KR20020004287A - IP Gatway - Google Patents

Abstract

PURPOSE: An IP gateway is provided so that a plurality of computers or information appliances connected to an IP gateway via the Ethernet can access the Internet since they are connected to a modem for external access such as Analog/XDSL by an external access of a single network. CONSTITUTION: A modem(10) externally connects to the Internet through a single access account. An IP gateway(100) is connected with a plurality of computers connected via an internal Ethernet LAN and allocates an Internet account to each of those computers(20). The IP gateway(100) performs the Internet sharing function of sharing a single Internet access account provided from an ISP(Internet Service Provider) by the plurality of computers through the modem(10), the Ethernet switch function of configuring a LAN by the computers themselves, and the access security function by IP packet filtering.

Description

IP Gateway

TECHNICAL FIELD The present invention relates to an internet router, and more particularly, to a function and connection of an IP gateway for supporting Internet connection of a small network.

The current rate of development of the Internet is very fast, doubling the number of websites in a month, and this trend is expected to continue. You can download the necessary software via the Internet, view the latest news, and enjoy the art of the Louvre from your home. You can also order what you need and make simple banking transactions at home. Most companies have their own websites and are using them to promote and introduce their products. With the explosive growth of computers and the generalization of the Internet, apart from existing businesses and government offices that use expensive, high-speed leased lines, individual users and small businesses have relatively low speeds but low initial installation and maintenance costs. I have used a 1: 1 connection to the Internet via a modem for telephone lines, or a CABLE / ADSL modem that provides medium speed and a fixed fee per period.

However, the use of such a modem has a disadvantage in that the computer and the ISP must be connected to 1: 1. Therefore, for each additional computer or information appliance, a separate circuit fee must be paid along with the additional circuit and service is provided. The disadvantage is that the company must prepare the corresponding receiving line as much as the additional line. That is, even if there are computers connected to a small area (Local Area Network) in the same place, each Internet connection line must be separately provided for Internet access.

As described above, in the prior art, a personal connection means is necessary in order for various information including a PC connected to an internal network to be connected to the Internet, which is an external network, in an electric machine. Each Internet accessor needed a data communications device, such as a modem, dial-up connection, and a separate account for accessing an Internet Service Provider, as well as a modem attached to each device.

The present invention is to support the Internet connection of a small network, according to the present invention that a user such as the existing Analog / xDSL and the like was able to use the external network only from one computer connected to the Internet by being assigned one IP address, When the IP gateway according to the present invention is used, several computers or information that are internally connected to the IP gateway and Ethernet are connected to an external connection modem such as analog / xDSL from an electric machine to an external connection of a single network, and several are simultaneously connected. Can support internet access.

1 is a network diagram of an IP gateway providing an IP address translation function, which is the core of the present invention.

2 is a hardware block diagram of an IP gateway for implementing an IP address translation function according to the present invention.

3 shows a software protocol stack of an IP gateway according to the present invention.

4 is an explanatory diagram of an address translation function of an IP gateway according to the present invention;

5 is a diagram illustrating a static routing function of an IP gateway according to the present invention.

6 is an explanatory diagram of a security function by packet filtering of an IP gateway according to the present invention;

7 is a diagram illustrating a setting item for IP gateway management according to the present invention;

<Description of the symbols for the main parts of the drawings>

10: modem 20: PC for internal network

100: IP gateway 110: port portion

120: transformer 130: Ethernet controller

140: CPU 150: Ethernet driver

160: bridge repeater 170: RAM

180: ROM

Hereinafter, an IP gateway according to the present invention will be described in detail with reference to the accompanying drawings.

1 is an example of a network configuration using an IP gateway according to the present invention.

Modem 10 for external access to the Internet through a single access account and a plurality of computers 20 connected by an internal Ethernet LAN are assigned to assign each Internet account to each computer 20. In addition, the modem 10 performs an Internet sharing function that can be shared by multiple computers with one Internet access account provided by an ISP (Internet Service Provider), and also allows multiple computers to configure their own LAN. The IP gateway 100 performs additional functions such as a switch function and an access security function by IP packet filtering.

2 is a hardware configuration diagram of an IP gateway according to the present invention.

Ethernet port MODEM, UP LINK port, and a plurality of internal LAN connection ports P1, P2, ... Pn for connecting the plurality of computers 20 to the modem 10 A port unit 110, a transformer 120 for converting signals of each port unit 110 into electrical signals, and an Ethernet controller 130 for an Ethernet connection function, which is a physical layer, are provided. ) And Ethernet Driver (150), Bridge Repeater (160) that supports 10Mbps or 100Mbps variable access to multiple Ethernet ports and performs Ethernet relay function, and external data and address bus Includes a central processing unit (CPU) 140 that supports a ROM 180, a RAM 170, and external I / O.

The IP gateway 100 of the present invention configured as described above is a hub that provides LAN connection to a plurality of ports independently. You can connect a router or switch here to extend the internal LAN. The internal LAN computers 20 access the Internet via the modem 10 by sharing one Internet account provided by the ISP. The external connection can automatically set up the TCP / IP for the Internet connection by the DHCP client, and can automatically set up the TCP / IP by providing DHCP service to the computers 20 in the internal LAN. It supports the operation of a server that provides a specific service to the internal LAN and can restrict internet access for security.

The hardware of the IP gateway 100 is configured as shown in FIG. 2, and there is an Ethernet port for connecting with the modem 10 and an UP LINK port used for extending an internal LAN. . There are multiple Ethernet ports (P1, .., Pn) that can directly connect multiple internal computers to form an internal LAN. Transformer 120 is responsible for the electrical conversion of all ports. The Ethernet controller 130 and the Ethernet driver 150 are in charge of the Ethernet access function, which is a physical layer. The bridge repeater 160 supports 10 Mbps or 100 Mbps variable access to several Ethernet ports and is responsible for the Ethernet relay function. In the figure, the CPU 140 has an external data and address bus supporting the ROM 180, the RAM 170, and the external I / O.

3 is a diagram illustrating a protocol stack configuration according to the present invention.

The software of the IP gateway 100 is divided into a protocol processing portion and a system and network management portion. The protocol processing part is further divided into WAN connection, LAN connection, and Internet connection. PPP, IP, TCP, UDP, and RIP support LAN and WAN connections, while DHCP, ARP, and NAT support Internet access services for internal computers. FTP, HTTP, and Telnet provide administrative access.

The IP gateway 100 has an IP address translation (NAT) function for bidirectionally converting an internal IP address into a representative IP address of the external network for TCP / IP data between the internal network and the external network, and Add a router that can configure another internal network, and look at the IP address of the IP packet received from the IP gateway 100, the routing table created by the operator through the management function to determine the route of the next IP packet to be delivered Dynamic Host Configuration Protocol (DHCP) server that dynamically assigns IP addresses to computers on the internal LAN that have static routing to route using them and IP addresses that are not publicly available on the external network and that can be used only on the internal LAN. Function, and a handover between internal LAN users and external Internet users. In order to provide a packet filtering function that performs security functions by restricting access to the kit with a filtering function, and to provide a management method through the Web, a web server is embedded in the IP gateway, and the network and System management function to set all items related to system operation is performed.

4 is an explanatory diagram of an IP address translation function (NAT) according to the present invention.

IP Address Translation (NAT) provides a way for multiple computers to use the Internet with a single IP address. The IP gateway 100 providing this function exists between the internal network and the external network to convert the internal IP address into a representative IP address for TCP / IP data between the two networks. 5 is a graphical representation of the NAT function.

In FIG. 4, the internal desktop system 20 converts the internal IP address “192.169.0.2” into the representative IP address “165.133.12.39” by the IP gateway 100 when connecting to the Internet. The transformation is applied to both the data sent out and the data sent out to and from the IP gateway 100. This function is possible by converting the IP address of the IP packet header. However, some applications that use IP use IP addresses in addition to the IP header. In this case, each application program should be processed separately. Therefore, the service may not be provided for the new application. Another disadvantage is the need for connection management for end-to-end traffic. Therefore, if many connections are made through an IP gateway at the same time, a lot of memory is required and performance may be degraded. Set the maximum number of connection connections that can be supported at the same time considering the memory allocation degree for connection management among performance and RAM area.

Static Routing

Static routing is a function that routes using only the routing table created by the operator. The routing function is a function of determining the path of an IP packet to be delivered next by looking at the IP address of the IP packet received by the IP gateway 100. Information necessary for routing is Destination IP Address, Network Mask, Gateway IP Address. This function is necessary when there is a router in the internal network. The routing table is created by the operator through the management function.

FIG. 5 is a network configuration and routing table in the case of using static routing of an IP switch and configuring two LANs internally using one router 200. Referring to FIG. The routing table means that all data belonging to 192.168.3.xxx should be sent to "192.168.0.100". Network Mask is used to distinguish between network address and host address.

Dynamic Host Configuration Protocol (DHCP) Server

This function automatically services the TCP / IP configuration for computers connected to the LAN. Items that can be set automatically are IP Address, Subnet Mask, Router Address, 5 DNS Address, Default Domain Name, and so on. This feature is an extension of BootP to serve clients that require TCP / IP configuration with BootP. The ability to dynamically assign IP addresses provides an effective way to use the free IP addresses of the IP gateway. There are IP addresses that can be used internally by anyone. This address does not exist on the public Internet, so anyone can use it internally. IP addresses that are not publicly available and can only be used on the internal LAN are "10.xxx" in Class A, "172.16.xx" through "172.31.xx" in Class B, and "192.168.0.x in C Class." "~" 192.168.255.x ". The DHCP function is a function that dynamically assigns an internally available IP address to a computer existing in an internal LAN.

Packet Filtering

This function performs filtering on the packets transferred between internal LAN users and external Internet users. By this function, the following three functions can be provided. The first is the Access Control feature, which restricts internal LAN users from using the external Internet. For each computer, you can either disable all Internet services, allow all, or only allow specific services by TCP / IP port number. The second is a function used when operating a server in an internal LAN. The virtual server function delivers a packet requesting a specific service from the outside to a specific internal computer. External Internet users request to connect to an IP address provided by their ISP. A special case of this feature is an external open system that unconditionally connects all connections from the Internet to a specific system on the internal LAN. It can also be set to allow external connections within a certain range. Third is the Port Security feature, which restricts access between LAN users when security is required between internal LAN users. In general, internal LAN computers allow all connections without IP address translation, but in certain cases you can restrict access to each port. 6 shows the above three functions graphically. In FIG. 6, a dotted line indicates a case of allowing each service.

System management functions

System and network operation are managed through Web, and program change of IP gateway uses FTP. In order to provide a management method through the web, a web server is embedded in the IP gateway. All items related to network and system operation can be set through web server. 7 shows a setting item and an operation state display item.

As described in detail above, the IP gateway according to the present invention effectively utilizes an IP address translation function (NAT), a remote management function through the web, a firewall function for security, a static routing function, and a DHCP server function. The effect is that multiple computers can share one Internet connection service provided by an ISP.

Claims (7)

Ethernet port (MODEM), uplink port (UP LINK) for connecting to the modem 10, and a plurality of internal LAN connection ports (P1, P2, ... Pn) for connecting a plurality of computers 20 One port unit 110, a transformer 120 for converting the signals of each port of the port unit 110 into an electrical signal, and an Ethernet controller (Ethernet Controller) for the Ethernet (physical) connection function (physical layer) ( 130) and Ethernet Driver 150, Bridge Repeater 160 that supports 10Mbps to 100Mbps variable access to multiple ports and performs internet relay function, and external data and address. It comprises a central processing unit (CPU) 140 that supports the bus, ROM 180, RAM 170 and external I / O, Ethernet switch that allows multiple computers to configure their own LAN as well as to perform the Internet sharing function that can be shared by multiple computers with one Internet access account provided by an ISP (Internet Service Provider) through the modem 10 IP gateway, characterized in that it is configured to perform additional functions such as access security by IP packet filtering. The method of claim 1, wherein the software protocol stack of the IP gateway, Divided into protocol processing part and system and network management part, The protocol processing part exists between PPP, IP, TCP, UDP, RIP supporting WAN connection and LAN connection, DHCP, ARP, and internal network and external network for Internet access service of internal computer. IP address translation (NAT) function to convert the internal IP address to a representative IP address for the IP data, Network management part is IP gateway, characterized in that consisting of FTP, HTTP, Telnet. The method of claim 1, wherein the IP gateway, An IP address translation (NAT) function for bidirectionally converting an internal IP address into a representative IP address of an external network for TCP / IP data between the internal network and the external network; The router adds a router that can configure another internal network, and looks at the IP address of the IP packet received by the IP gateway 100, and the routing table created by the operator through the management function to determine the route of the next IP packet to be forwarded. Static routing function to route using Dynamic Host Configuration Protocol (DHCP) server function that dynamically assigns IP addresses to computers on the internal LAN that have IP addresses that are not publicly available on the external network and that can be used only on the internal LAN; A packet filtering function that performs a security function by restricting access to a packet transmitted between an internal LAN user and an external Internet user; In order to provide a management method through the Web, a web server is embedded in the IP gateway, and the system management function is configured to set all items related to network and system operation through the web server. IP gateway. The method of claim 3, wherein the IP address translation function (NAT), It converts the internal IP address into a representative IP address connected to the external network for TCP / IP data between the internal network and the external network, and is sent to the outside and incoming data centering on the IP gateway. An IP gateway characterized by translating an IP address of an IP packet header by applying to all. The method of claim 3, wherein the static routing function, Additionally connect the router 200 through one port to configure another internal network through the router, The operator determines the destination IP address, network mask, and gateway IP address information through a management function so as to determine the path of the IP packet to be delivered next by looking at the IP address of the IP packet received by the IP gateway 100. IP gateway characterized in that the static routing by the routing table created by using. The method of claim 3, wherein the DHCP server function, Automatically service TCP / IP configuration for computers connected to the LAN, but can be set automatically. IP Address, Subnet Mask, Router Address, 5 DNS Address , Set the Default Domain Name, An extension of BootP that provides services to clients that require TCP / IP configuration with BootP, as well as dynamically assigns IP addresses to computers on the internal LAN that are internally available. The method of claim 3, wherein the packet filtering function, Filters packets transmitted between internal LAN users and external Internet users. An access control function that restricts the use of the external Internet by internal LAN users to disable all Internet services on each computer, allow all, or only allow specific services by TCP / IP port number; It is a function used when operating a server in the internal LAN, and a virtual server function that delivers a packet requesting a specific service from the outside to a specific internal computer. Port security that allows all connections without translating IP addresses between internal LAN computers, but restricts access between LAN users when security is required between internal LAN users by restricting access for each port in special cases. IP gateway comprising a function.