KR101074613B1 - System and method for providing virtual private network based on atm adsl - Google Patents

Abstract

The present invention relates to a system and a method for virtual dedicated network service based on ATM ADSL network, and more particularly, to separate virtual dedicated network that is not routed with the public network by using an Asynchronous Transfer Mode (ATM) Asymmetric Digital Subscriber line (ADSL) network. A virtual dedicated network service system based on ATM ADSL network for constructing a circuit network.

To this end, the present invention is a general terminal connected to the public network; A specialized terminal having an IP termination function and connected to a predetermined service provider to use a virtual private network service; A modem connected to the general terminal and the specialized terminal and transmitting an ATM cell for a data frame transmitted from the general terminal and a data frame transmitted from the special terminal to the same uplink; A NAS for transmitting an IP packet for an ATM cell transmitted from the modem to the public network or the service provider side; And an SDR, in which a plurality of service providers are connected, a tunnel is formed with the NAS, and routes an IP packet for a data frame transmitted from the specialized terminal transmitted from the NAS to a corresponding service provider.

Description

System and method for virtual dedicated network service based on ATM ADSL network {SYSTEM AND METHOD FOR PROVIDING VIRTUAL PRIVATE NETWORK BASED ON ATM ADSL}

1 is a block diagram of a virtual dedicated network service system based on an ATM ADSL network according to an embodiment of the present invention.

2 is a protocol stack diagram of the main configuration shown in FIG.

3 is a diagram illustrating the redundancy of SDR shown in FIG. 1;

4 is a block diagram illustrating ACL application of an ATM dedicated network service system based on an AMD ADSL network according to an embodiment of the present invention.

The present invention relates to a virtual dedicated network service system and method based on an Asynchronous Transfer Mode (ATM) Asymmetric Digital Subscriber line (ADSL) network. More particularly, the present invention relates to a separate virtual dedicated network that is not routed with a public network using an ATM ADSL network. The present invention relates to a technology for constructing a circuit network.

Intranets such as companies, universities, and institutions are required to secure the network above all else, and until recently, expensive private lines have been established to maintain security. This enables a fundamental guarantee of the security of the network, but has a disadvantage in that a huge cost is required for its construction and operation. Recently, a service for building a virtual private line network using the public Internet is a VPN (Virtual Private Network). It is provided under the name.

As is known, a virtual private network (VPN) is a virtual private network that provides the functionality of a private network using a public network. In particular, the virtual private network (VPN) on the Internet provides a private network function through the Internet, a public data network composed of IP protocols, and has security functions to ensure the privacy of information transmitted on the Internet, a connectionless network. . That is, a virtual private network (VPN) is a communication service that can significantly reduce the line cost by using a public network such as the Internet as a private network.

On the other hand, in order to use the above-described virtual private network, the virtual private network operator must have a separate hardware for receiving the virtual private network, the subscriber computer should be equipped with a virtual private network installation program, in the case of the hardware If different, there is a problem that it is not easy to expand and introduce a new model because of incompatibility, and there is a problem that the economic burden is increased because the virtual private network installation program is expensive.

As described above, since the virtual private network service is provided only for the object with hardware or the corresponding software, the virtual private network service cannot be used for the normal ATM ADSL subscriber.

ATM ADSL is a communication method that provides high-speed data communication using an existing telephone line, so the number of users is large, and considering that ATM ADSL users request virtual circuit network services, ATM ADSL users are required to provide virtual circuit network services. Development of technology is required.

The present invention has been made in view of the above circumstances, and the present invention provides a dedicated network service for ATM ADSL users by constructing a dedicated network that is not routable with a public network using an ATM ADSL network that is physically established. It aims to do it.

In order to achieve the above object, the ATM-based ADSL network based virtual dedicated network service system, the general terminal connected to the public network; A specialized terminal provided with an IP termination function and connected to a service provider to use a virtual private network service; A modem connected to the general terminal and the specialized terminal and transmitting an ATM cell for a data frame transmitted from the general terminal and a data frame transmitted from the special terminal to the same uplink; A NAS for transmitting an IP packet for an ATM cell transmitted from the modem to the public network or the service provider side; And an SDR, in which a plurality of service providers are connected, a tunnel is formed with the NAS, and routes an IP packet for a data frame transmitted from the specialized terminal transmitted from the NAS to a corresponding service provider.

In addition, the ATM-based ADSL network-based virtual dedicated network service method according to the present invention, the first process comprising an authorized VR for transmitting the ATM cell transmitted from the modem to the public network; Using a physical uplink identical to that of the authorized VR, and providing a private VR for tunneling an ATM cell transmitted from the modem to a CP provider for providing a virtual private network service; A third step of extracting a data frame by decapsulating the ATM cell when an ATM cell is transmitted from the modem; Analyzing a header of the data frame to determine an encapsulation method of the data frame; A fifth process of transmitting the data frame to the authorized VR or the private VR according to the encapsulation method; And a sixth process in which the IP packet for the data frame is transmitted to the public network by the authorized VR, or the IP packet for the data frame is tunneled by the private VR and transmitted to the CP provider. do.

Hereinafter, embodiments of the present invention will be described in detail with reference to the accompanying drawings.

1 is a block diagram illustrating an entire network of a virtual dedicated network service system based on an ATM ADSL network according to an exemplary embodiment of the present invention.

As shown in FIG. 1, the ATM-based ADSL network based virtual dedicated network service system includes a modem 103 to which a plurality of terminals 101 and 102 are connected, and a DSLAM (Digital Subscriber Line Access Multiplexer). , Network Access Server (NAS), Gigabit Switch Router (GSR) 110a, and Service Distribution Router
And an internet network 110 having a 106.

The general terminal 101 connected to the modem 103 is a terminal for generating a data frame by encapsulating the data by the PPPoE method, and then transmitting the data frame to the modem 103, and is connected to the modem 103. The specialized terminal 102 is a terminal for performing a network connection only for a specific purpose, and the purpose of the service is clearly defined, and services other than the corresponding service are limited terminals. The specialized terminal 102 should include an IP termination function, and should be able to configure the access network independently of the public network to which the PC is connected. In addition, the specialized terminal 102 must thoroughly maintain the service security between the service provider (CP provider, 107). The specialized terminal 102 receives a private fixed IP address, encapsulates the data in a bridged 1483 scheme, generates a data frame, and then transmits the data frame to the modem 103.

The modem 103 encapsulates the data frame of the general terminal 101 encapsulated by the PPPoE method and the data frame of the specialized terminal 102 encapsulated by the bridged 1483 method into an ATM cell, and the NAS (Permanent Virtual Circuit) through the NAS (Permanent Virtual Circuit). 105).

NAS 105 is a core equipment of ATM ADSL service, and there is a virtual router (VR), also called context, in which there is generally one VR (authorized VR) on one NAS. The circuit configuration is achieved by creating a virtual interface to the authorized VR and connecting the ATM port at the bottom and the Gigabit Ethernet port at the top to the interface of the authorized VR.

The connection process between the interface defined in the VR inside the NAS 105 and the physical down / uplink port is called "binding". In the case of a general Internet access service, one subscriber line is bound to the public VR through one PVC. This is called "single binding". Through this binding process, an IP packet corresponding to a data frame transmitted from the subscriber PC is transmitted to the Internet composed of IP networks.

In the present invention, the NAS 105 includes an authorized VR 105a bound to the general terminal 101, a private VR 105b bound to the specialized terminal 102, and a packet classification unit 105c. At this time, the public VR 105a and the private VR 105b transmit and receive IP packets using one physical uplink as a virtual router.
The authorized VR 105a transmits an IP packet for a data frame transmitted from the general terminal 101 to a Gigabit Switch Router (GSR) of the Internet network 110, and the private VR 105b is transmitted from the specialized terminal 102. The IP packet for the data frame is transmitted to the CP provider 107 through the GRE tunnel and the SDR 106.

 Meanwhile, the packet classification unit 105c decapsulates the ATM cell introduced from the DSLAM 104, confirms the encapsulation method of the data frame, and then, if the data frame is encapsulated by the PPPoE method, the packet classification unit 105c receives the authorized VR 105a. If the data packet is encapsulated in the Bridged1483 manner, it binds to the private VR 105b. As described above, binding to different VRs according to the encapsulation method is referred to as "multibinding".

Data frames bound to the public VR 105a are processed into IP packets and transmitted to the GSR 110a of the Internet 110, while data frames bound to the private VR 105Bb are processed into IP packets and transmitted through the GRE tunnel. Sent to SDR 106. Here, the private VR 105b encapsulates the IP packet to enable GRE tunneling and transmits the encapsulated IP packet to the SDR 106. In the present invention, the tunneling technique between the private VR 105b and the SDR 106 is illustrated as a GRE tunnel, but the present invention may be implemented by applying another tunnel technique that performs the same function as the GRE tunnel.

As described above, although the authorized VR 105a and the private VR 105b exist separately inside the NAS 105, the authorized VR 105a and the private VR 105b are virtual routers and are connected to the Internet network 110 as a virtual router. It is connected by one physical uplink.

2 is a protocol stack diagram of the general terminal 101, the specialized terminal 102, the modem 103, and the NAS 105 corresponding to the main configuration of the present invention.

The general terminal 101 is a general PC, and includes a physical layer, an Ethernet layer, a PPP layer, and an IP layer, and encapsulates data in a PPPoE method and transmits the data to the modem 103.

The specialized terminal 102 is a terminal located at an IP terminal, and is equipped with a physical layer, an Ethernet layer, and an IP layer, and encapsulates data in a bridged 1483 scheme and transmits the data to the modem 103.

The modem 103 is equipped with a physical layer and an ATM layer, and encapsulates the data frame transmitted from the general terminal 101 or the specialized terminal 102 into an ATM cell and transmits the data frame to the NAS 105 in an ATM ADSL manner. At this time, the modem 103 transmits an ATM cell corresponding to the data frame to the NAS 105 by using a predetermined PVC value for connection with the NAS 105.

The frame classifier 105c of the NAS 105 checks the type field of the Ethernet header of the Ethernet frame transmitted from the modem 103, binds to the authorized VR 105a if the Ethernet frame is a PPPoE scheme. If the Ethernet frame is a bridged 1483 scheme, the Ethernet frame is bound to the private VR 105B.

Meanwhile, the SDR 106 shown in FIG. 1 has a redundant structure as shown in FIG. 3.

1 and 3, the NAS 105 exists in each NAS centralized station of a particular region (national), and there may be a plurality of CP operators 107 per service application, but only one SDR 106 is located. All the private VR packets that exist and flow from NAS concentrating stations nationwide are routed to the CP provider 107 which provides each service via one SDR.

Since the virtual dedicated network system is the most important feature along with the security of the network, the SDR 106 preferably has a redundant structure. Thus, as shown in FIG. 3, the SDR 106 is composed of a primary SDR 106a and a secondary SDR 106b, and has a redundancy structure. A link between 106a) and SDR 106b is established, allowing primary SDR 106a and secondary SDR 106b to confirm each other's states.

Due to the redundant structure of the SDR 106, if the primary SDR 106a operates first and then fails and becomes inoperable, the secondary SDR 106b detects this and becomes an operating state. Thereafter, when the primary SDR 106a is restored to the operating state, the secondary SDR 106a automatically enters the Standby state.

5 is a method for applying an access control list (ACL) of a virtual dedicated network system according to the present invention. An ACL is a list in which network elements to be blocked / allowed are set to artificially block / allow a connection from a specific source or a specific destination for security purposes between network elements. The ACL is set based on an IP or TCP / UDP port. The ALC is provided in the private VR 105b to block communication between specialized terminals as shown in FIG. 4.

ACL configuration can permit access to the required node while denying all source / destination nodes, and deny access to the required node with permission to all origin / destination nodes. There is also. The ACL must be set such that specialized terminals in the same network do not communicate with each other, and specialized terminals existing in separate networks do not communicate with each other. This is because the specialized terminal is a terminal whose security is to be maintained, and the security must be maintained between each specialized terminal as well as the Internet.

In a virtual dedicated network system, general terminals and specialized terminals that share the same PVC do not communicate with each other, so there is no need to set the ACL. This is because the general terminal and the specialized terminal are bound to separate VRs not routed to each other.

As described above, according to the ATM-based ADSL network based virtual dedicated network service system, it is not necessary to build and upgrade additional equipment and secure by using a network configured for the existing ATM-ADSL Internet access service. It is possible to provide a virtual private network service that guarantees sex.

On the other hand, the present invention is not limited to the above-described embodiment, but can be modified and modified within the scope not departing from the gist of the present invention, such modifications and changes should be regarded as belonging to the following claims. will be.

Claims (16)

A general terminal connected to the public network; A specialized terminal provided with an IP termination function and connected to a service provider to use a virtual private network service; A modem connected to the general terminal and the specialized terminal and transmitting an ATM cell for a data frame transmitted from the general terminal and a data frame transmitted from the special terminal to the same uplink; A NAS for transmitting an IP packet for an ATM cell transmitted from the modem to the public network or the service provider side; And An ATM ADSL network, comprising: a plurality of service providers connected to each other and having an SDR configured to route an IP packet for a data frame transmitted from the specialized terminal transmitted from the NAS to the corresponding service provider by forming a tunnel with the NAS; Based Virtual Private Network Service System. The method of claim 1, wherein the general terminal And a data transmission system for compressing the data frame by PPPoE and transmitting the data frame to the modem. The method of claim 1, wherein the specialized terminal Atm ADDSL network-based virtual dedicated network service system characterized in that the data frame is compressed in a Bridged 1483 scheme and transmitted to the modem. The method according to any one of claims 1 to 3, wherein the NAS A packet classification unit which decapsulates an ATM cell transmitted from the modem and determines a binding state according to an encapsulation method of a data frame; An authorized VR for binding a data frame transmitted from a general terminal by the packet classification unit to route an IP packet for the data frame to the public network; A virtual dedicated network based on an ATM ADSL network, comprising: a private VR for binding a data frame transmitted from a specialized terminal by the packet classification unit to route an IP packet for the data frame to the SDR through the tunnel; Service system. The method of claim 4, wherein the private VR is A virtual AD network service system based on an ATM ADSL network configured to route the tunneled IP packet to the SDR using the physical uplink of the authorized VR. The method of claim 1, wherein the private VR is And an access control list (ACL) for intercepting communication between the specialized terminals. The method of claim 1, wherein the tunnel Virtual dedicated network service system based on ATM ADSL network, characterized in that the GRE tunnel. The method of claim 4, wherein the SDR is A virtual dedicated network service system based on an ATM ADSL network, comprising a primary SDR and a secondary SDR for redundancy. 4. The modem of any of claims 1 to 3, wherein the modem is And a data frame transmitted from the general terminal and a data frame transmitted from the specialized terminal to the NAS using the same PVC. A first step of providing an authorized VR for transmitting an ATM cell transmitted from a modem to a public network; Using a physical uplink identical to that of the authorized VR, and providing a private VR for tunneling an ATM cell transmitted from the modem to a CP provider for providing a virtual private network service; A third step of extracting a data frame by decapsulating the ATM cell when an ATM cell is transmitted from the modem; Analyzing a header of the data frame to determine an encapsulation method of the data frame; A fifth process of transmitting the data frame to the authorized VR or the private VR according to the encapsulation method; And And a sixth process in which the IP packet for the data frame is transmitted to the public network by the authorized VR, or the IP packet for the data frame is tunneled and transmitted to the CP operator side by the private VR. ATM-based ADSL network-based virtual dedicated network service method. The method of claim 10, wherein the fifth process And if the data frame encapsulation method is a PPPoE method, binding the data frame to the authorized VR. The method of claim 10, wherein the fifth process If the data frame encapsulation method is a Bridged 1483 method, the data frame is bound to the private VR, ATM MDSL-based virtual dedicated network service method. The method of claim 10, wherein the data frame encapsulated by the PPPoE method Virtual dedicated network service method based on the ATM ADSL network, characterized in that transmitted from the general terminal. The method of claim 12, wherein the data frame encapsulated in the bridged 1483 manner A private IP address is assigned, and is transmitted from a specialized terminal that performs an IP end device function. The method of claim 13 or 14, wherein the modem And a data frame encapsulated in the PPPoE scheme and the data frame encapsulated in the bridged 1483 scheme in an ATM cell, and then transmitted using the same PVC. 11. The method of claim 10, wherein if an IP packet is transmitted through the tunnel And based on an access control list (ACL), further comprising a seventh process for allowing the terminal to use a virtual dedicated network service by granting or blocking a source or destination. Virtual Private Network Service Method.

Images