KR20050036365A - System and method for providing internet additional service using mpls tunneling - Google Patents

Abstract

The present invention is to provide a VPN application service by confirming the Internet additional service registered by the subscriber at the time of the Internet access, so that traffic generated from the subscriber who has registered the VPN application service is delivered to the Internet additional service provider through the MPLS tunneling scheme through the Internet. The present invention relates to a technology capable of shortening the time required to improve an environment for providing an additional Internet service.

Description

System and method for providing internet additional service using MPLS tunneling

The present invention relates to a system and method for providing an internet supplementary service using MPLS tunneling, and more particularly, to improve an environment for providing an internet supplementary service by processing traffic according to a VPN application service through multiprotocol label switching (MPLS) tunneling. It's about technology that makes

Due to the rapid spread of the Internet and the development of technology, a scalable network structure is required for the continuous introduction of new services and additional services.In addition, the ISP (Internet Service Provider) is differentiated by reaching the limit of profit generation of existing services. Development of new value-added services is actively underway. At present, such an attempt has been visualized, and certain ISP providers have started to provide new additional services such as VPN (Virtual Private Network) services through a network tunneling technology through the Internet.

The main technologies used for network tunneling are Layer 2 Tunneling Protocol (L2TP) and Generic Routing Encapsulation (GRE). For reference, L2TP is a kind of Layer 2 tunnel protocol developed by Cisco Systems, and GRE is an encapsulation protocol that operates in general Layer 3 standardized by IEEE. Tunnel protocol PPTP or Ascend Communication's Accept Tunnel Management Protocol (ATP) It is used for.

In general, most tunneling protocols are handled in software, so they have a lot of limitations in terms of performance. Also, in the Internet network, multiple VPNs cannot use the same IP address. There is a problem that the packet processing time is delayed because the path control is performed using the address information.

On the other hand, recently introduced multiprotocol label switching (MPLS) technology is a destination IP address of an IP packet in a label switch network using MPLS (a network encapsulated in a short fixed length header called a label for high speed transmission of IP packets). Since IP packets can be encapsulated using layer 2 information called labels (short fixed length information), IP packets having private IP addresses can be transmitted using wide area IP networks.

This MPLS technology has the advantage of being scalable enough to be applied to large ISP networks among tunneling protocols.

Accordingly, the present invention has been made in view of the above-described circumstances, and in providing a VPN application service, by delivering traffic according to the internet supplementary service to an internet supplementary service provider through MPLS tunneling, an internet supplementary service using an existing infrastructure. The aim is to improve the provisioning environment.

In order to realize the above object, the system for providing an internet supplementary service using MPLS tunneling according to the present invention is an IP address group belonging to an IP pool assigned to an internet supplementary service registered by an authenticated subscriber after authenticating a subscriber station requesting internet access. Subscriber access unit for assigning one of the subscriber station to the originating IP; A packet processing system for providing an Internet supplementary service to the subscriber; And an internet network for processing traffic from the subscriber station transmitted through the subscriber access unit in a multiprotocol label switching (MPLS) tunneling scheme and delivering the traffic to the packet processing system. The MPLS network is installed at each end of the MPLS network, and is provided with a VPN routing information table storing routing information of the packet processing system, and extracts routing information from the VPN routing information table using an originating IP of the traffic. PE routers for routing the traffic based on the extracted routing information; And a plurality of P routers for performing MPLS relay between the PE routers.

In addition, the method for providing an internet supplementary service using MPLS tunneling according to the present invention may be performed by performing authentication on a subscriber who has requested internet access, and then recognizing one of the IP addresses belonging to an IP pool designated to the internet supplementary service registered by the authenticated subscriber. A first step of allocating to a calling IP address of a subscriber terminal; A second step of extracting routing information of the internet supplementary service provider using an originating IP address of the packet when an IP packet is transmitted from an authenticated subscriber to a multiprotocol label switching (MPLS) network; Attaching an MPLS label to the IP packet based on the routing information, converting the IP packet into an MPLS packet, and routing the packet in an MPLS tunneling manner; And a fourth process of removing the MPLS label from the MPLS packet, converting the MPLS packet into an IP packet, and delivering the MPLS packet to the Internet supplementary service provider.

1 is a block diagram illustrating a traffic processing in an internet supplementary service using MPLS tunneling according to an embodiment of the present invention.

Referring to FIG. 1, the subscriber station 2 is connected to the MPLS network 40 through the Digital Subscriber Line Access Multiplexer (DSLAM) 10 and the NAS 20.

As is known, the DSLAM 10 is a device that receives a signal from a digital subscriber line connection of several customers and sends a signal to a high-speed backbone line using multiplexing technology, and is a subscriber access system (hereinafter referred to as NAS: Network). Access System (20) performs authentication for the subscriber station (2) requesting access in connection with the authentication system (30), and assigns an IP address to the subscriber station (2) that has been successfully authenticated. It is a device to use this Internet access service.

In addition, the MPLS network 40 converts an IP packet transmitted from the NAS 20 into an MPLS packet so that traffic for using a VPN application service can be delivered to an internet supplementary service provider through MPLS tunneling. The routers 42 and 44 and the some P router 46 are comprised.

Hereinafter, the functions of the main components shown in FIG. 1 will be described in more detail.

The NAS 20 includes a table of name information of each IP pool designated for each service and information on an IP address group assigned to each IP pool, and communicates with the authentication system 30 using the Radius protocol. . In the present invention, the IP pool is preferably designated corresponding to the Internet supplementary service, but a separate IP pool may be designated even for a general subscriber who is not registered in the internet supplementary service.

The authentication system 30 preferably includes a table in which service profiles for each subscriber and name information of IP pools for each Internet supplementary service are stored. In the service profile, personal information for each subscriber, ID and password for authentication, etc. are stored, and it is preferable that the Internet additional service subscribed to by the subscriber is registered in the present invention.

In addition, the PE routers 42 and 44 of the MPLS network 40 include a table storing VPN routing information storing routing information for connection with an internet supplementary service provider (packet processing system shown in FIG. 3) for an IP pool. And attaching an MPLS label to the IP packet based on the routing information so that the IP packet is delivered to the internet supplementary service provider through MPLS tunneling.

The PE router 42 is located at the end of the MPLS network 40, and exchanges routing information for an internet supplementary service provider through an internal border gateway protocol (IBGP). The PE router 42 forwards the packet to the P router 46 by attaching an MPLS label if the IP pool information with the network address is in the VPN routing table, and forwards the packet to the corresponding VPN routing table. If there is no information, the packet is forwarded to a path close to the destination IP according to the general IP routing table. It is preferable to store the source IP pool address and the destination IP address corresponding to each source IP pool address in the VPN routing table.

The P router 46 of the MPLS network 40 performs a label swapping function to change the MPLS label of the MPLS packet transmitted from the PE router 42 and transmit the changed MPLS label to the PE router 44 to perform MPLS relaying through MPLS tunneling. Do this.

Receiving the forwarded packet from the P router 46, the PE router 44 removes the MPLS label and forwards the IP packet to the POP-only router 62.

With reference to the flowchart shown in Figures 1 and 2, the traffic processing procedure according to the provision of the Internet additional service using MPLS tunneling according to an embodiment of the present invention will be described in detail.

First, when the subscriber station 2 requests Internet access by inputting an ID and password on the access program (S2), the NAS 20 authenticates the subscriber through communication with the authentication system 30 using the Radius protocol. Perform (S4).

If the result of the authentication is successful (Yes in S4), the authentication system 30 extracts the Internet supplementary service registered by the subscriber with reference to the service profile of the subscriber, and the IP pool corresponding to the extracted Internet supplementary service information. The name information of the transmits to the NAS (20). Name information of the subscriber IP pool is preferably registered in attribute value 88 according to the RFC 2869 recommendation using the Radius protocol and transmitted to the NAS 20.

The NAS 20 having received the IP pool name information allocates an arbitrary IP address as an originating IP address of the subscriber station 2 from the IP address group assigned to the IP pool corresponding to the IP pool name information. (S10).

Subsequently, if the traffic is transmitted from the successful subscriber station 2 (S12), the traffic is transmitted to the PE router 42 of the MPLS network 40 through the NAS (20).

The PE router 42 extracts the destination IP address corresponding to the source IP address from the VPN routing table using the source IP address of the traffic (IP packet), and then generates an MPLS label based on the extracted destination IP address. It attaches to the said IP packet (S14).

The packet with the MPLS label is forwarded to the P router 46, after the MPLS label is changed by the P router 46, and forwarded to the PE router 44 by the changed MPLS label, and to the PE router 44. MPLS label is removed by the corresponding packet is delivered to the Internet supplementary service provider connected on the Internet (S16).

Through this process, since the packet is routed through the MPLS label, MPLS tunneling is possible, thereby improving the packet transmission speed.

In the network configuration shown in FIG. 1, the PE router 44 may be connected to an Internet network corresponding to an IP network, and as shown in FIG. 3, a service POP 60 may be connected to the PE router 44. ) Is usually built on IP.

In Fig. 3, a conventional Internet 50 and a service POP 62 are connected to the PE router 44. The service POP 60 is connected to a dedicated POP router 62 for performing related processing for providing an Internet supplementary service. , Packet filtering is performed on the service subscriber traffic delivered through the POP dedicated router 62 so that normal packets are delivered to the Internet 50 through the POP dedicated router 62 and the PE router 44. A packet processing system 64 is provided.

The packet processing system 64 is a device operated by an internet supplementary service provider. The packet processing system 64 may be equipped with an application for realizing various packet filtering functions. It can be an application that realizes a function of blocking access to a harmful site by using a virus, and an application that realizes a virus blocking function by performing a virus check on the delivered service subscriber traffic.

Next, with reference to Figures 3 and 4 will be described in detail the method of providing an internet additional service using MPLS tunneling according to an embodiment of the present invention.

When the traffic input from the subscriber station 2, which has undergone the authentication procedure according to the Internet connection, is delivered to the PE router 42 through the NAS 20 (S40), the PE router 42 sends the IP address of the corresponding service subscriber traffic. After extracting the routing information for transmitting the packet from the VPN routing table by using, generates an MPLS label based on the extracted routing information, and attach the generated MPLS label to the packet.

The packet is transmitted to the P router 46 and the PE router 44 through the MPLS tunneling by the MPLS label, and the PE router 44 receiving the MPLS-labeled packet removes the MPLS label from the packet. After converting the packet into an IP packet, the IP packet is transferred to the POP-only router 62 of the service POP 60 using the destination IP address recorded in the IP packet (S44).

Subsequently, the packet processing system 64 receiving the packet from the POP dedicated router 62 performs filtering on the packet constituting the traffic (S46), and transmits the normal packet back to the PE router 44 as a result of the filtering. The verified packet is forwarded to the Internet network 50 by the PE router 44.

However, on the contrary, if the filtering result in step S46 is detected that a URL for accessing a harmful site or a virus is detected and the packet is determined to be defective, a web page for informing the filtering result is transmitted through the MPLS network 40. Output to (2).

According to the present invention as described above, by processing the service subscriber traffic using the MPLS tunneling, not only can improve the packet processing speed according to the additional Internet services, but also improve the overall network performance, and existing Internet infrastructure without additional network construction By using it is possible to provide a scalable Internet additional service.

On the other hand, the present invention is not limited to the above-described embodiment, but can be modified and modified within the scope not departing from the gist of the present invention, such modifications and changes should be regarded as belonging to the following claims. will be.

1 is a network diagram illustrating traffic processing according to an additional service of the Internet using MPLS tunneling according to an embodiment of the present invention.

2 is a flowchart for describing traffic processing according to an internet supplementary service using MPLS tunneling according to an embodiment of the present invention.

3 is a diagram illustrating a network configuration of an internet supplementary service system using MPLS tunneling according to an embodiment of the present invention.

4 is a flowchart for explaining a method for providing an internet supplementary service using MPLS tunneling according to an embodiment of the present invention.

Claims (11)

A subscriber access unit for authenticating a subscriber station requesting access to the Internet, and then assigning one of the IP address groups belonging to the IP pool designated in the internet supplementary service registered by the authenticated subscriber as the source IP of the subscriber station; A packet processing system for providing an Internet supplementary service to the subscriber; And A MPLS network for processing traffic from the subscriber station delivered through the subscriber access unit in a multiprotocol label switching (MPLS) tunneling scheme and delivering the traffic to the packet processing system; The MPLS network VPN routing information tables, each of which is installed at an end of the MPLS network and stores routing information of the packet processing system, are provided to extract routing information from the VPN routing information table using an originating IP of the traffic, and the extracted routing. PE routers for routing the traffic based on information; And a plurality of P routers configured to perform MPLS relay between the PE routers. The method of claim 1, In the VPN routing table, Corresponding to the IP pool allocated to each of the Internet supplementary services, routing information to the packet processing system for providing the Internet supplementary service is stored, characterized in that the Internet additional service providing system using MPLS tunneling. The method of claim 1, The PE routers, Internet additional service providing system using MPLS tunneling, characterized in that the exchange of VPN routing information for each service using the IBGP (Internal Border Gateway Protocol). A first step of performing an authentication for the subscriber requesting the internet access and then assigning one of the IP addresses belonging to the IP pool designated in the internet supplementary service registered by the authenticated subscriber as the source IP address of the subscriber's terminal; A second step of extracting routing information of the internet supplementary service provider using an originating IP address of the packet when an IP packet is transmitted from an authenticated subscriber to a multiprotocol label switching (MPLS) network; Attaching an MPLS label to the IP packet based on the routing information, converting the IP packet into an MPLS packet, and routing the packet in an MPLS tunneling manner; And And removing the MPLS label from the MPLS packet, converting the MPLS packet into an IP packet, and forwarding the MPLS packet to the Internet supplementary service provider. The method of claim 4, wherein The first step is A first step of performing authentication for the subscriber by using the ID and password inputted from the subscriber, when the subscriber access system (NAS) requests authentication of the subscriber who has requested an internet connection to the authentication system; A second step of inquiring a service profile of the subscriber and inquiring of an internet supplementary service registered by the subscriber if authentication of the subscriber is successful; A third step of inquiring about the IP pool of the inquired Internet supplementary service, and transmitting information about the inquired IP pool and an authentication result to the subscriber access system; And a fourth step of the subscriber access system allocating a specific IP address from the IP address group belonging to the IP pool as the source IP address of the terminal of the subscriber. The method of claim 5, wherein In the third step, The information on the IP pool is the name information of the IP pool, characterized in that the Internet additional service providing method using MPLS tunneling. The method of claim 4, wherein The second process, Extracting the IP pool from the source IP address of the IP packet, and then extracting routing information of the Internet supplementary service provider corresponding to the IP pool from the VPN routing information table. The method of claim 7, wherein In the VPN routing table, Corresponding to the IP pool allocated for each VPN service, routing information of the Internet service provider providing the Internet service is stored, characterized in that for storing MPLS tunneling. The method of claim 4, wherein In the fourth process, The Internet supplementary service provider performs a filtering function on the IP packet so that a normal IP packet is delivered to the Internet network through the MPLS network, and when a bad IP packet is detected, an error state is transmitted to the terminal of the subscriber through the MPLS network. Internet additional service providing method using MPLS tunneling, characterized in that the notification. The method of claim 9, Filtering on the IP packet, And extracting a URL address from the IP packet, determining whether the URL address is registered as a harmful site URL, and determining whether the IP packet is normal. The method of claim 9, Filtering on the IP packet, And performing a virus scan on the IP packet to determine whether the IP packet is normal according to a virus scan result.