KR20000000185A - Method for connecting internet to save IP addresses by using NAT(Network Address Translation) function and configurating VPN(Virtual Private Network) - Google Patents

Abstract

PURPOSE: Address saving-type internet connection method using a network address translation(NAT) saves a IP address, embodies a private network with a single IP address, and easily configures various networks. A virtual private network(VPN) configuration method configures a virtual private network, reduces a cost for the virtual private network(VPN) by using IP address saving-type internet connection method, solves a speed problem without a coding and a preservation protocol, and utilizes all conventional public networks. CONSTITUTION: When constructing a plurality of servers such as Web, mail, FTP, and tel-net in order to construct a private network, an internet connection system(address translation function router; 10) constructs a virtual private network about a plurality of personal computers and servers to be connected to a hub is constructed with a single IP address, therefore, the number of IP addresses is reduced in constructing a network or a server. When embodying the virtual private network (VPN), a conventional public network can be maximally utilized without regard to any service company, a construction cost of the VPN and a maintenance cost of the VPN can be reduced. A load of a network device is reduced without using a preservation protocol and a coding algorithm, and a preservation maintenance of the VPN is possible.

Description

Method for connecting internet to save IP addresses by using NAT (Network Address Translation) function and configurating virtual private network (VPN)}

The present invention relates to a method for constructing an address-saving internet access and a virtual private network (VPN) using a network address translation (NAT) function. In particular, the present invention relates to a web, mail, If you build servers such as FTP and Telnet, you can save all of these servers with one IP (Internet Protocol) address, and if you implement a virtual private network (VPN), no matter what service provider you use. How to configure address-saving Internet access and Virtual Private Network (VPN) using network address translation (NAT) function that can make full use of existing public network without any security protocol or encryption algorithm. It is about.

Over the last few years, the Internet has grown so rapidly that today, an unimaginably large number of hosts are connected to the Internet, which requires that hosts be assigned a unique, unique Internet Protocol (IP) address. .

However, the current structure of the IPv4 type of the Internet is due to the increasing number of Internet-enabled hosts and the development of the Internet-related software industry, which can lead to the problem of IP address depletion when providing unique IP addresses to all newly connected hosts. Cause. To overcome this limitation of IPv4, a new Internet protocol called IPv6 is in progress, which greatly expands the IP address field length.

However, many difficult problems remain to actually apply and operate new standards such as IPv6 for Internet address system.

1 is a configuration diagram of a conventional address translation function.

The existing address translation function will be described in detail with reference to FIGS. 1 and 2.

Referring to FIG. 1, the private network using the address translation function is composed of a router, a computer, and a hub having a single IP address and an address translation function, a web server, a mail server, an FTP server, a telnet server, and the like. When constructing server, there should be as many IP addresses as the number of servers.

2A to 2B are flowcharts illustrating a conventional address translation function.

Referring to FIG. 2A, when the IP packet enters the inside of the address translation function router (step S1), the address translation function table is checked (step S2), and the source port of the IP packet is shown in Table 1 below. As described above, the ports of the address translation function table are compared (step S3), and if present in the address translation function table, the source port and the source IP are changed by referring to the table, and the check sum is changed (step S5). The IP packet arrives at the destination (step S6).

If the source port of the IP packet is not in the address translation function table in step S3, that is, if the port of the address translation function table and the source port of the IP packet are not the same, a new address translation function table is generated (step S4). , The source port and source IP are changed and the checksum is changed by referring to the table (step S5).

table Internal IP address port Local Address Translation Facility Port 10.1.1.210.1.5.48: 11113112: 22222223:

Referring to FIG. 2B, when the IP packet comes out of the address translation function router (step S7), the address translation function table is checked (step S8) and the destination port of the IP packet and the destination port of the IP packet are checked. Comparing the local address translation function ports of the address translation function table (step S9), if present in the address translation function table, the destination port and destination IP are changed by referring to the address translation function table, and a checksum After converting (check sum) (step S11), the IP packet reaches the destination (step S12).

If the destination port of the IP packet is not in the address translation function table in step S9, the packet is discarded (step S10).

Network Address Translation (NAT) is a function that translates an IP address of a private network into an IP address of a global network by using an address allocation mechanism.It is embedded in a router or a firewall. Used to conserve IP addresses.

Recently, as the number of Internet users in SOHO (Small Pffice Home Office) environments, including Internet rooms, increases, the importance of such NAT function is increasing.

However, this NAT (Network Address Translation) feature is inaccessible from the outside network, which is an advantage in terms of security. However, if a small company or office wants to have a web server or mail server, etc. This is a disadvantage because access from outside must be allowed. Thus, in order to construct a web or mail server, such a server must be installed outside the NAT function or serviced by an Internet service provider. This can increase the IP addresses you need to use or incur additional costs for service providers.

Referring to FIG. 3, a conventional virtual private network (VPN) is composed of a WAN connecting an Internet service provider having a private line, a Point of Presence (POP) of the Internet service provider, and a corporate private network. .

The operation of the virtual private network is provided by an Internet service provider that establishes a private line and provides a security protocol, connects to the WAN (Point of Presence) of the Internet service provider closest to the company by a WAN, and works from home and travel. On the other hand, field engineers dial in to a nearby Internet service provider's POP, and then send packets using encryption algorithms to compensate for the shortcomings of using home networks and constant security protocols over the Internet.

However, the problem of the conventional address translation function is that, first, although the conventional address translation function helped to save the IP address, there is a problem that the additional address is required when additional servers are constructed. The maintenance cost is further increased due to the additional IP address.

The problem of the conventional virtual private network technology is that the burden on the network equipment and slow down by performing a very complex algorithm for security, equipment price is high, the virtual private network (VPN) has to be configured using a security protocol There was a problem in that it was completely dependent on an Internet service provider, and the cost of maintaining a virtual private network was not perfect for security problems, and there was a problem that only a part of the public network could be used in using virtual private network technology.

The present invention has been proposed to solve the above problems of the prior art, an object of the present invention is to save the IP address in the situation of lack of IPv4 address and to establish a private network with only a single IP address, including a variety of servers Address-saving Internet access method using network address translation (NAT) function that makes various network configurations easy and inexpensive with only one IP address, virtual private network can be configured as desired without receiving service from internet service provider, and IP address saving type IP address-saving Internet access that reduces the cost of establishing and maintaining a virtual private network (VPN) by using the Internet access method, and requires no encryption or security protocols, thereby reducing the burden on network equipment and solving the speed problem. A virtual private network (VPN) using the method and address allocation mechanism By using Network Address Translation (NAT), a function that converts an IP address of a private network into a Global Network IP address, it is embedded in a router or a firewall. Provides a method of configuring address-saving internet access and virtual private network (VPN) using network address translation (NAT).

1 is a configuration diagram of a conventional address translation function.

2A to 2B are flowcharts illustrating a conventional address translation function.

3 is a configuration diagram of a conventional virtual private network (VPN).

4 is a conceptual diagram of an address saving internet access system for implementing the present invention;

5a to 5b are flowcharts of an address saving internet access system according to the present invention;

6 is a block diagram of a virtual private network (VPN) using the address-saving Internet access method according to an embodiment of the present invention.

7 is a flowchart of an extended network address translation (NAT) function.

8 is a conceptual diagram of a network address translation (NAT).

9A and 9B are flowcharts illustrating the operation of a virtual private network (VPN) according to the present invention.

Explanation of symbols on the main parts of the drawings

8: External user PC 9: Internet connection

10: Address Saving Internet Access System 11: Hub

12: Personal PC 13: Server

NAT: Network Address Translation

VPN: Virtual Private Network

In order to achieve the above object, the present invention provides an Internet access unit 9, an address saving Internet access system (NAT router: address translation function router) 10, a hub 11, a personal PC 12, and various servers. In the network system provided with (13), (a) when the IP packet arrives inside the address-saving internet access system of the virtual private network (VPN) constructed by using the address-saving internet access method (S29), the private network connection Checking the table (S30) and confirming whether the destination IP address of the IP packet is an address registered in the private network connection table (S31); (b) In step S31, if the destination IP address of the packet is registered in the private network connection table, the virtual IP header function is started (S37), the destination port (destination port) conversion, destination IP conversion, check sum (check sum) (S38) to obtain a destination IP address from the private network connection table, obtain a source IP address from the address translation function router 10, generate a virtual IP header therefrom (S39), and then generate the original header. Encapsulating the IP packets between the private networks (S40) and arriving at the destination (S36); (c) In step S31, if the destination IP address of the packet is not the address registered in the private network connection table, check the address translation function table (NAT table) of the address-saving internet access system (S32). Check that the port is the same as the source port of the IP packet (S33) to generate the address translation table (S34), source port (source port) conversion, source IP conversion, checksum conversion (S35) and then the packet arrives at the destination Step S36; (d) When the sent IP packet arrives outside of the address saving internet access system of the virtual private network (VPN) constructed by using the address saving internet access method (S41), the private network connection table is checked (S42), and the IP packet is checked. Checking whether the source IP address of the IP address is registered in the private network connection table (S43); (e) If the source IP address of the packet is registered in the private network connection table in step S43, the virtual IP header function is started (S48), and the virtual IP header is deleted (S49). The step of reaching the destination IP packet to the destination (S50); And (f) if the source IP address of the packet is not the address registered in the private network connection table in step S43, check the address translation function table (NAT table) of the address-saving internet access system (S44). Check if the local address translation function port is the same as the destination port of the IP packet (S45), if not equal, discard the packet (step S46), and if it is the same, the destination packet (destination port) conversion, destination IP translation, checksum conversion (step S47) A method of constructing an address-saving Internet access and a virtual private network (VPN) using a network address translation (NAT) function, comprising the step S50 of arriving at the destination, is provided.

In order to overcome this drawback, the present invention proposes an extended concept NAT that can access a specific server in a private network by modifying a NAT table. The extended NAT function allows you to specify one server per service, and allows access to those specific servers, while leaving any server you want to advertise to. As a result, the NAT IP address can be operated as a single IP while performing the desired function.

Hereinafter, exemplary embodiments of the present invention will be described in detail with reference to the accompanying drawings.

4 is a block diagram of an address saving type internet access system for implementing the present invention. Referring to FIG. 4, the private network using the IP address-saving internet access method includes an address-saving internet access system 10 which is a router including a table of a single IP address and an address-saving internet access system, an external user PC 8, and an Internet access unit. (9), a hub (11), a personal PC (12) and a server (Server) (13).

The Internet connection unit 9 is a telephone network using a modem or a dedicated line using a DSU or CSU, LAN, xDSL, or Fiber To The Home (FTTH).

Hereinafter, an address saving type internet access method using an address translation function will be described with reference to FIGS. 5A, 5B, and 6. 5A to 5B are flowcharts of an address saving type internet access system according to the present invention.

Referring to FIG. 5B, a port and an IP address of a server to be connected are registered in advance in the address translation function table (Table 2) of an address saving Internet access system (NAT router), and an IP packet enters the outside of the address translation function router. (Step S22), check the address translation function table of the address saving Internet access system (step S23), and compare the destination port of the IP packet with the local address translation function port of the address translation function table (step S24). If the port is defined in the address translation function table, the IP packet refers to the address translation function table, changes the destination port and the destination IP, changes the check sum (step S26), and connects to the server to which the packet is the destination. (Step S27). If the destination port of the IP packet is not in the address translation function table in step S24, the packet is discarded (step S25).

Referring to FIG. 5A, when an IP packet enters the inside of an address translation function router (NAT router) (step S16), the address translation function table of the address saving Internet access system is checked (step S17), and the source port of the packet (source port and the port of the address translation function table (Table 2) are compared (step S18), and if present in the address translation function table, the source port and the source IP are changed with reference to the table, and the check sum is checked. ), The packet arrives at the destination (step S21). If not in the address translation function table, a new table is created (step S20), and then the source port and the source IP are changed and the checksum is changed by referring to the table.

The core of the operation of the extended (Network Address Translation: NAT) function proposed in the present invention is to modify the NAT table to properly handle the connection request to a specific server that we want.

As can be seen from the above-described NAT method, a packet coming to the outside of the NAT router can be compared with the destination port number and the local NAT port number in the table, and can refer to the related data only when there is the same.

And there are only a few specific servers that we want to hang inside NAT. Therefore, we want the port number related to the server such as web, mail, telnet, etc. (note, FTP port number: 21, telnet port number: 23, mail port number: 25, web server port number: If 80 is fixed to the local NAT port number in the NAT table, packets destined for that particular server will come in. Of course, the existing network address translation (NAT) function is still performed.

The following is an example of an extended NAT table that has a fixed port number for the server you want to place inside the NAT.

table Internal IP address port Local Address Translation Facility Port 10.1.1.210.1.5.48: 2380: 2380:

When using the extended network address translation (NAT) method, when an operator wants to telnet to a NAT router, the port number (23) may overlap, but this is only used by the operator. If you replace it with a number, it will be solved.

Hereinafter, a method of configuring a virtual private network (VPN) using an address-saving internet access method will be described with reference to FIGS. 6 and 7.

6 is a configuration diagram of a virtual private network (VPN) using an address-saving internet access method according to an embodiment of the present invention.

Referring to FIG. 6, a virtual private network (VPN) using an address-saving internet access method according to the present invention is a connection between a private network (10.1.100.X) consisting of an address-saving internet access method and such a private network (10.1.200.X). It consists of a private network connection table embedded in the address-saving internet access system 10 for the purpose of saving data by saving the IP address between virtual private networks through the two authorized IP addresses (200.1.1.1 and 210.1.1.1). Can send and receive

A process of making a connection from the host 2 outside the private network to the host 1 inside using the extended NAT table will be described in detail with reference to FIG. 7.

7 is a flowchart of an extended network address translation (NAT) function.

Referring to FIG. 7, when an IP packet enters the outside of a NAT router (1), if the destination port number of the packet is compared with the local NAT port number of the NAT table, and the port number is defined in the NAT table (for example, Telnet port number 23) Change the destination port number by referring to the NAT table (23-> 23) (where 23 before means telnet port number and 23 means fixed port number). (166.104.226.104) and checksum (2). If not in the NAT table, the packet is discarded. After that, the packet arrives at the destination host 1 (3). Thus, when a response packet (replace the destination address and source address in the received packet, change the destination port number and source port number) into the NAT router (④), the source port number of the packet Port number in the NAT table by comparing the port number of the NAT table with the NAT table, changing the source port number (23-> 23), changing the source IP address (10.1.1.2-> 166.104.226.104), and the checksum. Change (⑤). If it is not in the NAT table, it creates a new table just like an existing network address translation (NAT). The packet arrives at host 2 as the destination (6).

Referring to the NAT conceptual diagram of FIG. 8, the change of the packet in the extended NAT is shown in Table 3 in detail.

Destination address From address Destination port number Source port number … ① 166.104.226.104 138.201.148.165 23 1111 … ② 10.1.1.2 138.201.148.165 23 1111 … ④ 138.201.148.165 10.1.1.2 1111 23 … ⑤ 138.201.148.165 166.104.202.104 1111 23 …

9A and 9B are flowcharts illustrating the operation of a virtual private network (VPN) according to the present invention. Referring to FIG. 9A, an Internet connection unit 9, an address saving Internet access system (NAT router: address translation function router) 10, a hub 11, a personal PC 12, and various servers 13 are shown. In the network system provided, when the IP packet arrives inside the address saving internet access system of the virtual private network (VPN) constructed by using the address saving internet access method (step S29), the private network connection table is checked (step S29). In step S31, it is checked whether the destination IP address of the IP packet is an address registered in the private network connection table (step S31).

In step S31, if the destination IP address of the packet is registered in the private network connection table, the virtual IP header function is started (step S37), and destination port conversion, destination IP conversion, and check sum are performed. Convert (step S38) to obtain a destination IP address from the private network connection table, obtain a source IP address from the address translation function router 10, generate a virtual IP header therefrom (step S39), and then generate the original header. It encapsulates the IP packet between private networks (step S40) and the packet arrives at the destination (step S36).

In step S31, if the destination IP address of the packet is not the address registered in the private network connection table, the address translation function table (NAT table) of the address saving type internet access system is checked (step S32), and the port of the address translation function table Check if the source port of the IP packet is the same (step S33) to generate the address translation table (step S34), source port (source port) conversion, source IP conversion, checksum conversion (step S35), and then the packet goes to the destination. Arrival (step S36).

Referring to FIG. 9B, when the IP packet sent in FIG. 9A above arrives outside the address-saving internet access system of the virtual private network (VPN) constructed by using the address-saving internet access method (step S41), the private network connection table (Step S42), and confirm that the source IP address of the IP packet is an address registered in the private network connection table (step S43).

In step S43, if the source IP address of the packet is registered in the private network connection table, the virtual IP header function is started (step S48), and the virtual IP header is deleted (step S49). The IP packet arrives at the destination (step S50).

If the source IP address of the packet in step S43 is not the address registered in the private network connection table, check the address translation function table (NAT table) of the address saving Internet access system (step S44), and then convert the local address of the address translation function table. Check if the functional port is the same as the destination port of the IP packet (step S45) and if it is not the same, drop the packet (step S46) and if it is the same, then the destination port conversion, destination IP conversion, checksum conversion (step S47) and the next packet is the destination (Step S50).

When Network Address Translation (NAT) was first developed, it was only thought of as an alternative to the problem of IP address exhaustion, and no one thought it would be useful in a completely different domain. However, even if the Internet environment changes to IPv6, the NAT function will continue to be used for security or IP address assignment convenience, and may be applied in various areas. As more and more complicated and various types of Internet connection are required, NAT function becomes an essential function, but it is extremely limited because it is impossible to connect from the outside at all.

The extended NAT function proposed in the present invention is a simple and very useful method to overcome this disadvantage, and it is expected that many applications will be made in the future. The current Internet configuration can be easily applied to routers or firewalls, and the network management method is also very easy. In particular, SOHO users, who are showing a variety of forms in an unpredictable future, will be able to use them properly when constructing a virtual private network (VPN) that accommodates various needs.

As described above, the address-saving internet access and virtual private network (VPN) configuration method using the network address translation (NAT) function according to the present invention uses the IP address-saving internet access method using the network address translation (NAT) function. It is possible to save the IP address in the current situation where there is a shortage of addresses, to build a server by type in a private network with a single IP address, and to easily and inexpensively configure various networks with a single IP address. By using the virtual private network configuration method, the cost of establishing and maintaining a virtual private network in a way that does not require an internet service provider is greatly reduced, and a virtual private network (VPN) can be configured by making full use of the existing public network without an internet service provider. Can solve security problems without security protocols or encryption algorithms. As the load of network devices by reducing the effect that the processing speed becomes fast.

Although the above has been described with reference to a preferred embodiment of the present invention, those skilled in the art will be able to variously modify and change the present invention without departing from the spirit and scope of the invention described in the claims below. It will be appreciated.

Claims (3)

In a network system provided with an Internet connection unit 9, an address saving Internet access system (NAT router: address translation function router) 10, a hub 11, a personal PC 12, and various servers 13 , (a) When the IP packet arrives inside the address-saving internet access system of the virtual private network (VPN) constructed by using the address-saving internet access method (S29), check the private network connection table (S30), Confirming whether a destination IP address is an address registered in the private network connection table (S31); (b) In step S31, if the destination IP address of the packet is registered in the private network connection table, the virtual IP header function is started (S37), the destination port (destination port) conversion, destination IP conversion, check sum (check sum) (S38) to obtain a destination IP address from the private network connection table, obtain a source IP address from the address translation function router 10, generate a virtual IP header therefrom (S39), and then generate the original header. Encapsulating the IP packets between the private networks (S40) and arriving at the destination (S36); (c) In step S31, if the destination IP address of the packet is not the address registered in the private network connection table, check the address translation function table (NAT table) of the address-saving internet access system (S32). Check that the port is the same as the source port of the IP packet (S33) to generate the address translation table (S34), source port (source port) conversion, source IP conversion, checksum conversion (S35) and then the packet arrives at the destination Step S36; (d) When the sent IP packet arrives outside of the address saving internet access system of the virtual private network (VPN) constructed by using the address saving internet access method (S41), the private network connection table is checked (S42), and the IP packet is checked. Checking whether the source IP address of the IP address is registered in the private network connection table (S43); (e) If the source IP address of the packet is registered in the private network connection table in step S43, the virtual IP header function is started (S48), and the virtual IP header is deleted (S49). The step of reaching the destination IP packet to the destination (S50); And (f) If the source IP address of the packet in step S43 is not the address registered in the private network connection table, check the address translation function table (NAT table) of the address-saving internet access system (S44). Check if the address translation function port is the same as the destination port of the IP packet (S45). If it is not the same, drop the packet (step S46). If it is the same, the next packet is converted to the destination port, destination IP conversion, and checksum conversion (step S47). A method for constructing an address-saving internet access and a virtual private network (VPN) using a network address translation (NAT) function, characterized in that it comprises a step (S50) of arriving at a destination. The method of claim 1, Access to various servers such as web server, mail server, FTP server, telnet server by adding extended NAT function to NAT (Network Address Translation) table in the address saving Internet access system (NAT router) 10 Define the internal IP address, port number and local NAT number of the private network in the expanded NAT table so that the IP address saving Internet access method can be saved with a single IP address while saving various IP addresses in the network or server installation. A method of constructing an address-saving Internet access and a virtual private network (VPN) using a network address translation (NAT) feature, which can be used to construct various types of private networks (VPNs) and does not require encryption or security protocols. The function (a), the function (b), the function (c) provided from the outside of the virtual private network (VPN) to the address-saving Internet access system (NAT router) 10 from the outside A computer-readable recording medium having recorded thereon a program for realizing the function (d), the function (e), and the function (f) provided upon receiving an IP packet through the virtual private network (VPN).