KR102187301B1 - The multiple virtual network communication system and method using virtual router - Google Patents

Abstract

A multi-virtual network communication system and method using a virtual router are provided. The multi-virtual network communication system using the virtual router is a first virtual network for performing data communication by creating a first tunnel between a first user terminal and a second user terminal, and is separated by software from the first virtual network. , A second virtual network for performing data communication by creating a second tunnel between a third user terminal and a fourth user terminal, a first virtual router for establishing the first virtual network, and the first virtual router A gateway for creating the first tunnel through the first tunnel, generating a second virtual router for establishing the second virtual network, and generating the second tunnel through the second virtual router, and the first to fourth user terminals And a virtual network management device for receiving terminal authentication information from and performing terminal authentication, generating virtual network information on the first virtual network or the second virtual network, and transmitting the generated virtual network information to the gateway, the first user terminal Is set to include the same IP information as the third user terminal, and the second user terminal may be set to include the same IP information as the fourth user terminal.

Description

The multiple virtual network communication system and method using virtual router}

The present invention relates to a multi-virtual network communication system and method using a virtual router. More specifically, it relates to a multi-virtual network communication system and method using a virtual router that enhances security and enables infinite utilization of limited IP resources.

In recent years, with the development of semiconductor technology, the performance of computer processors has been highly improved, and with the development of multi-core processor technology, the amount of work that can be performed simultaneously on one server has increased.

Meanwhile, in private data centers in the corporate or financial sector, as few as dozens to as many as hundreds of servers are installed to provide corporate or financial services (corporate finance, financial services, securities services, etc.). In addition, in an internet data center (IDC), hundreds or thousands of servers are provided in one place to stably provide various services (web server, mail server, file server, video server, cloud server, etc.) to different users. It is installed on. Therefore, enterprise operators or Internet service providers have demanded to reduce costs and simplify server management by integrating servers, and to control large-scale multi-processors and cluster equipment such as server storage or render farms. . In addition, there is a need to execute an application program dependent on a specific operating system in other hardware or operating system.

To meet these requirements, the concept of server virtualization has emerged. In a server virtualization environment, one or more different virtual machines may exist on one server. These different virtual machines can share the hardware (cpu, memory, storage, network interface, etc.) resources of the virtualized server. The hypervisor can perform functions such as creation, removal, transfer, and resource management of virtual machines within the server. In addition, the hypervisor allows virtual machines to share network and storage. In the case of storage, by setting the hypervisor to use storage in a logically or physically divided area for each virtual machine, the entire storage can be shared between virtual machines without interference.

However, in the case of a network, it is common for several (tens to hundreds) virtual machines installed on a single server to share a small number of network devices. When more than one virtual machine shares a network device, the network device must allow each virtual machine to share the network without interfering with each other at the network level. A technology for solving this problem is a network virtualization technology.

Korean Patent Laid-Open Patent 10-2012-0065131 (Publication date June 20, 2012)

The technical problem to be solved by the present invention is to separate a single network device in hardware into multiple virtual networks in software and use it for data communication between a pair of user terminals, and at this time, for infinite use of limited IP resources. It is to provide a multi-virtual network communication system and method using a virtual router capable of setting IP information identically between each terminal pair (eg, terminal-terminal or terminal-server).

However, the technical problems to be solved by the present invention are not limited to the above problems, and may be variously extended without departing from the spirit and scope of the present invention.

A multi-virtual network communication system using a virtual router according to an embodiment of the present invention for solving the above problem is a first virtual network communication system for performing data communication by creating a first tunnel between a first user terminal and a second user terminal. Network, a second virtual network that is separated by software from the first virtual network and performs data communication by creating a second tunnel between a third user terminal and a fourth user terminal, and a second virtual network for establishing the first virtual network 1 Create a virtual router, create the first tunnel through the first virtual router, create a second virtual router for establishing the second virtual network, and establish the second tunnel through the second virtual router. A gateway to generate, and receiving terminal authentication information from the first to fourth user terminals, performing terminal authentication, generating virtual network information about the first virtual network or the second virtual network, and transmitting the generated virtual network information to the gateway. Including a virtual network management device, the first user terminal is set to include the same IP information as the third user terminal, the second user terminal can be set to include the same IP information as the fourth user terminal .

According to some embodiments of the present invention, the virtual network management apparatus automatically performs terminal authentication when a terminal authentication request for creating the first virtual network is transmitted from the first user terminal or the second user terminal. Then you can return the result.

According to some embodiments of the present invention, the virtual network management apparatus automatically performs terminal authentication when a terminal authentication request for creating the second virtual network is transmitted from the third user terminal or the fourth user terminal. Then you can return the result.

According to some embodiments of the present invention, the gateway receives a first virtual network creation request from the first user terminal or the second user terminal and transmits a virtual network creation response corresponding to the first virtual network creation request. And, it is possible to create the first virtual network.

According to some embodiments of the present invention, the gateway receives a second virtual network creation request from the third user terminal or the fourth user terminal and transmits a virtual network creation response corresponding to the second virtual network creation request. And, it is possible to create the second virtual network.

According to some embodiments of the present invention, the first virtual router and the second virtual router may be separate virtual routers.

According to some embodiments of the present invention, the first virtual router and the second virtual router are a single virtual router, and the first virtual network and the second virtual network may be respectively created through the single virtual router. have.

In the multi-virtual network communication method using a virtual router according to an embodiment of the present invention for solving the above problem, the first terminal authentication information of a first user terminal is transmitted to a virtual network management device, the virtual network management device A step of performing terminal authentication based on the first terminal authentication information and transmitting virtual network information to a gateway, the first user terminal transmitting a first virtual network creation request to the gateway to establish a first virtual network The step of: establishing a first virtual network between the first user terminal and the second user terminal in response to the request to create the first virtual network, and the second terminal authentication information of the third user terminal is provided with the virtual network management apparatus. Transmitting to, the virtual network management device performing terminal authentication based on the second terminal authentication information, and transmitting virtual network information to the gateway, the third user terminal to the gateway a second virtual network Transmitting a second virtual network creation request for establishment, and establishing a second virtual network between the third user terminal and a fourth user terminal in response to the second virtual network creation request, wherein the The first user terminal may be configured to include the same IP information as the third user terminal, and the second user terminal may be configured to include the same IP information as the fourth user terminal.

According to some embodiments of the present invention, the first virtual network and the second virtual network may be established through separate virtual routers respectively created in the gateway.

According to some embodiments of the present invention, the first virtual network and the second virtual network are established by a single virtual router created in the gateway, and the first virtual network and the second virtual network are configured through the single virtual router. 2 Each virtual network can be created.

Other specific details of the present invention are included in the detailed description and drawings.

According to the present invention, it is possible to prevent interference between tunnels used as communication channels by separating multiple virtual networks from each other in software using a single network device. Accordingly, user terminal pairs of virtual networks can be configured with the same IP information, and by using separate virtual networks, there is no interference between multiple virtual networks, enhancing security, and limiting limited IP resources. Utilization becomes possible.

In particular, since the separation between different virtual networks is implemented in software, it is possible to configure a plurality of virtual networks using a single network device in hardware, thereby realizing infinite utilization of limited IP resources.

However, the effects of the present invention are not limited to the above effects, and may be variously extended without departing from the spirit and scope of the present invention.

1 is a block diagram showing the configuration of a multi-virtual network communication system using a virtual router according to an embodiment of the present invention.
2 is a block diagram showing the configuration of a virtual network management apparatus according to an embodiment of the present invention.
3 is a flowchart sequentially showing a method of establishing and managing a virtual network according to an embodiment of the present invention.
4 and 5 are block diagrams illustrating a method of establishing and managing a virtual network according to an embodiment of the present invention.
6 is a block diagram illustrating a configuration of a multi-virtual network communication system using a virtual router according to another embodiment of the present invention.

Advantages and features of the present invention, and a method of achieving them will become apparent with reference to the embodiments described below in detail together with the accompanying drawings. However, the present invention is not limited to the embodiments disclosed below, but will be implemented in a variety of different forms, only these embodiments make the disclosure of the present invention complete, and common knowledge in the technical field to which the present invention pertains. It is provided to completely inform the scope of the invention to those who have, and the invention is only defined by the scope of the claims.

The terms used in this specification are for describing exemplary embodiments, and are not intended to limit the present invention. In this specification, the singular form also includes the plural form unless specifically stated in the phrase. As used in the specification, "comprises" and/or "comprising" refers to the presence of one or more other components, steps, actions and/or elements, and/or elements, steps, actions and/or elements mentioned. Or does not exclude additions.

Unless otherwise defined, all terms (including technical and scientific terms) used in the present specification may be used as meanings that can be commonly understood by those of ordinary skill in the art to which the present invention belongs. In addition, terms defined in a commonly used dictionary are not interpreted ideally or excessively unless explicitly defined specifically.

Hereinafter, preferred embodiments of the present invention will be described in more detail with reference to the accompanying drawings. The same reference numerals are used for the same elements in the drawings, and duplicate descriptions for the same elements are omitted.

The present invention automatically creates multiple virtual networks through an authentication procedure for a user's terminal, and implements a virtual network for a terminal pair in which data is exchanged to prevent each of the multiple virtual networks from interfering with each other. As a technique for mapping routing, it relates to a technique in which different terminal pairs can each perform communication using the same IP in a single network device in hardware. In the present specification, the term terminal, terminal pair, or user terminal is used as a term encompassing not only terminal devices but also all devices capable of performing network communication, such as servers and computing devices.

Among the terms used in this specification, a tunnel means not only a 1:1 communication channel between user terminals through a virtual router on a gateway in which a virtual network is implemented, but also includes the meaning of multiple communication channels such as 1:N and N:1. do. To this end, a program for virtual network communication may be installed in the user terminal, the gateway, and the virtual network management device.

In the present specification, a virtual router is a basic unit of a channel that enables communication using a virtual network, and can generally be composed of one IP address and one port number or one IP address and an arbitrary key pair. Hereinafter, a multi-virtual network communication system using a virtual router according to embodiments of the present invention will be described with reference to the drawings.

1 is a block diagram showing the configuration of a multi-virtual network communication system using a virtual router according to an embodiment of the present invention.

1, a multi-virtual network communication system using a virtual router according to an embodiment of the present invention includes a first user terminal 10, a second user terminal 20, a third user terminal 30, and a fourth user terminal. User terminal 40, fifth user terminal 50, sixth user terminal 60, seventh user terminal 70, first virtual network 110, second virtual network 120, third virtual network (130), a fourth virtual network 140, a gateway 100, may include a virtual network management device 200.

In FIG. 1, the first to seventh user terminals 10 to 70 are illustrated by way of example, and these are shown together to explain the technical idea of the present invention, and only some of them will constitute the communication system in the present invention. It is self-evident. In addition, in FIG. 1, the first to fourth virtual networks 110 to 140 are illustrated as an example, and these are illustrated together to explain the technical idea of the present invention, and only some of them are the communication system in the present invention. It is obvious that it can be constructed.

As described above, the first to seventh user terminals 10 to 70 may correspond to a terminal device, a server, or a computing device.

The first user terminal 10 is a device capable of network communication with the virtual network management apparatus 200 and the second user terminal 20 for data communication through the gateway 100. For example, the first user terminal 10 may be any one of a desktop PC, a fixed computing device such as a server device, or a mobile computing device such as a smart phone, PDA, laptop, slate PC, and tablet PC. Alternatively, the first user terminal 10 may be an Internet of Things (IoT) terminal device such as an IP camera, a drone, or a WallPad.

Likewise, the third user terminal 30 is a device capable of network communication with the virtual network management device 200 and the fourth user terminal 40 for data communication through the gateway 100, for example, a desktop It may be any one of a fixed computing device such as a PC or a server device or a mobile computing device such as a smart phone, PDA, laptop, slate PC, or tablet PC, or an IoT terminal device such as an IP camera, drone, or WallPad.

Here, for convenience, the first user terminal 10 is defined as a user terminal performing data communication with the second user terminal 20, and the third user terminal 30 communicates data with the fourth user terminal 40. Although it has been defined as a user terminal that performs an operation, this is simplified for convenience of description, and the content of the present invention is not limited thereto, and data communication between user terminals may be supported through various network structures.

The first virtual network 110 is a communication network for transmitting transmission/reception data between the first user terminal 10 and the second user terminal 20 through the gateway 100, for example, software in a single network device. It may be any one of virtual networks created by being divided into multiple units. Similarly, the second virtual network 120 is a communication network for transmitting transmission/reception data between the third user terminal 30 and the fourth user terminal 40 through the gateway 100, and the software It may be any one different from the first virtual network 110 among virtual networks generated by being divided into multiple units.

The first virtual network 110 creates a virtual router when an authentication request for creating a virtual network and a request for creating a virtual network are transmitted from the first user terminal 10 or the second user terminal 20 to create a first tunnel ( T1) can be created and established for data communication between user terminals. In addition, the second virtual network 120 is a separate virtual router from the virtual router when an authentication request for virtual network creation and a virtual network creation request are transmitted from the third user terminal 30 or the fourth user terminal 40. A router may be created to create a second tunnel T2, and may be established for data communication between user terminals.

In addition, the fifth user terminal 50 is a device capable of network communication with the virtual network management device 200 and the sixth user terminal 60 for data communication and the seventh user terminal 70 through the gateway 100 to be. That is, the fifth user terminal 50 is a device capable of network communication with the sixth user terminal 60 and the seventh user terminal 70 different from each other through a multi-virtual network.

For example, the fifth user terminal 50 may be any one of a desktop PC, a fixed computing device such as a server device, or a mobile computing device such as a smart phone, PDA, laptop, slate PC, and tablet PC. Alternatively, the fifth user terminal 50 may be an IoT terminal device such as an IP camera, a drone, or a WallPad.

In FIG. 1, the third virtual network 130 and the fourth virtual network 140 are illustrated as being created in one gateway 100, but the present invention is not limited thereto, and the third virtual network 130 and the third virtual network 130 4 The virtual network 140 may be created through different gateways.

When the fifth user terminal 50 communicates with the sixth user terminal 60 and the seventh user terminal 70 different from each other through a multi-virtual network, the sixth user terminal 60 and the seventh user terminal ( In 70), the destination IP information must be set differently. This will be described in detail later.

The third virtual network 130 is a communication network for transmitting transmission/reception data between the fifth user terminal 50 and the sixth user terminal 60 through the gateway 100, for example, software in a single network device. As a result, it may be any one different from the first and second virtual networks 110 and 120 among the virtual networks generated by being divided into multiple units. Similarly, the fourth virtual network 140 is a communication network for transmitting transmission/reception data between the fifth user terminal 50 and the seventh user terminal 70 through the gateway 100, and the software It may be any one different from the first to third virtual networks 110 to 130 among virtual networks generated by being divided into multiple units.

The third virtual network 130 generates a virtual router when an authentication request for creating a virtual network and a request for creating a virtual network are transmitted from the fifth user terminal 50 or the sixth user terminal 60 to create a third tunnel ( T3) can be created and established for data communication between user terminals. In addition, the fourth virtual network 140 is a separate virtual router from the virtual router when an authentication request for creating a virtual network and a request for creating a virtual network are transmitted from the fifth user terminal 50 or the seventh user terminal 70. A router may be created to create a fourth tunnel T4, and may be established for data communication between user terminals.

The gateway 100 is a node that communicates with the first to seventh user terminals 10 to 70, and includes a virtual router constituting a virtual network between corresponding user terminals among the first to seventh user terminals 10 to 70. It may contain more than one. In particular, according to an embodiment of the present invention, the gateway 100 may generate a virtual network between one or more virtual routers and one or more user terminal pairs under the control of the virtual network management apparatus 200. In this case, the virtual router may be generated in real time according to a request to create a virtual network from the first to seventh user terminals 10 to 70. Separate different virtual routers may be created for data communication between different terminal pairs.

In FIG. 1, as the first virtual network 110 and the second virtual network 120 are created, the virtual router of the first virtual network 110, the first user terminal 10, and the second user terminal 20 A tunnel created between the first tunnel (T1), the virtual router of the second virtual network 120 and the third user terminal 30, and the second tunnel (T2). ) Is illustrated. Here, the first virtual network 110 and the second virtual network 120 are services that use different virtual routers, and use separate communication channels on the network and do not interfere with each other between these virtual networks.

Accordingly, the IP information of the first user terminal 10 and the second user terminal 20 of the service using the first virtual network 110 is a third user terminal of the service using the second virtual network 120 ( 30) and the IP information of the fourth user terminal 40 may be identical to each other. For example, if the IP address of the first user terminal 10 is exemplified as 1.1.1.1 and the IP address of the second user terminal 20 is 2.2.2.2, the first virtual network 110 The IP address of the third user terminal 30 in the second virtual network 120 may also be set to 1.1.1.1, and the IP address of the fourth user terminal 40 may be set to 2.2.2.2.

In addition, in FIG. 1, as the third virtual network 130 and the fourth virtual network 140 are created, the virtual router of the third virtual network 130, the fifth user terminal 50, and the sixth user terminal ( 60) A third tunnel (T3), a tunnel created between the virtual router of the fourth virtual network 140, the fifth user terminal 50, and the seventh user terminal 70, as a fourth tunnel (T4) is illustrated. Here, the third virtual network 130 and the fourth virtual network 140 are services using different virtual routers, and use separate communication channels on the network and do not interfere with each other between these virtual networks.

Accordingly, the IP information of the fifth user terminal 50 and the sixth user terminal 60 of the service using the third virtual network 130 is the service using the first or second virtual network (110, 120). User terminals and IP information may be identical to each other. For example, the IP address of the fifth user terminal 50 may be set to 1.1.1.1, and the IP address of the sixth user terminal 60 may be set to 2.2.2.2. However, since the 7th user terminal 70 of the service using the 4th virtual network 140 can perform accurate data communication only when the 6th user terminal 60 and the receiving side IP information are different, the 7th user terminal 70 The IP address of) can be set to 3.3.3.3, for example.

By using a virtual network separated from each other as described above, interference between multiple virtual networks or multiple virtual networks is prevented, security is enhanced, and limited use of limited IP resources is possible. In particular, since the separation between different virtual networks is implemented in software, it is possible to configure a plurality of virtual networks using a single network device in hardware, thereby realizing infinite utilization of limited IP resources.

Meanwhile, in FIG. 1, a case in which the gateway 100 is a physically separate configuration from the virtual network management apparatus 200 is illustrated as an example, but the embodiment of the present invention is not limited thereto, and the gateway 100 is a virtual network It may be integrated with the management device 200 and implemented as a single hardware unit.

The virtual network management apparatus 200 may be a computing device that executes a plurality of virtual networks and tunnels according to an embodiment of the present invention on a multi or multi virtual network communication system and controls the overall operation of the gateway 100. In particular, the virtual network management device 200 may be any one of fixed computing devices such as desktop PCs and server devices capable of wired/wireless communication with the gateway 100, as well as mobile devices such as smart phones, tablet PCs, laptops, and PDAs. It may be any one of the computing devices.

The virtual network management apparatus 200 includes the first and second user terminals 10 and 10 through the first tunnel T1 created between the virtual router on the gateway 100 and the first and second user terminals 10 and 20. 20) and data communication can be performed. In particular, according to an embodiment of the present invention, the virtual network management apparatus 200 may provide a service for setting a virtual network in real time at that time in response to an authentication request and a virtual network creation request from a user terminal. Specifically, as the virtual network management apparatus 200 receives an authentication request and a virtual network creation request from at least one of the first to seventh user terminals 10 to 70, the virtual router corresponding to each user terminal pair is It is possible to provide a virtual network communication service by controlling to be generated on 100 and establishing a virtual network for transmitting and receiving data between the gateway 100 and each pair of user terminals through the generated virtual router.

2 is a block diagram showing the configuration of a virtual network management apparatus according to an embodiment of the present invention. Hereinafter, the structure and operation of the virtual network management apparatus 200 will be described in detail with reference to FIG. 2.

Referring to FIG. 2, the virtual network management apparatus 200 is connected to a network interface 102 and a processor 101 for generating a virtual network between a user terminal and a virtual router through one or more processors 101 and a gateway 100. It may include a memory 103 for loading a computer program to be executed and a storage 104 for storing a computer program.

The processor 101 may control the overall operation of each component of the virtual network management apparatus 200. The processor 101 may be implemented by including a Central Processing Unit (CPU), a Micro Processor Unit (MPU), a Micro Controller Unit (MCU), or any type of processor well known in the art. In addition, the processor 101 may perform an operation on at least one application or program for executing the method according to the embodiments of the present invention. The virtual network management apparatus 200 may include one or more processors.

The network interface 102 supports wired/wireless Internet communication of the virtual network management apparatus 200. In addition, the network interface 102 may support various communication methods other than the Internet, which is a public communication network. To this end, the network interface 102 may be implemented by including a communication module well known in the art.

In particular, the network interface 102 may create one or more virtual routers on the gateway 100 to support a virtual network communication service, and create a virtual network between each virtual router and user terminals. Under the control of the virtual network management device 200, various commands, such as a request for creation of a virtual network and a request for blocking, can be transmitted to the gateway 100, and a tunnel on the virtual network according to an authentication request and a virtual network creation request from a user terminal is established. Can be established. Meanwhile, according to an embodiment of the present invention, the network interface 102 may be implemented including the gateway 100.

The memory 103 stores various types of data, commands and/or information. The memory 103 may load one or more programs 105 from the storage 104 in order to execute a virtual network communication service according to embodiments of the present invention. 2, a RAM is shown as an example of the memory 103.

The storage 104 may temporarily store the one or more programs 105 and virtual network service information 106. In FIG. 2 a virtual network management software 105 is shown as an example of the one or more programs 105.

The storage 104 is a nonvolatile memory such as a ROM (Read Only Memory), EPROM (Erasable Programmable ROM), EEPROM (Electrically Erasable Programmable ROM), flash memory, etc., a hard disk, a removable disk, or well in the technical field to which the present invention belongs. It may be implemented including any known computer-readable recording medium.

The virtual network management software 105 may be an agent installed in the virtual network management apparatus 200 and/or the gateway 100 to create and manage a virtual network according to an embodiment of the present invention. Such an agent may be installed in the first to seventh user terminals 10 to 70 to create a virtual network between the first to seventh user terminals 10 to 70 and the gateway 100.

In addition, the virtual network service information 106 records the result of creation and termination of the virtual network service. Specifically, various types of information about the virtual network service, for example, user terminal information, virtual router information, virtual network service start and end time information, and time information at which data is transmitted and received may be recorded.

3 is a flowchart sequentially illustrating a method of establishing and managing a virtual network according to an embodiment of the present invention, and FIGS. 4 and 5 are block diagrams illustrating a method of establishing and managing a virtual network according to an embodiment of the present invention.

Hereinafter, a virtual network establishment and management method performed by the virtual network management apparatus 200 will be described with reference to FIGS. 3 to 5. Each of the following steps is performed by the virtual network management apparatus 200, and in particular, each of the following steps is performed as the processor 101 performs an operation according to the virtual network management software 105.

3 to 5, the virtual network management apparatus 200 may receive terminal authentication information from the first user terminal 10 (S100 ). In this case, the first user terminal 10 means any user terminal that wants to perform data communication with the second user terminal 20 through a virtual network service among user terminals. The virtual network management apparatus 200 may authenticate login information for terminal authentication information transmitted from the first user terminal 10, and transmit authentication information and virtual network information thereto to the first user terminal 10. .

In addition, the virtual network management apparatus 200 may provide virtual network information for a service of the first virtual network 110 to the gateway 100 based on the received terminal authentication information (S110). Specifically, the virtual network management apparatus 200 may provide virtual network information for the creation of the first virtual network 110 to the gateway 100, and the gateway 100 controls the virtual network management apparatus 200 Thus, a virtual router can be created. At this time, the virtual router may include IP information and port information or an arbitrary key value, and may also include information on the second user terminal 20 through which data is transmitted from the first user terminal 10. . For example, it may include IP information of the second user terminal 20 as a destination. The virtual router may set a path to the destination under the control of the virtual network management apparatus 200.

Next, the first user terminal 10 may transmit a virtual network creation request for the first virtual network 110 service to the gateway 100 (S120). Then, the gateway 100 may transmit a virtual network creation response to the first user terminal 10 (S130). For example, the virtual network creation response may include information on the service of the first virtual network 110, and this information includes header information that the first user terminal 10 must add to the transmission data for communication, that is, , It may include information on a protocol in which data is virtualized. In addition, the information on the first virtual network 110 service may include virtual network information to which a virtual router is connected, information on other user terminals, and the like.

In addition, after a response to create a virtual network is transmitted to the first user terminal 10, the first virtual network 110 service is set, and data communication between the first user terminal 10 and the second user terminal 20 is performed. It is performed (S140). The first user terminal 10 may perform data virtualization and transmit virtualized data. In this way, when the virtualized data is received by the virtual router on the gateway 100, it can be seen that the virtual network between the first user terminal 10 and the virtual router is created by the virtual network management apparatus 200. It is assumed that the IP information of the first user terminal 10 is, for example, 1.1.1.1, and the IP information of the second user terminal 20 is, for example, 2.2.2.2.

Similar to the above-described procedure, the third user terminal 30 transmits terminal authentication information to the virtual network management apparatus 200, and the third user terminal 30 and the fourth user through the gateway 100 according to the terminal authentication. A virtual network for data communication may be created between the terminals 40. At this time, the third user terminal 30 and the fourth user terminal 40 perform data communication through the second virtual network 120 service, and the IP information of the third user terminal 30 is, for example, 1.1 It may be set to .1.1, and the IP information of the fourth user terminal 40 may be set to 2.2.2.2, for example. That is, as described above, the IP information of the first user terminal 10 and the second user terminal 20 may be the same as the IP information of the third user terminal 30 and the fourth user terminal 40, respectively. have.

Similarly, the fifth user terminal 50 transmits terminal authentication information to the virtual network management apparatus 200, and the fifth user terminal 50 and the sixth user terminal 60 through the gateway 100 according to the terminal authentication. A virtual network for data communication may be created between them. In addition, as another virtual network, a virtual network for data communication between the fifth user terminal 50 and the seventh user terminal 70 is created in the fifth user terminal 50 through the gateway 100 according to terminal authentication. Can be.

At this time, the fifth user terminal 50 and the sixth user terminal 60, the fifth user terminal 50, and the seventh user terminal 70, respectively, the third virtual network 130 service and the fourth virtual network 140 ) Data communication is performed through a service, and the IP information of the fifth user terminal 50 may be set to, for example, 1.1.1.1, and the IP information of the sixth user terminal 60 is, for example, 2.2 It can be set to .2.2. In addition, the IP information of the seventh user terminal 70 may be set to 3.3.3.3, for example.

That is, as described above, the IP information of the fifth user terminal 50 and the sixth user terminal 60 may be the same as the IP information of the first user terminal 10 and the second user terminal 20, respectively. have. However, since the fifth user terminal 50 creates a virtual network to enable data communication with the seventh user terminal 70, the IP information of the seventh user terminal 70 is the sixth user terminal to distinguish the receiving terminal. It may be set differently from the IP information of (60). Accordingly, by using a virtual network separated from each other, interference between multiple or multiple virtual networks is prevented, security is enhanced, and limited use of limited IP resources is possible.

6 is a block diagram illustrating a configuration of a multi-virtual network communication system using a virtual router according to another embodiment of the present invention.

6, a multi-virtual network communication system using a virtual router according to another embodiment of the present invention creates multiple or multi-virtual networks by using a single virtual router (VR) on the gateway 100, respectively. Separate each other so that communication channels of the virtual network do not interfere with each other.

For example, the first user terminal 10 communicates with the second user terminal 20 through the first tunnel T1, and the third user terminal 30 communicates with the fourth user through the second tunnel T2. It communicates with the terminal 40. At this time, assuming that the IP information of the first user terminal 10 is 1.1.1.1 and the IP information of the second user terminal 20 is 2.2.2.2, the IP information of the third user terminal 30 is 1.1 It may be .1.1, and the IP information of the fourth user terminal 40 may be 2.2.2.2.

In addition, for example, the fifth user terminal 50 communicates with the sixth user terminal 60 through the third tunnel T3, and communicates with the seventh user terminal 70 through the fourth tunnel T4. do. In this case, assuming that the IP information of the first user terminal 10 is 1.1.1.1 and the IP information of the second user terminal 20 is 2.2.2.2, the IP information of the fifth user terminal 50 is 1.1 The IP information of the sixth user terminal 60 may be .1.1, the IP information of the sixth user terminal 60 may be 2.2.2.2, and the IP information of the seventh user terminal 70 may be 3.3.3.3.

This is possible because a plurality of virtual networks (multi-virtual networks or multi-virtual networks) are separately implemented by one virtual router (VR). In the multi-virtual network communication system using a virtual router according to an embodiment of the present invention described above, virtual routers corresponding to each of the virtual networks are created to implement separate virtual networks. However, in another embodiment of the present invention, a single virtual network A router can be created to control multiple virtual networks and implement separate virtual networks.

The first to fourth virtual networks 110 to 140 in another embodiment of the present invention are services that use the same virtual router (VR), and control communication channels separated from each other on the network and interfere with each other between these virtual networks. It doesn't work.

Accordingly, the IP information of the first user terminal 10 and the second user terminal 20 of the service using the first virtual network 110 is a third user terminal of the service using the second virtual network 120 ( 30) and the IP information of the fourth user terminal 40 may be identical to each other. In addition, IP information of the first user terminal 10 and the second user terminal 20 may be identical to the IP information of the fifth user terminal 50 and the sixth user terminal 60, respectively.

By using a virtual network separated from each other in this way, interference between multiple virtual networks is prevented, security is enhanced, and limited use of limited IP resources is possible. In particular, since the separation between different virtual networks is implemented in software, it is possible to configure a plurality of virtual networks using a single network device in hardware, thereby realizing infinite utilization of limited IP resources.

The method according to the embodiments of the present invention described so far with reference to the accompanying drawings may be performed by executing a computer program implemented with computer-readable code. The computer program may be transmitted from a first computing device to a second computing device through a network such as the Internet and installed in the second computing device, thereby being used in the second computing device.

The first computing device and the second computing device include all of a server device, a fixed computing device such as a desktop PC, and a mobile computing device such as a notebook, a smart phone, and a tablet PC.

It should be understood that the above-described embodiments are illustrative and non-limiting in all respects, and the scope of the present invention will be indicated by the claims to be described later rather than the detailed description described above. And the meaning and scope of the claims, as well as all changes and modifications derived from the equivalent concept should be interpreted as being included in the scope of the present invention.

10 to 70: first to seventh user terminals
100: gateway
110 to 140: first to fourth virtual networks
200: virtual network management device
101: processor
102: network interface
103: memory
104: storage

Claims (10)

A first virtual network for performing data communication between the first user terminal and the second user terminal by creating a first tunnel between the first user terminal and the second user terminal on which terminal authentication has been performed;
It is separated by software from the first virtual network, and creates a second tunnel between the third user terminal and the fourth user terminal on which terminal authentication has been performed, to allow data communication between the third user terminal and the fourth user terminal. A second virtual network to perform;
Generating a first virtual router by receiving network information for establishing the first virtual network, generating the first tunnel between the first user terminal and the second user terminal through the first virtual router, the A gateway receiving network information for establishing a second virtual network, generating a second virtual router, and generating the second tunnel between the third user terminal and the fourth user terminal through the second virtual router; And
A virtual network management device for receiving terminal authentication information from the first to fourth user terminals, performing terminal authentication, generating network information about the first virtual network or the second virtual network, and transmitting the network information to the gateway; Including,
The virtual network management device controls to create the second virtual network coexisting in real time while the first virtual network is created,
The gateway is a single physical device, the first virtual network and the second virtual network coexist in real time but are separated from each other through software,
The virtual network management apparatus receives terminal authentication information and performs access control of the terminal for each virtual network,
The first user terminal is configured to include the same IP information as the third user terminal, and the second user terminal is configured to include the same IP information as the fourth user terminal, and multiple virtual network communication using a virtual router system. The method of claim 1,
The virtual network management apparatus automatically performs terminal authentication when a terminal authentication request for creating the first virtual network is transmitted from the first user terminal or the second user terminal and returns the result value. Multi-virtual network communication system using routers. The method of claim 2,
The virtual network management apparatus automatically performs terminal authentication when a terminal authentication request for creating the second virtual network is transmitted from the third user terminal or the fourth user terminal and returns the result value. Multi-virtual network communication system using routers. The method of claim 3,
The gateway receives a first virtual network creation request from the first user terminal or the second user terminal, transmits a virtual network creation response corresponding to the first virtual network creation request, and generates the first virtual network A multi-virtual network communication system using a virtual router. The method of claim 4,
The gateway receives a second virtual network creation request from the third user terminal or the fourth user terminal, transmits a virtual network creation response corresponding to the second virtual network creation request, and generates the second virtual network A multi-virtual network communication system using a virtual router. The method of claim 1,
The first virtual router and the second virtual router are separate virtual routers from each other. A multi-virtual network communication system using a virtual router. The method of claim 1,
The first virtual router and the second virtual router are a single virtual router, and the first virtual network and the second virtual network are respectively created through the single virtual router, a multi-virtual network communication system using a virtual router . Transmitting the first terminal authentication information of the first user terminal to the virtual network management apparatus;
Performing, by the virtual network management apparatus, terminal authentication based on the first terminal authentication information, and transmitting virtual network information to a gateway;
Transmitting, by the first user terminal, a request for creating a first virtual network to establish a first virtual network to the gateway;
Establishing a first virtual network between the first user terminal and the second user terminal in response to the first virtual network creation request;
Transmitting third terminal authentication information of a third user terminal to the virtual network management apparatus;
Performing, by the virtual network management apparatus, terminal authentication based on the third terminal authentication information, and transmitting virtual network information to the gateway;
Transmitting, by the third user terminal, a request for creating a second virtual network to establish a second virtual network to the gateway; And
In response to the second virtual network creation request, establishing a second virtual network between the third user terminal and the fourth user terminal; Including,
The gateway is a single physical device,
The establishment of the second virtual network includes controlling to coexist in real time while the first virtual network is created to establish the second virtual network separated by software from the first virtual network, and
The virtual network management apparatus receives terminal authentication information and performs access control of the terminal for each virtual network,
The first user terminal is configured to include the same IP information as the third user terminal, and the second user terminal is configured to include the same IP information as the fourth user terminal, and multiple virtual network communication using a virtual router Way. The method of claim 8,
The first virtual network and the second virtual network are each established through separate virtual routers created in the gateway, a multi-virtual network communication method using a virtual router. The method of claim 8,
The first virtual network and the second virtual network are established by a single virtual router created in the gateway, and the first virtual network and the second virtual network are respectively created through the single virtual router. Multiple virtual network communication method using router.

Images