KR20010057104A - Internet VPN service provisioning method using service gateway - Google Patents

Abstract

PURPOSE: A method for providing Internet VPN(Virtual Private Network) service using a service gateway is provided to actively supply the VPN setting to a preferred enterprise through Internet when a user can use Internet wherever the user is and the network can initialize the tunnel in NAS(Network Access Server). CONSTITUTION: A number of Intranets(27) register its own address of remote access server with the service gateway in advance. Internet user accesses to Internet and selects the object Intranet through the service gateway. If the object Intranet is selected, the address of the remote access server of the Intranet selected is told to the Internet user by the service gateway. By using the address of the remote access server(24,28) of the object Intranet selected, the Internet user requests to the network access server(22) for the connection setting with the remote access server of the object Intranet. If the acknowledgement with respect to the connection setting is received, a request is made for ending point-to-point protocol session with the Internet service provider. If the session is ended, a tunnel between the network access server and the remote access server of the object Intranet is set. The point-to-point protocol session between the user terminal(21) and the remote access server of object Intranet is set to thereby set a virtual private network between the user terminal and the object Intranet.

Description

Internet VPN service provisioning method using service gateway

The present invention relates to a method for providing an Internet VPN service using a service gateway, and more particularly, to an Internet virtual private network that a user who uses the Internet through an Internet service provider using a modem needs as needed through the service gateway. (Virtual Private Network (hereinafter referred to as VPN)) It is about a method to be provided with a service.

Although the business environment is changing to office automation, remote access, and remote work through private network, the cost of constructing private network through dedicated equipment is very expensive, and access to corporate private network through public network is cheap and easy to implement. There is a problem that cannot be guaranteed.

Unlike existing private line-based private networks, which have a lot of limitations in terms of cost and flexibility, Internet VPN services can establish virtual private networks in corporate intranets anytime, anywhere through the Internet. In addition, as the recent business environment changes rapidly, there is a very dynamic cooperative relationship between companies, and a business cooperative relationship with any individual in the world.

However, most of the methods for establishing virtual private networks have been to set up a PPP session by directly calling an intranet of a company that wants to set up a VPN. This method has geographical limitations in terms of cost, which requires a direct call to a geographically distant place (international or international) to establish a VPN.

In order to solve this problem, a virtual private network (VPN) is emerging as a new network service, and VPN technology uses an existing public network to allow employees to connect to an intranet, connect branch offices and headquarters, and secure communication with external companies. It is a technology that virtually establishes a private communication network.

Currently, a typical VPN providing method is widely used to use a tunneling protocol that establishes a virtual communication line called 'tunnel' at a VPN start point and end point on a public network. The start and end points of these tunnels are network access servers in the network (hereinafter referred to as NAS) and intranet remote access servers (hereinafter referred to as RAS). The endpoint is the user terminal and the RAS.

As such, the starting point and the ending point of the VPN may be arbitrarily applied to a user terminal, an access gateway of an intranet, etc. according to a business model (see FIG. 1).

Referring to FIG. 1, a conventional dial-up VPN access procedure is described. A user terminal 11 equipped with a PPP protocol is connected to a NAS 12 which is an endpoint of a dial-up connection via a transport network 16. do. When connecting to the NAS 12, the authentication procedure for the intranet is performed through the AAA server 13 of the transport network 16 and the AAA server 15 of the intranet 17.

The NAS 12 establishes a tunnel with the RAS 14 of the intranet 17 to establish a VPN based on the user identifier transmitted from the user. At this time, the end points of the PPP session are the user terminal 11 and the RAS 14, and the user terminal 11 connected to the intranet is assigned a private Internet protocol (hereinafter referred to as IP) of the intranet.

The above-described conventional VPN providing method starts a task for configuring a VPN from the time the user terminal is connected to the NAS, these operations require a contract relationship between the company owning the intranet and the operator owning the NAS Do. To establish a VPN with a user or enterprise where no contract relationship is established, a more complex contract relationship is required.

Accordingly, the present invention has been made to solve the above-mentioned conventional problems, and if the user can use the Internet wherever he is and has a function of initiating a tunnel to the NAS in the network, the VPN of the enterprise to the desired enterprise over the Internet can be The purpose of the present invention is to provide a method of providing an Internet VPN service using a service gateway to dynamically provide settings.

In order to achieve the above object, a method of providing an Internet VPN service using a service gateway according to a preferred embodiment of the present invention includes: registering a plurality of intranets with the addresses of their remote access servers in advance in the service gateway;

An internet user accessing the internet and selecting a destination intranet through the service gateway;

When the destination intranet is selected, the service gateway informs the Internet user of the address of the remote access server of the selected intranet, and the Internet user sends the destination intranet to the network access server by using the address of the remote access server of the selected destination intranet. Requesting to establish a connection with a remote access server of the;

Requesting the end of a point-to-point protocol session with an internet service provider if the connection establishment is authenticated; And

When the point-to-point protocol session with the Internet service provider is terminated, a tunnel is established between the network access server and the remote access server of the target intranet, and the user terminal and the remote access server of the target intranet and the point-to-point protocol session are established. And establishing a virtual private network between the terminal and the target intranet.

1 is a conventional Internet VPN configuration diagram,

2 is an overall configuration diagram of a system to which the present invention is applied;

3 is a connection procedure with an Internet service provider to receive an Internet service according to an embodiment of the present invention;

4 is a flowchart illustrating a flow of a method for providing an Internet VPN service using a service gateway according to an embodiment of the present invention.

<Description of Symbols for Major Parts of Drawings>

11, 21: user terminal

12, 22: network access server

14, 24, 28: remote access server

16, 26: transport network

17, 27: intranet

Hereinafter, embodiments of the present invention will be described in detail with reference to the accompanying drawings.

FIG. 2 is an overall configuration diagram which can simultaneously provide an Internet service and a VPN service according to an embodiment of the present invention, and shows a relationship between the service gateway 31, the user terminal 21, the intranet 27, and the NAS 22. And the relationship with the RAS 28 of the Internet service provider (operator).

In this configuration, the user is assigned an IP address through an internet service provider (operator) to which he has subscribed through the NAS 22, and receives an Internet service from an internet service provider using the assigned IP address.

The information of the service gateway 31 is provided to the user in the form of a URL (Unified Resource Locator).

3 is a flowchart illustrating an operation of connecting to an initial Internet according to an embodiment of the present invention.

Referring to the signal flow with reference to FIG. 2, first, the user terminal 21 establishes a connection with the NAS 22 in the transport network 26 through dial-up (step 101).

After the user authentication procedure (step 102) of the Internet service provider (ISP) domain is performed through the NAS 22, the tunnel is established from the NAS 22 to the RAS 28 of the Internet service provider (ISP). In step 103, a PPP session is established from the user terminal to the RAS 28 of the Internet service provider, and the user is assigned an IP address from the Internet service provider to use the Internet service using the IP address (step 104).

4 is a flowchart illustrating an operation when a user who is connected to an ISP network 30 and receives an Internet service according to an embodiment of the present invention establishes a VPN.

First, in order to set up a VPN, an Internet user selects a destination intranet through the service gateway 31. These choices obtain a list of intranets 27 registered with the service gateway 31 via the URL of the service gateway 31 used on the Internet (step 202), and the user selects endpoints from which they want to establish a VPN. A choice is made (step 203). At this time, the intranet 27 wishing to establish a VPN with the outside should register its own RAS address with the service gateway (step 201).

After that, if you do not want to set up the VPN with the outside of the intranet (27), you can cancel the registration again. These registrations may be made through a VPN operator or may be made by an intranet operator through an interface provided by the service gateway 31.

When the user sets up the intranet 27 to set up the VPN through the service gateway 31, the service gateway 31 informs the user of the RAS address of the selected intranet 27, and the user RAS of the intranet 27. The NAS 22 is requested to establish a connection with the RAS 24 of the intranet 27 using the address (step 204).

At this time, the NAS 22 of the network performs authentication operation through the RAS 24 and the AAA server 25 of the intranet 27 (step 205), and after authentication, the NAS 22 transmits the Internet to the user terminal 21. Request termination of the point-to-point protocol session with the service provider or direct the end point-to-point protocol (PPP) session to the user terminal 21 and the RAS 28 of the Internet service provider (step 206).

The authenticated user terminal 21 establishes a PPP session of the intranet 27, and the NAS 22 establishes a tunnel with the RAS 24 of the intranet 27 (step 207). When the tunnel between the NAS 22 and the intranet RAS 24 is established and the RAS 24 and the PPP session of the user terminal 21 and the intranet 27 are established, the VPN between the user terminal 21 and the intranet 27 is established. Is set.

If a VPN is established between the user terminal 21 and the intranet 27, the user terminal 21 cannot use the Internet service through the Internet service provider because the PPP session with the Internet service provider is not established. However, when the VPN setup is completed, the user requests the termination of the PPP session with the RAS 24 of the intranet 27. In this case, the user terminal 21 may cause the PPP session to be reset with the previous Internet service provider.

According to the present invention as described above, unlike the VPN service providing method up to now, access the ISP from any place where the Internet can be used, and then use the service gateway to set the desired RAS address using the service gateway. Once obtained, the VPN can be set up as an intranet of your choice, allowing for greater flexibility in setting up the VPN very dynamically.

On the other hand, the present invention is not limited to the above-described embodiment, but can be modified and modified within the scope not departing from the gist of the present invention, such modifications and changes should be regarded as belonging to the following claims. will be.

Claims (3)

Registering a plurality of intranet addresses of remote access servers with a service gateway in advance; An internet user accessing the internet and selecting a destination intranet through the service gateway; When the destination intranet is selected, the service gateway informs the Internet user of the address of the remote access server of the selected intranet, and the Internet user sends the destination intranet to the network access server by using the address of the remote access server of the selected destination intranet. Requesting to establish a connection with a remote access server of the; Requesting the end of a point-to-point protocol session with an internet service provider if the connection establishment is authenticated; And When the point-to-point protocol session with the Internet service provider is terminated, a tunnel is established between the network access server and the remote access server of the target intranet, and the user terminal and the remote access server of the target intranet and the point-to-point protocol session are established. A method of providing an Internet VPN service using a service gateway, comprising: establishing a virtual private network between a terminal and a target intranet. The method of claim 1, The selecting of the target intranet may include: searching, by the Internet user, a list of intranets registered with a service gateway through a URL of the service gateway, and selecting an endpoint for setting up a virtual private network from the searched list. Internet VPN service providing method using a service gateway, characterized in that consisting of. The method of claim 1, A method of providing an Internet VPN service using a service gateway, wherein the addresses of remote access servers of a plurality of intranets registered in the service gateway are registered by a virtual private network operator or an intranet operator.