KR102076121B1 - Device and system for providing l2 network service - Google Patents

Abstract

An apparatus for providing a network service based on the second layer (L2) may be configured to perform an inner tagging and an outer tagging on a packet received from a user terminal, and to generate a subscriber authentication key based on the inner tagging and the outer tagging. A key generation unit, and the authentication key generation unit transmits authentication request information including the subscriber authentication key generated to the authentication gateway, and receives the authentication result processed by the authentication server based on the authentication request information transmitted from the authentication gateway. The IP allocation request is transmitted to the virtual premises device based on the authentication result, and the user terminal is assigned an IP address by the virtual premises device.

Description

DEVICE AND SYSTEM FOR PROVIDING L2 NETWORK SERVICE}

The present invention relates to an apparatus and system for providing a network service based on a second layer.

A home gateway refers to a device that interconnects or relays between a home network and an external communication service. The home gateway can provide a variety of multimedia services to the user at home by adding middleware technology to the upper layer. In addition, the home gateway may integrate various server functions such as a web server, a multimedia server, and a home automation server to perform a complex function as a home server.

In relation to such a home gateway, Korean Patent Laid-Open Publication No. 2009-0060700 discloses a power consumption-saving home gateway based on a network protocol and a control method thereof.

Recent home gateways include key network functions of the third layer (L3) of the OSI 7 layer, such as DHCP and NAT functions for IP assignment and firewall functions for packet filtering. However, as the home gateway is loaded with various functions, it is a cause of frequent failures.

In order to provide an apparatus and system for providing a network service based on a second layer that can easily configure an access network as L2 by removing a network function such as routing from an L3 based access network of a conventional home gateway. do. By virtualizing the network function of the home gateway, it is intended to provide an apparatus and system for providing a network service based on a second layer that can eliminate a cause of a failure occurring in the home gateway and reduce management and operation costs. In addition, when applying a new network service, to provide a device and system that provides a network service based on the second layer that can be applied to the new network service in a virtualized environment, without a software upgrade of the home gateway or replacement of the home gateway. do. However, the technical problem to be achieved by the present embodiment is not limited to the technical problems as described above, and other technical problems may exist.

As a means for achieving the above-described technical problem, an embodiment of the present invention, a tagging unit for performing inner tagging and outer tagging for a packet received from a user terminal and subscriber authentication based on the inner tagging and the outer tagging An authentication key generation unit for generating a key, wherein the authentication key generation unit transmits authentication request information including the generated subscriber authentication key to an authentication gateway, and is based on the authentication request information transmitted from the authentication gateway. Receiving an authentication result processed by the second terminal, transmitting an IP allocation request to the virtual indoor device based on the authentication result, and the user terminal is configured to be assigned an IP address by the virtual indoor device. A network device can be provided.

Further, another embodiment of the present invention includes a second layer-based network device and an authentication gateway, wherein the second layer-based network device receives a packet from a user terminal, performs inner tagging and outer tagging on the packet, Generate a subscriber authentication key based on the inner tagging and the outer tagging, and transmit authentication request information including the generated subscriber authentication key to an authentication gateway, wherein the authentication gateway is based on the subscriber authentication key The authentication request information is transmitted to the second layer-based network device, the authentication result is received from the authentication server, and the second layer-based network device is based on the authentication result. Send the IP allocation request to the device, and use it by the virtual premise device It is possible to provide a terminal of a second layer based network system is configured to receive the assigned IP address.

In addition, another embodiment of the present invention, a tagging unit for performing inner tagging and outer tagging for a packet received from a user terminal, a session key generation unit for generating a subscriber session key based on the inner tagging and the outer tagging And the session key generation unit transmits authentication request information including the generated subscriber session key to a broadband gateway to perform an authentication procedure through an authentication gateway, and based on the transmitted authentication request information from the authentication gateway. The second layer-based network device may be configured to receive an authentication result processed by an authentication server and to allocate an IP address to the user terminal based on the authentication result.

The above-described problem solving means are merely exemplary, and should not be construed as limiting the present invention. In addition to the exemplary embodiments described above, there may be additional embodiments described in the drawings and detailed description of the invention.

According to any one of the above-described problem solving means of the present invention, the second layer to remove the network function such as routing in the L3 based access network of the conventional home gateway, so that the access network can be simply configured as L2 It is possible to provide an apparatus and system for providing a network service based on the above. By virtualizing the network function of the home gateway, it is possible to provide an apparatus and system for providing a network service based on a second layer that can eliminate a cause of a failure occurring in the home gateway and reduce management and operation costs. In addition, when the new network service is applied, a device and system for providing a network service based on a second layer that enables the new network service to be applied in a virtualized environment without a software upgrade of the home gateway or replacement of the home gateway may be provided. Can be.

1 is a configuration diagram of a second layer-based network system according to an embodiment of the present invention.
2 is a block diagram of a second layer-based network device according to an embodiment of the present invention.
3 is a signal flow diagram illustrating a process of providing a network service based on a second layer in a second layer-based network system according to an embodiment of the present invention.
4 is a flowchart illustrating a method of providing a network service based on a second layer in a second layer-based network device according to an embodiment of the present invention.
5 is a configuration diagram of a second layer-based network device according to another embodiment of the present invention.
6 is a signal flowchart illustrating a process of providing a network service based on a second layer in a second layer-based network system according to another embodiment of the present invention.
7 is a flowchart illustrating a method of providing a network service based on a second layer in a second layer-based network device according to another embodiment of the present invention.

DETAILED DESCRIPTION Hereinafter, exemplary embodiments of the present invention will be described in detail with reference to the accompanying drawings so that those skilled in the art may easily implement the present invention. As those skilled in the art would realize, the described embodiments may be modified in various different ways, all without departing from the spirit or scope of the present invention. In the drawings, parts irrelevant to the description are omitted in order to clearly describe the present invention, and like reference numerals designate like parts throughout the specification.

Throughout the specification, when a part is "connected" to another part, it includes not only "directly connected" but also "electrically connected" with another element in between. . In addition, when a part is said to "include" a certain component, which means that it may further include other components, without excluding other components, unless specifically stated otherwise, one or more other features It is to be understood that the present disclosure does not exclude the possibility of adding or presenting numbers, steps, operations, components, parts, or combinations thereof.

In the present specification, the term 'unit' includes a unit realized by hardware, a unit realized by software, and a unit realized by both. In addition, one unit may be realized using two or more pieces of hardware, and two or more units may be realized by one piece of hardware.

Some of the operations or functions described as being performed by the terminal or the device in the present specification may instead be performed in a server connected to the terminal or the device. Similarly, some of the operations or functions described as being performed by the server may be performed by a terminal or a device connected to the server.

Hereinafter, an embodiment of the present invention will be described in detail with reference to the accompanying drawings.

1 is a configuration diagram of a second layer-based network system according to an embodiment of the present invention. Referring to FIG. 1, the second layer-based network system 1 may include a user terminal 110, a home gateway (not shown), a second layer-based network device 120, a virtual indoor device 130, and an authentication gateway 140. ), A broadband gateway (not shown), and an authentication server 150. A user terminal 110, a home gateway (not shown), a second layer-based network device 120, a virtual premises device 130, an authentication gateway 140, a broadband gateway (not shown), and an authentication server shown in FIG. 150 exemplarily illustrates components that can be controlled by the second layer-based network system 1.

Each component of the second layer based network system 1 of FIG. 1 is generally connected via a network. For example, as shown in FIG. 1, the second layer-based network device 120 may be connected to the user terminal 110 and the authentication gateway 140 at the same time or at intervals through a network.

The network refers to a connection structure capable of exchanging information between respective nodes such as terminals and servers. An example of such a network includes Wi-Fi, Bluetooth, Internet, and LAN. Network, Wireless Local Area Network (WLAN), Wide Area Network (WAN), Personal Area Network (PAN), 3G, 4G, 5G, LTE, and the like, but are not limited thereto.

The Open System Interconnection (OSI) 7 layer is a standard of the hierarchical implementation model used in an open data communication environment. The first layer of the physical layer, the second layer of the data link layer, the third layer of the network layer, and the transport layer And a fourth layer of, a fifth layer of a session layer, a sixth layer of a presentation layer, and a seventh layer of an application layer. Here, the second layer performs an error-free data transfer function from one station to another, and the device corresponding to the second layer may include a bridge, a switch, and the like. The third layer performs source-to-destination forwarding of packets through multiple network links, and the device corresponding to the third layer may include a router, an L3 switch, and the like.

In one embodiment, the second layer-based network system 1 includes a user terminal 110, a home gateway (not shown), a second layer-based network device 120, a virtual premises device 130, an authentication gateway 140. And an authentication server 150. Here, the second layer-based network system 1 includes a second layer-based network device 120 including an access switch, an aggregation switch, and a broadband network gateway (BNG) in the second layer. As the second layer, the virtual indoor device 130, the authentication gateway 140, and the authentication server 150 may be set as the third layer.

The user terminal 110 is a device for accessing the Internet, and may transmit a packet to the second layer-based network device 120. In addition, the user terminal 110 may be assigned an IP address from the virtual indoor device 130 through the second layer-based network device 120.

An example of such a user terminal 110 may include all kinds of TV devices using an Internet line, such as an Internet Protocol Television (IPTV), a Smart TV, and a Connected TV. In addition, the user terminal 110 may be a desktop, a notebook, a netbook, a netbook, an ultrabook, a subnotebook, a desknote, a UMPC (Ultra-Mobile PC), or the like. It can include all kinds of PCs. In addition, the user terminal 110 may include a personal communication system (PCS), a global system for mobile communications (GSM), a personal digital cellular (PDC), a personal handyphone system (PHS), a personal digital assistant (PDA), and an international mobile telecommunication (IMT). ) -2000, Code Division Multiple Access (CDMA) -2000, W-Code Division Multiple Access (W-CDMA), Wireless Broadband Internet (Wibro), 3G, 4G, 5G terminals, smart phones, tablet PCs, It may be a wireless communication device such as a notebook.

The home gateway (not shown) is a device for connecting the user terminal 110 to the Internet. The home gateway (not shown) may receive a packet from the user terminal 110 and transmit the packet to the second layer-based network device 120. Here, the home gateway (not shown) performs only the second layer-based bridge function, and the second layer-based network device 120 performs all traffic generated by the user terminal 110 located at the bottom of the home gateway (not shown). Can be forwarded to Through this, the home gateway (not shown) can minimize the CPU load for packet analysis by removing the network function corresponding to the third layer, and performs only the second layer-based bridge function that removes routing and firewall functions. Thus, transparency can be provided from end to end.

The second layer-based network device 120 may include an access switch, an aggregation switch, and a broadband network gateway (BNG). The access switch refers to a switch having a port connecting to the user terminal 110 in the access period, the device corresponding to the access switch may include a GES (Gigabit Ethernet Switch). An aggregation switch is a switch that aggregates traffic in an access section. The aggregation switch collects traffic and connects it to BNG. Examples of the aggregation switch include an optical line terminal (OLT) and a metro Ethernet switch. Can be. The BNG is a broadband gateway, and serves as a gateway device for authenticating subscribers' Internet access. The BNG device may include a service edge router. The BNG is located at an edge of an edge network for managing and controlling a subscriber profile of the user terminal 110, manages a connection session of the user terminal 110, and virtualizes a CPE or core network according to the user profile. It can handle routing for connection.

The second layer-based network device 120 may receive a packet from the user terminal 110 through a home gateway (not shown) serving as a bridge. In this case, the second layer-based network device 120 may perform inner tagging and outer tagging on the packet. For example, inner tagging may be specified as a Customer Virtual Local Network (CVLAN) tagging method, an Ethernet header type of the packet may be designated as '0x8100', and outer tagging may be performed using a Service Virtual Local Network (SVLAN) tagging method, The header type may be designated as '0x9100' or '0x88a8'.

The second layer-based network device 120 may generate a subscriber authentication key based on inner tagging and outer tagging, and may transmit authentication request information including the generated subscriber authentication key to the authentication gateway 140. In this case, when there is an authentication session of a subscriber identified by the subscriber authentication key, the second layer-based network device 120 may transmit a packet received from the user terminal 110 to the virtual indoor device 130. For example, the second layer-based network device 120 manages subscriber sessions for successful subscribers, and does not perform reauthentication for subsequent connections, and accesses all terminals of the same subscriber with the same authentication authority. The second layer-based network device 120 may transmit a packet to the virtual premises device 130 for the traffic generated in the premises of the subscriber for the authenticated subscriber session.

The second layer-based network device 120 may transmit an IP allocation request to the virtual premises device 130 based on the authentication result received from the authentication gateway 140.

The virtual premises device 130 may provide network functions such as carrier-grade NAT (CG-NAT), DHCP, and firewall in a virtualized environment. NAT functions to convert a public IP into a private IP, and may perform a function of assigning a private IP to the user terminal 110 by classifying subscribers. Here, the virtual indoor device 130 may be equipped with a CG-NAT function, and may process a NAT traverse function and an ALG function in addition to the NAT function. The NAT-Traverse function uses a private IP in the home, and uses a public IP when communicating with an external network, and manages NAT translation rules through NAT session management, and allows packets to pass through. You can decide whether or not. The application level gateway (ALG) can analyze the payload of packets at the application level and perform address translation for private IP such as IP or port.

The virtual indoor device 130 may allocate an IP address to the user terminal 110 based on the IP allocation request received from the second layer-based network device 120.

The authentication gateway 140 may transmit the authentication request information to the authentication server 150 based on the subscriber authentication key. In this case, the authentication gateway 140 may match and manage subscriber information (eg, a circuit contract ID) and an authentication key list for each terminal, and analyze the authentication request information based on the authentication key list. In addition, the authentication gateway 140 may extract subscriber information matching the subscriber authentication key from the authentication key list, and transmit the extracted subscriber information or authentication request information including the extracted subscriber information to the authentication server 150. That is, the authentication gateway 140 matches and manages the subscriber information and the authentication key list, so that the authentication server 150 is based on the subscriber's line contract ID based on the subscriber's line contract ID, regardless of the structure of the second network. Can manage. Thus, the present invention can accommodate a second network based authentication without changing the system for the authentication server 150.

The authentication gateway 140 may receive the authentication result from the authentication server 150 and transmit the authentication result to the second layer-based network device 120.

The authentication server 150 may manage a user's or subscriber's authentication profile and process authentication. For example, the authentication server 150 receives the authentication request information from the authentication gateway 140, processes the authentication for the authentication request information based on the subscriber's authentication profile, and transmits the authentication result to the authentication gateway 140. Can be.

In another embodiment, the second layer-based network system 1 includes a user terminal 110, a home gateway (not shown), a second layer-based network device 120, a virtual premises device 130, an authentication gateway 140. , A broadband gateway (BNG, not shown), and an authentication server 150. In this case, the second layer-based network system 1 uses a second layer-based network device 120 including an access switch, an aggregation switch, and a virtual premises device 130 as a second layer, an authentication gateway 140, and a broadband. The gateway BNG and the authentication server 150 may be set as the third layer. Through this, the second layer-based network system 1 is configured in a distributed form of access based by moving the virtual premises device 130 to the bottom of the broadband gateway, and reduces the traffic centralization problem generated in one embodiment. You can.

The user terminal 110 is a device for accessing the Internet, and may transmit a packet to the second layer-based network device 120. In addition, the user terminal 110 may be assigned an IP address from the second layer-based network device 120 through the second layer-based network device 120.

The home gateway (not shown) may receive a packet from the user terminal 110 and transmit the packet to the second layer-based network device 120.

The second layer-based network device 120 may receive a packet from the user terminal 110 through a home gateway (not shown) serving as a bridge. In this case, the second layer-based network device 120 may perform inner tagging and outer tagging on the packet. For example, inner tagging may be specified as a Customer Virtual Local Network (CVLAN) tagging method, an Ethernet header type of the packet may be designated as '0x8100', and outer tagging may be performed using a Service Virtual Local Network (SVLAN) tagging method, The header type may be designated as '0x9100' or '0x88a8'.

The second layer-based network device 120 may generate a subscriber session key based on inner tagging and outer tagging. In this case, the second layer-based network device 120 may manage NAT and DHCP sessions using the generated subscriber session key.

The second layer-based network device 120 may transmit authentication request information including a subscriber session key generated to a broadband gateway (not shown) to perform an authentication procedure through the authentication gateway 140. In this case, the second layer-based network device 120 may transmit authentication request information to a broadband gateway (not shown) based on whether the packet corresponds to a DHCP packet.

The broadband gateway (not shown) receives authentication request information from the second layer-based network device 120, generates a subscriber authentication key based on the authentication request information, and authenticates the authentication request information including the generated subscriber authentication key. May transmit to the gateway 140.

The authentication gateway 140 may transmit the authentication request information to the authentication server 150 based on the subscriber authentication key. In this case, the authentication gateway 140 may match and manage subscriber information and an authentication key list for each terminal, and analyze the authentication request information received from the second layer-based network device 120 based on the authentication key list. In addition, the authentication gateway 140 may extract subscriber information matching the subscriber authentication key from the authentication key list, and transmit the extracted subscriber information or authentication request information including the extracted subscriber information to the authentication server 150.

The authentication server 150 receives the authentication request information including the subscriber authentication key from the authentication gateway 140, processes the authentication request information based on the subscriber's authentication profile, and transmits the authentication result to the authentication gateway 140. Can be sent to.

The authentication gateway 140 may receive the processed authentication result based on the authentication request information from the authentication server 150 and transmit the processed authentication result to the second layer-based network device 120.

The second layer-based network device 120 may receive an authentication result from the authentication gateway 140 and allocate an IP address to the user terminal 110 based on the authentication result.

2 is a block diagram of a second layer-based network device according to an embodiment of the present invention. Referring to FIG. 2, the second layer-based network device 120 may include a tagging unit 210 and an authentication key generation unit 220.

The tagging unit 210 may receive a packet from the user terminal 110 through a home gateway (not shown) serving as a bridge.

The tagging unit 210 may perform inner tagging and outer tagging on the packet received from the user terminal 110. For example, inner tagging may be performed by a customer virtual local network (CVLAN) tagging scheme, and outer tagging may be performed by a service virtual local network (SVLAN) tagging scheme. The second layer is an Ethernet frame, which includes a destination MAC address, a source MAC address, an Ethernet type, a VLAN ID, and the like, and the Ethernet type includes the 802.1Q method and the QinQ method. The outer side is called an outer tag, and in the inner tag, the packet's Ethernet header type may be designated as '0x8100', and in the outer tagging, the packet's Ethernet header type may be designated as '0x9100' or '0x88a8'.

The authentication key generation unit 220 may generate a subscriber authentication key based on inner tagging and outer tagging. At this time, the authentication key generation unit 220 may generate a subscriber authentication key by a combination of tags set in the header of the packet by using the CVLAN tag method and the SVLAN tag method. For example, the authentication key generation unit 220 may manage the number of subscribers by generating a subscriber authentication key by a combination of the number of tags that can be set in the access switch and the aggregation switch, respectively.

The authentication key generator 220 may transmit authentication request information to the authentication gateway 140 based on whether the packet corresponds to a DHCP packet. For example, when the user terminal 110 corresponds to an initial access in the home, the authentication key generation unit 220 may use authentication request information to the authentication gateway 140 using a RADIUS (Remote Authentication Dial-In User Service) protocol. Can be transmitted. For another example, if the packet is not a DHCP packet, the authentication key generator 220 may transmit the packet to the virtual indoor device 130. When the packet is delivered to the core network by the virtual indoor device 130, the response packet processed by the core network may be delivered to the user terminal 110 through the virtual indoor device 130.

The authentication key generator 220 may transmit authentication request information including the subscriber authentication key generated to the authentication gateway 140. The authentication request information may be analyzed based on the authentication key list stored by matching the subscriber information by the authentication gateway 140.

The authentication key generator 220 may receive an authentication result processed by the authentication server 150 based on the authentication request information transmitted from the authentication gateway 140. At this time, the authentication key generation unit 220 transmits the IP allocation request to the virtual indoor device 130, based on the authentication result, the user terminal 110 is assigned an IP address by the virtual indoor device 130; You can do that.

That is, the authentication key generation unit 220 manages the subscriber session for the successful authentication, does not perform re-authentication for subsequent access, and allows access with the same authentication authority to all terminals of the same user. Can be. In addition, with respect to the subscriber session that has been authenticated, the authentication key generation unit 220 may transmit a packet to the virtual indoor device 130 for the traffic generated in the home.

3 is a signal flow diagram illustrating a process of providing a network service based on a second layer in a second layer-based network system according to an embodiment of the present invention. Referring to FIG. 3, the second layer-based network system 1 may include a user terminal 110, a second layer network device 120, a virtual indoor device 130, an authentication gateway 140, and an authentication server 150. It may include.

Here, the second layer-based network system 1 includes a second layer-based network device 120 including an access switch, an aggregation switch, and a broadband network gateway (BNG) in the second layer. As the second layer, the virtual indoor device 130, the authentication gateway 140, and the authentication server 150 may be set as the third layer.

The user terminal 110 may transmit a packet to the second layer-based network device 120 (S301).

The second layer-based network device 120 may perform inner tagging and outer tagging on the received packet (S302). Here, inner tagging may be performed by a CVLAN (Customer Virtual Local Network) tag scheme, and outer tagging may be performed by a Service Virtual Local Network (SVLAN) tag scheme. In this case, S302 may be performed by an access switch and an aggregation switch included in the second layer-based network device 120.

The second layer-based network device 120 may check whether the received packet is a DHCP packet (S303), and generate a subscriber authentication key based on inner tagging and outer tagging (S304). In this case, S303 to S304 may be performed by the BNG included in the second layer-based network device 120.

In addition, the second layer-based network device 120 may transmit authentication request information including the generated subscriber authentication key to the authentication gateway 140 (S305).

The authentication gateway 140 may transmit the analyzed authentication request information to the authentication server 150 based on the subscriber authentication key (S306).

When the authentication server 150 processes authentication for the authentication request information based on the subscriber's authentication profile (S307), and transmits the authentication result to the authentication gateway 140 (S308), the authentication gateway 140 sends the authentication result. It may transfer to the second layer-based network device 120 (S309).

When the second layer-based network device 120 requests the IP allocation request to the virtual indoor device 130 based on the authentication result (S310), the virtual indoor device 130 allocates an IP address to the user terminal 110. It may be (S311). At this time, the S310 may be performed by the BNG included in the second layer-based network device 120. That is, the BNG may request IP allocation from the virtual indoor device 130 based on the authentication result.

That is, in relation to the embodiment illustrated in FIG. 3, the BNG included in the second layer-based network device 120 checks whether the received packet is a DHCP packet, and based on inner tagging and outer tagging. The subscriber authentication key may be generated and an IP address assignment may be requested to the virtual premises device based on the authentication result.

In the above description, steps S301 to S311 may be further divided into additional steps or combined into fewer steps, according to an embodiment of the present invention. In addition, some steps may be omitted as necessary, and the order between the steps may be changed.

4 is a flowchart illustrating a method of providing a network service based on a second layer in a second layer-based network device according to an embodiment of the present invention. The method for providing a network service based on the second layer performed by the second layer-based network device 120 according to the embodiment shown in FIG. 4 is based on the second layer-based network system according to the embodiment shown in FIG. And the steps processed in time series in (1). Therefore, although omitted below, the present invention also applies to a method for providing a network service based on the second layer performed by the second layer-based network device 120 according to the embodiment shown in FIGS. 1 to 3.

In operation S410, the second layer-based network device 120 may perform inner tagging and outer tagging on the packet received from the user terminal 110. Here, the packet may be delivered from the user terminal 110 through a home gateway serving as a bridge. Inner tagging is performed by a Customer Virtual Local Network (CVLAN) tagging scheme, and outer tagging is performed by a Service Virtual Local Network (SVLAN). Can be performed by a tag method. In operation S420, the second layer-based network device 120 may generate a subscriber authentication key based on inner tagging and outer tagging. In this case, the second layer-based network device 120 may generate the subscriber authentication key by a combination of tags set in the header of the packet using the CVLAN tagging method and the SVLAN tagging method.

Although not shown in FIG. 4, the second layer-based network device 120 transmits authentication request information including a subscriber authentication key generated to the authentication gateway 140, and authentication request information transmitted from the authentication gateway 140. The method may further include receiving an authentication result processed by the authentication server 150 and transmitting an IP allocation request to the virtual premises apparatus 130 based on the authentication result. Here, the authentication request information may be analyzed based on the authentication key list stored by matching the subscriber information by the authentication gateway 140. Through this process, the user terminal 110 can be assigned an IP address by the virtual indoor device 130.

Although not shown in FIG. 4, the second layer-based network device 120 may further include transmitting authentication request information to the authentication gateway 140 based on whether the packet corresponds to a DHCP packet. At this time, if the packet is not a DHCP packet, when the second layer-based network device 120 transmits the packet to the virtual premises device 130, the packet is delivered to the core network by the virtual premises device 130, and the core The response packet processed by the network may be delivered to the user terminal 110 through the virtual indoor device.

In the above description, steps S410 to S420 may be further divided into additional steps or combined into fewer steps, according to an embodiment of the invention. In addition, some steps may be omitted as necessary, and the order between the steps may be changed.

5 is a configuration diagram of a second layer-based network device according to another embodiment of the present invention. Referring to FIG. 5, the second layer-based network device 120 may include a tagging unit 510 and a session key generation unit 520.

The tagging unit 510 may receive a packet from the user terminal 110 through a home gateway (not shown) serving as a bridge.

The tagging unit 510 may perform inner tagging and outer tagging on the packet received from the user terminal 110. Here, inner tagging may be performed by a CVLAN (Customer Virtual Local Network) tag scheme, and outer tagging may be performed by a Service Virtual Local Network (SVLAN) tag scheme. The second layer is an Ethernet frame, which includes a destination MAC address, a source MAC address, an Ethernet type, a VLAN ID, and the like, and the Ethernet type includes the 802.1Q method and the QinQ method. The outer side is called an outer tag, and in the inner tag, the packet's Ethernet header type may be designated as '0x8100', and in the outer tagging, the packet's Ethernet header type may be designated as '0x9100' or '0x88a8'.

The session key generator 520 may generate a subscriber session key based on inner tagging and outer tagging. At this time, the session key generation unit 520 may generate the subscriber session key by a combination of tags set in the header of the packet using the CVLAN tag method and the SVLAN tag method.

The session key generator 520 may transmit authentication request information including the subscriber session key to a broadband gateway (not shown) based on whether the packet corresponds to a DHCP packet. For example, if the packet corresponds to a DHCP packet, the session key generator 520 may transmit authentication request information to a broadband gateway (not shown). At this time, the subscriber authentication key is generated based on the authentication request information by the broadband gateway (not shown), and the authentication request information including the generated subscriber authentication key may be transmitted to the authentication gateway 140. Here, the authentication request information may be analyzed based on the authentication key list stored by matching the subscriber information by the authentication gateway 140.

For another example, if the packet is not a DHCP packet, the session key generator 520 may transmit the packet to a broadband gateway (not shown). At this time, the authentication session is confirmed by the broadband gateway (not shown), the packet is delivered to the core network, and the response packet processed by the core network sends the broadband gateway (not shown) and the second layer-based network device 120 to each other. It may be delivered to the user terminal 110 through.

6 is a signal flowchart illustrating a process of providing a network service based on a second layer in a second layer-based network system according to another embodiment of the present invention. Referring to FIG. 6, the second layer-based network system 1 may include a user terminal 110, a second layer network device 120, an authentication gateway 140, an authentication server 150, and a broadband gateway 160. It may include.

In this case, the second layer-based network system 1 uses a second layer-based network device 120 including an access switch, an aggregation switch, and a virtual premises device 130 as a second layer, an authentication gateway 140, and a broadband. The gateway BNG and the authentication server 150 may be set as the third layer.

The user terminal 110 may transmit a packet to the second layer-based network device 120 (S601).

The second layer-based network device 120 may perform inner tagging and outer tagging on the received packet (S602). Here, inner tagging may be performed by a CVLAN (Customer Virtual Local Network) tag scheme, and outer tagging may be performed by a Service Virtual Local Network (SVLAN) tag scheme. In this case, S602 may be performed by an access switch and an aggregation switch included in the second layer-based network device 120.

The second layer-based network device 120 may check whether the received packet is a DHCP packet (S603), and generate a subscriber session key based on inner tagging and outer tagging (S604). In this case, S603 to S604 may be performed by the virtual indoor device included in the second layer-based network device 120.

In this case, the second layer-based network device 120 may transmit authentication request information including the subscriber session key generated to the broadband gateway 160 to perform an authentication procedure through the authentication gateway 140 (S605). .

The broadband gateway 160 may generate a subscriber authentication key based on the authentication request information (S606), and may transmit authentication request information including the generated subscriber authentication key to the authentication gateway 140 (S607).

The authentication gateway 140 may transmit the analyzed authentication request information to the authentication server 150 based on the subscriber authentication key (S608). When the authentication server 150 processes authentication for the authentication request information based on the subscriber's authentication profile (S609), and transmits the authentication result to the authentication gateway 140 (S610), the authentication gateway 140 transmits the authentication result. The second layer-based network device 120 may transmit the information to the second layer-based network device 120 (S611).

The second layer-based network device 120 may allocate an IP address to the user terminal 110 based on the authentication result (S612). In this case, S612 may be performed by a virtual indoor device included in the second layer-based network device 120.

That is, in relation to the exemplary embodiment illustrated in FIG. 6, the virtual indoor device included in the second layer-based network device 120 checks whether the received packet is a DHCP packet, and checks for inner tagging and outer tagging. A subscriber session key can be generated based on this, and an IP address can be assigned to the user terminal based on the authentication result. Therefore, the second layer-based network device of FIG. 3 and the second layer-based network device of FIG. 6 may be distinguished according to whether the BNG or the virtual indoor device is included.

In the above description, steps S601 to S612 may be further divided into additional steps or combined into fewer steps, according to an embodiment of the present invention. In addition, some steps may be omitted as necessary, and the order between the steps may be changed.

7 is a flowchart illustrating a method of providing a network service based on a second layer in a second layer-based network device according to another embodiment of the present invention. The method for providing a network service based on the second layer performed by the second layer-based network device 120 according to the embodiment shown in FIG. 7 is based on the second layer-based network system according to the embodiment shown in FIG. 1. And the steps processed in time series in (1). Therefore, although omitted below, the present invention also applies to a method for providing a network service based on the second layer performed by the second layer-based network device 120 according to the embodiment shown in FIGS. 1 to 6.

In operation S710, the second layer-based network device 120 may perform inner tagging and outer tagging on the packet received from the user terminal 110. Here, the packet may be delivered from the user terminal 110 through a home gateway serving as a bridge. Inner tagging is performed by a Customer Virtual Local Network (CVLAN) tagging scheme, and outer tagging is performed by a Service Virtual Local Network (SVLAN). Can be performed by a tag method. In operation S720, the second layer-based network device 120 may generate a subscriber session key based on inner tagging and outer tagging. In this case, the second layer-based network device 120 may generate the subscriber session key by a combination of tags set in the header of the packet using the CVLAN tagging method and the SVLAN tagging method.

Although not shown in FIG. 7, the second layer-based network device 120 transmits authentication request information including a subscriber session key generated to the broadband gateway to perform an authentication procedure through the authentication gateway 140 and authentication. The method may further include receiving an authentication result processed by the authentication server 150 based on the authentication request information transmitted from the gateway 140. Here, the authentication request information may be analyzed based on the authentication key list stored by matching the subscriber information by the authentication gateway 140. Through this process, the user terminal 110 can be assigned an IP address by the virtual indoor device 130.

Although not shown in FIG. 7, the second layer-based network device 120 may transmit authentication request information to the broadband gateway based on whether the packet corresponds to a DHCP packet. For example, when the packet corresponds to a DHCP packet, the second layer-based network device 120 transmits authentication request information to the broadband gateway, and a subscriber authentication key is generated by the broadband gateway based on the authentication request information. The authentication request information including the generated subscriber authentication key may be transmitted to the authentication server 150. In another example, if the packet is not a DHCP packet, the second layer-based network device 120 transmits the packet to the broadband gateway, an authentication session is confirmed by the broadband gateway, and the packet is forwarded to the core network. The response packet processed by the PC may be delivered to the user terminal 110 through the broadband gateway and the second layer-based network device.

In the above description, steps S710 to S720 may be further divided into additional steps or combined into fewer steps, according to an embodiment of the invention. In addition, some steps may be omitted as necessary, and the order between the steps may be changed.

The method for providing a network service based on the second layer in the second layer-based network device 120 described with reference to FIGS. 1 to 7 may be executed by a computer program stored in a medium executed by a computer or instructions executable by the computer. It can also be implemented in the form of a recording medium that includes. In addition, the method of providing a network service based on the second layer in the second layer-based network device 120 described with reference to FIGS. 1 to 7 may also be implemented in the form of a computer program stored in a medium executed by a computer. Can be. Computer readable media can be any available media that can be accessed by a computer and includes both volatile and nonvolatile media, removable and non-removable media. In addition, computer readable media may include both computer storage media and communication media. Computer storage media includes both volatile and nonvolatile, removable and non-removable media implemented in any method or technology for storage of information such as computer readable instructions, data structures, program modules or other data. Communication media typically includes computer readable instructions, data structures, program modules, or other data in a modulated data signal such as a carrier wave, or other transmission mechanism, and includes any information delivery media.

The above description of the present invention is intended for illustration, and it will be understood by those skilled in the art that the present invention may be easily modified in other specific forms without changing the technical spirit or essential features of the present invention. will be. Therefore, it should be understood that the embodiments described above are exemplary in all respects and not restrictive. For example, each component described as a single type may be implemented in a distributed manner, and similarly, components described as distributed may be implemented in a combined form.

The scope of the present invention is shown by the following claims rather than the above description, and all changes or modifications derived from the meaning and scope of the claims and their equivalents should be construed as being included in the scope of the present invention. do.

110: user terminal
120: second layer-based network device
130: virtual home device
140: authentication gateway
150: authentication server
210: tagging part
220: authentication key generation unit
510: tagging part
520: session key generation unit

Claims (18)

An apparatus for providing a network service based on a second layer (L2),
A tagging unit for performing inner tagging and outer tagging on a packet received from a user terminal; And
Authentication key generation unit for generating a subscriber authentication key based on the inner tagging and the outer tagging
Including,
The authentication key generation unit transmits authentication request information including the generated subscriber authentication key to an authentication gateway,
Receiving an authentication result processed by an authentication server based on the authentication request information transmitted from the authentication gateway,
Sends an IP allocation request to the virtual indoor device based on the authentication result,
The user terminal is configured to be assigned an IP address by the virtual indoor device,
The inner tagging is performed by a Customer Virtual Local Network (CVLAN) tagging method, and the outer tagging is configured to be performed by a Service Virtual Local Network (SVLAN) tagging method.
And the authentication key generation unit is configured to generate the subscriber authentication key by a combination of a tag set in a header of the packet by using the CVLAN tagging method and the SVLAN tagging method. delete delete The method of claim 1,
And the authentication key generating unit is configured to transmit the authentication request information to the authentication gateway based on whether the packet corresponds to a DHCP packet. The method of claim 4, wherein
The authentication key generation unit, if the packet is not a DHCP packet, transmits the packet to the virtual indoor device,
The packet is forwarded to the core network by the virtual premises device,
And the response packet processed by the core network is forwarded to the user terminal through the virtual premises device. The method of claim 1,
And the authentication request information is analyzed based on a list of authentication keys stored and matched with subscriber information by the authentication gateway. The method of claim 1,
And the packet is configured to be delivered from the user terminal to the tagging unit through a home gateway serving as a bridge. In the system for providing a network service based on the second layer (L2),
A second layer-based network device; And
Authentication gateway
Including,
The second layer-based network device,
Receive a packet from the user terminal,
Inner tagging and outer tagging the packet,
Generate a subscriber authentication key based on the inner tagging and the outer tagging;
Transmitting authentication request information including the generated subscriber authentication key to an authentication gateway,
The authentication gateway,
Deliver the authentication request information to an authentication server based on the subscriber authentication key, receive an authentication result from the authentication server, and transmit the authentication result to the second layer-based network device,
The second layer-based network device transmits an IP allocation request to a virtual indoor device based on the authentication result,
The user terminal is configured to be assigned an IP address by the virtual indoor device,
The inner tagging is performed by a Customer Virtual Local Network (CVLAN) tagging method, and the outer tagging is configured to be performed by a Service Virtual Local Network (SVLAN) tagging method.
The second layer-based network device,
And generating the subscriber authentication key by a combination of a tag set in a header of the packet by using the CVLAN tagging scheme and the SVLAN tagging scheme. The method of claim 8,
The authentication gateway is configured to match and manage subscriber information and an authentication key list for each terminal, and analyze the authentication request information based on the authentication key list. The method of claim 9,
And the authentication gateway is configured to extract subscriber information matching the subscriber authentication key from the authentication key list and transmit the extracted subscriber information to the authentication server. In the device for providing a network service based on the second layer (L2),
A tagging unit that performs inner tagging and outer tagging on a packet received from a user terminal;
Session key generation unit for generating a subscriber session key based on the inner tagging and the outer tagging
Including,
The session key generation unit transmits authentication request information including the generated subscriber session key to a broadband gateway to perform an authentication procedure through an authentication gateway,
Receive an authentication result processed by an authentication server based on the transmitted authentication request information from the authentication gateway,
Is configured to assign an IP address to the user terminal based on the authentication result,
The inner tagging is performed by a Customer Virtual Local Network (CVLAN) tagging method, and the outer tagging is configured to be performed by a Service Virtual Local Network (SVLAN) tagging method.
And the session key generation unit is configured to generate the subscriber session key by a combination of tags set in a header of the packet by using the CVLAN tagging scheme and the SVLAN tagging scheme. delete delete The method of claim 11,
And the session key generator is configured to transmit the authentication request information to the broadband gateway based on whether the packet corresponds to a DHCP packet. The method of claim 14,
The session key generation unit transmits the authentication request information to the broadband gateway when the packet corresponds to a DHCP packet.
A subscriber authentication key is generated by the broadband gateway based on the authentication request information.
And the authentication request information including the generated subscriber authentication key is configured to be transmitted from the broadband gateway to the authentication gateway. The method of claim 14,
The session key generation unit, if the packet is not a DHCP packet, transmits the packet to the broadband gateway,
An authentication session is confirmed by the broadband gateway and the packet is forwarded to a core network,
And the response packet processed by the core network is forwarded to the user terminal through the broadband gateway and the second layer-based network device. The method of claim 11,
And the authentication request information is analyzed based on a list of authentication keys stored and matched with subscriber information by the authentication gateway. The method of claim 11,
And the tagging unit is configured to receive the packet from the user terminal through a home gateway acting as a bridge.

Images