DNS server (not shown) of the external host X sends the global IP address to the external host, It tells host X (211.113.146.144). The external host X 16 sends the packet using the global IP address (168.188.46.46) as the destination address. When the packet is received at the router 10, the source IP address of the received packet is recorded as a new item in the identification table together with the global IP address and local host MAC address information previously recorded in the DNS request queue. As a result, the identification table has complete information. The reason for the binding process of the DNS request queue is that the actual IP address information of the external host attempting to connect is not known at the time of DNS request. Therefore, after pre-binding the local host MAC address and the global IP address of the local host and storing them in the DNS request queue (Fig. 5), when the first IP packet arrives, not only the IP address information of the external host but also all items constituting the identification table In this case, a new item is recorded in the data flow identification table. When all the information for identifying the data flow is recorded in the identification table, the binding information is no longer needed and thus deleted from the DNS request queue. When the identification table is completed, L2 forwards the packet to local host 1, which is the corresponding local host, by using the local host MAC address 00FF0A0E0F0A. As a result, in addition to attempting to communicate from the local network to the external network, full access (two-way) communication is performed, which can attempt to communicate from the external network to the local network.

The present invention supports Internet full access communication through sharing different local hosts with one or more global IP addresses assigned to routers / network equipments responsible for the internetworking of the local network and the global network. It supports data flow identification by reference (read) without translating the payload's IP address / port. Therefore, it can support general Internet applications and Internet applications that include the local host's IP address / port information in the payload of the packet without requiring a separate application level gateway (ALG) software program. By identifying the data flow, it also has the advantage of supporting security applications such as IPSec that require end-to-end connection integrity.

Claims (10)

When one or more local hosts with different private IP (local IP) addresses in a local network using a private IP address defined in RFC 1918 communicate with external hosts using the same public IP (global IP) In the method for identifying the data flow for each host on the network, (a) assigning the local IP address to each of the local hosts and separately assigning a small number of global IP addresses assigned to routers / network devices located at network boundaries to a plurality of local hosts via DHCP, Sharing an IP address by the local hosts in an IP aliasing manner; (b) a host routing step in which a local host uses a separate local IP address as a source address for communication in a local network and uses the global IP address as a source address when communicating with a host in a global network; (c) (c1) providing an identification table including a protocol number, a global IP address of a local host, an IP address of an external host, and a MAC address of a local host to identify the data flow, (c2) providing a DNS server having information on the local IP address and a predetermined domain name corresponding thereto; (c3) the DNS server obtaining the MAC address of the local host using the local IP address and ARP to return a global IP address assigned to the local host in response to the received DNS query; (c4) obtaining a global IP address assigned to the local host by using the MAC address of the local host to the local DHCP server in order to respond to the received domain name; (c5) binding a local host MAC address and the assigned global IP address and storing them in a predetermined binding queue; and (c6) when receiving the IP packet destined for the global IP address of the local host, storing the protocol number and the external host IP address recorded in the IP packet together with the information stored in the binding queue in an identification table. Identifying a data flow between the external host and the local host using some or all of information stored in a router / network device; (d) forwarding L2 using Layer 2 of the information to deliver data to the local host; (e) deleting the information stored in the binding queue after the information stored in the binding queue is stored in the identification table; And (f) setting a timeout for the data flow identification table of each packet to be transmitted and received; Data flow identification method using a host routing and IP Aliasing technique comprising a. delete delete delete When one or more local hosts with different private IP (local IP) addresses in a local network using a private IP address defined in RFC 1918 communicate with external hosts using the same public IP (global IP) In the system for identifying the data flow for each host on the network, Add a few local IP addresses to different local hosts to each local IP address, and assign a few global IP addresses assigned to routers / network devices at network boundaries using dynamic host configuration protocols and IP aliasing. Share and use the global IP address of the local host as the source address of the data flow, In addition to having information about the local IP address and corresponding predetermined domain name, it communicates with a local DHCP server to obtain a global IP address assigned to the host in response to a received DNS query, and the received domain ARP is used to obtain the MAC address of the local host corresponding to the name, and the MAC address of the local host is bound to the assigned global IP address and stored in a predetermined binding queue, and the information stored in the binding queue is stored. A DNS server which deletes the information stored in the binding queue after being stored in the identification table and sets a timeout for each packet transmitted and received; And An identification table including a protocol number for the data flow, a global IP address of a local host, an IP address of an external host, and a MAC address of a local host, wherein the data flow between the external host and the local host is included in the identification table. Identifying using some or all of the stored information, and receiving an IP packet destined for the global IP address, the protocol number and the external host IP address recorded in the IP packet with the information stored in the binding queue Router / network equipment for storing in an identification table; Data flow identification system using a host routing and IP Aliasing technique comprising a. delete delete delete delete Within a local network using private IP addresses as defined in RFC 1918, different local hosts each have a different private IP (local IP) address and a small number of identical public IPs assigned to routers / network devices at network boundaries. Local hosts that are assigned a (global IP) address using DHCP and are shared by multiple different local hosts through IP aliasing and that use the global IP address as a source address of data flow An apparatus for identifying a data flow to be transmitted and received on a network, The router includes an identification table including a protocol number for the data flow, a global IP address of a local host, an IP address of an external host, and a MAC address of a local host, and the data flow between the external host and the local host. And identifying by using some or all of the information stored in the identification table, communication from the local network to the global network is L3 forwarding, and communication from the global network to the local network is L2 forwarding.

Images