KR20060087385A - A one body type equipment having a vpn and modem there inside - Google Patents

Abstract

The present invention relates to an integrated terminal of a WPN and a modem, and includes a VPN device which is used to secure a modem terminal and transmission data used for accessing an Internet network in most networks including an ADSL to access an ISP public network. The present invention also relates to an integrated terminal of a WPN and modem configured to provide network control functions such as identifying a point of failure throughout the network and security, which are not realized in a conventional network system.

An integrated terminal of a VPN and a modem according to the present invention, a modem unit for performing the modulation / demodulation of the data signal transmitted and received between a predetermined computer terminal and the ISP public network; and a VPN unit for performing the encryption and decryption process for the data signal ; And a connector unit providing a connection path between the modem unit and the VPN unit.

VPN, Modem, Connector, ISP, xDLS

Description

Integrated terminal of WiFi and modem {A ONE BODY TYPE EQUIPMENT HAVING A VPN AND MODEM THERE INSIDE}

1 is a block diagram illustrating a network system using a conventional VPN device and a modem terminal.

2 is a block diagram illustrating a network system using an integrated terminal incorporating a VPN and a modem terminal in accordance with the present invention.

3 is a block diagram illustrating a configuration of an integrated terminal according to the present invention;

Figure 4 is a block diagram showing a connector pin configuration according to the present invention.

5 is a block diagram showing a control center according to the present invention.

* Description of the symbols for the main parts of the drawings *

10: computer terminal 20: VPN equipment

30: modem terminal 40: DSLAM

50: BRAS 60: IPS PE

100: integrated terminal 200: VPN unit

205: LAN 230: central processing unit

300: modem unit 304: modem DSP unit

400: connector 500: control center

The present invention relates to an integrated terminal of a WPN and a modem, and includes a VPN device which is used to secure a modem terminal and transmission data used for accessing an Internet network in most networks including an ADSL to access an ISP public network. The present invention also relates to an integrated terminal of a WPN and modem configured to provide network control functions such as identifying a point of failure throughout the network and security, which are not realized in a conventional network system.

Recently, due to the development of internet network and network technology, distant computers can be connected as LAN (wide area network) and wide area network (WAN) and used as computers next to each other. It was done.

In such data transmission, DSL (Digital Subscriber Line) is especially used for high-speed information transmission. DSL is a technology for high-speed information transmission to homes and small businesses through ordinary copper telephone lines, and xDSL is Asymmetric Digital. Various other variants of DSL are collectively called Subscriber Line, High-Beat Digital Subscriber Line (HDSL), Rate Adaptive Digital Subscriber Line (RADSL).

In particular, ADSL, which is the most widely used among ISP's Internet products to access the Internet, installs a modem in the personal computer terminal of the subscriber's customer and connects to the ISP's public network.

However, since most network products including ADSL are shared and used by multiple users, there is a problem that security is weak, such as information leakage, system destruction by illegal invasion through a network.

Therefore, in recent years, it is common to use a virtual private network such as a virtual private network (VPN) to reinforce vulnerable security. Until now, the modem terminal 30 and the VPN device 20 are separately separated as in the conventional block diagram of FIG. 1. By installing, the modem terminal 30 is configured to access the Internet network, the VPN device 20 is responsible for the security of the transmission data through encryption / decryption, respectively.

In the case of separately configuring such a conventional modem terminal 30 and the VPN device 20, the cost required by the installation is very large, when the failure in data transmission occurs the failure of the network of the modem terminal 30 It is difficult to determine whether it is due to a failure occurring in the connection part or due to the VPN device 20 that encrypts and decrypts without visiting the site, and it is difficult to control remotely.

The present invention has been made to solve the problems described above, an object of the present invention is to provide a terminal integrating a modem terminal and VPN equipment in one equipment, MPLS (MultiProtocol Label Switching) network which is a secure network provided by an ISP To provide a secure connection to the network, and furthermore, to provide an integrated terminal of the VPN and modem that can accurately identify the point of failure throughout the network and security, such as in the control center, to enable accurate response.

Another object of the present invention is to control the modem terminal or to check the network status of the IPS in the case of network connection problems in the network and security, and to recreate the tunnel of the VPN device in case of security problems To provide an integrated terminal of a VPN and a modem.

In order to solve the problems as described above, the integrated terminal of the VPN and modem provided by the present invention,

A modem unit for performing modulation / demodulation of a data signal transmitted and received between a predetermined computer terminal and an ISP public network, and a VPN unit for performing encryption and decryption processing on the data signal; And a connector unit providing a connection path between the modem unit and the VPN unit.

Preferably, the modem unit is connected to a DSLAM (Digital Subscriber Line Access Multiplexer) of an ISP public network to perform analog data exchange with the ISP network: an ADSL input / output unit; and analog data transmitted / received through the ADSL input / output unit. And an ADSL analog front end (AFE) unit for performing amplification; and a modem DSP (Digital Signal Processor) unit connected to the ADSL AFE unit to convert the analog data into digital data; and converting the converted digital data into an Ethernet. Ethernet PHY volume unit for converting a signal to perform Ethernet communication, including;

The VPN unit receives a network interface card for processing a network interface to the Ethernet signal, and receives an Ethernet signal applied through the network interface card to perform data decryption processing by a predetermined encryption algorithm, and received from a computer terminal. A central processing unit for performing data encryption processing and transmitting the data to the network interface card;

The connector unit is a power connection unit for applying the power applied to the VPN unit to the modem side, and a network connection unit for providing a connection path of the data transmitted and received between the VPN unit and the modem unit: and is output from the central processing unit of the VPN unit And an RS232 connection for providing a path for console communication for transferring various control data to the DSP portion of the modem.

The central processing unit of the VPN unit may include a built-in acceleration chipset for accelerating encryption, and the VPN unit may be connected to a UTP cable to be connected to a wide area network (WAN), which is an external network.

In addition, the connector unit may be configured to further include an LED signal connection unit for transmitting the network and data flow status signals of the modem unit to the VPN unit.

Hereinafter, with reference to the accompanying drawings will be described in more detail for the present invention.

FIG. 2 is a block diagram illustrating a network system in which an integrated terminal 100 according to the present invention is used first. As shown in an ISP (Internet Service Provider) network, an ISP Multiprotocol Label Switching (MPLS) network and an ISP XDLS. As a structure in which networks are organically connected to each other, as is generally known, ISP PE 60 equipment is disposed between an ISP MPLS network and an ISP XDLS network, and data encryption is performed. Between the 100 and the ISP XDLS network, a Broadband Remote Access Server (BRAS) and a Digital Subscriber Line Access Multiplexer (DSLAM) are configured as shown in the figure, and are located at the front end of the computer terminals 10 which is the point where the XDLS is finally used. The integrated terminal 100 according to the present invention is disposed.

Prior to explaining the configuration of the integrated terminal 100 in detail in the block diagram of FIG. 3, the components of the above-described network system will be described as follows.

MPLS network is a technology to process LAYER 3 packet in LAYER 2, and is a kind of 3 layer switching technology that combines 2 layer switching speed and 3 layer routing function, and is simple label switching using short and stable length label. The label consists of 4 bytes. MPLS uses a packet delay because the network layer router makes the program process simpler by searching for the 4-byte label attached to the packet and making a transmission decision instead of scanning the entire network layer information. Save time.

In particular, MPLS can scan all packets to find out where they are going and what applications they are assigned to, and assign MPLS tags to each packet, so you only need to read the MPLS header and route the packets in the right direction. Relieves the burden of routers and switches within

ISP XDLS is a generic term for several different variants of ADSL, HDSL, RADSL, and VDSL. It is a high speed communication modem using copper cable for telephone line. BRAS is a broadband remote access server that connects ADSL signals to the Internet. DSLAM is the part that plays the role of MUX in ADSL.

The configuration of such a network as described above has a configuration and operation commonly known in the art, so further detailed description will be omitted, hereinafter, of the integrated terminal 100 according to the present invention using the block diagram of FIG. It will be described in detail the configuration and operation.

According to FIG. 3, the integrated terminal 100 of the present invention includes three parts, that is, a modem unit 300 for performing modulation / demodulation of data signals transmitted and received between a predetermined computer terminal and an ISP public network, and a data signal. The VPN unit 200 performs encryption and decryption processing, and the connector unit 400 provides a connection path between the modem unit 300 and the VPN unit 200.

The modem unit 300 includes an ADSL input / output unit 305, an ADSL AFE unit 306, a modem DSP unit 304, an Ethernet PHY block unit 302, etc. as main components, and a protection device as other components ( 307, flash memory 308, SDRAM 309, reset circuit 310, regulator 301, console 303, and the like.

More specifically, the ADSL input and output unit 305 is connected to the DSLAM 40 of the ISP public network to exchange analog data with the ISP network, and the ADSL AFE unit 306 is connected to the ADSL input and output unit 305. It is a component that modulates / demodulates and amplifies analog data transmitted and received.

In particular, the ADSL AFE unit 306 may be a circuit configured by using a line transformer, a capacitor, and a register. The ADSL signal is divided into RX and TX signals, and the interface of the CX81301 ADSL router chip, which is an example of the chip processor of the modem DSP unit, described later. The circuit can be configured to connect with the portion.

The modem DSP unit 304 is connected to the ADSL AFE unit 306 and converts analog data into digital data. As described above, the CX81301 ADSL router chip may be used, and the CX81301 ADSL router chip is the above ADSL AFE unit. The internal 306 is configured to convert an analog signal into a digital signal therein and then calculate the digital data in an ARM940T processor.

The Ethernet PHY block unit 302 is connected to the modem DSP unit 304 to communicate the converted digital data in the Ethernet network. Preferably, the 10/100 Ethernet PHY block unit is a PHY chip, an Ethernet magnetic module, and an RJ-45. It is a block that includes a connector, and internally connects to the modem DSP unit 304, which is a CX81301 ADSL router chip, by MII and sends and receives data. Connected to and configured to perform data communication.

In addition, the PHY chip communicates data using SNI (Serial Network Interface) and MII (Media Independent Interface), and communicates with 10BaseTx by Manchester Encoding and Decoded data.

It extracts the clock using the internal PLL from the input signal and outputs the 2.5MHz reference clock necessary for serial controller and MII connection, and enables the PHY chip register handling using the MII Management Function, and supports Auto Negotiation for layer and Set the communication speed automatically. And it is operated by receiving 25MHz clock input from outside and power is used for 3.3V.

On the other hand, the Ethernet magnetic module reduces noise mixed in the data signal output from the PHY chip, and is connected to the Ethernet NIC of the PC through the Lan Cable at the RJ-45 connector, and is connected to the PC through the Ethernet NIC embedded in the PC. Connected with.

The protection device 307 is a circuit configured to prevent the modem unit 300 from being damaged by abnormal voltages such as overvoltage and lightning inputted from the ADSL line by being composed of overvoltage and overcurrent protection components and RJ11. 308 is a storage medium for storing software for driving a modem and is configured as a flash memory chip and connected to EMAC1 INTERFACE of the modem DSP unit 304, which is a CX81301 ADSL router chip, to input and output data.

The SDRAM 309 is a circuit composed of an SDRAM chip. The SDRAM 309 is connected to the EMAC1 INTERFACE unit of the modem DSP unit 304, which is a CX81301 ADSL router chip, and is driven by the main clock used by the modem DSP unit 304, which is a central processing unit of the modem. SDRAM operated by receiving (CLOCK) directly provides 64-bit data bus and each RAM operates in synchronization with each other so that there is no waiting time for accessing the memory, so to provide a storage space where ACCESS is possible. Other configurations include a reset circuit 310 for resetting the modem unit 300, a regulator 301 for stabilizing power and supplying the modem unit 300, as shown in the figure.

The VPN unit 200 includes, as its main configuration, a network interface card 208, also referred to as a NIC, and a central processing unit 230 that performs data decryption processing by an encryption algorithm. The network interface card 208 includes a modem. It is to interface the Ethernet signal from the Ethernet PHY block unit 302 of the unit 300 side, the central processing unit 230 receives the Ethernet signal applied through the network interface card 208 to the data by a predetermined encryption algorithm By performing the decryption process of the CPU 230, the central processing unit 230 may have a built-in acceleration chipset for accelerating the encryption.

The WAN 204 and the LAN 205 are Ethernet interfaces connected to an external network and an internal network, respectively, and one of the two interfaces is configured to be connected to a UTP cable.

On the other hand, the other interface LAN is connected to the modem unit 300 through the connector 400, which will be described later, the switch 210 is configured to directly up to four computer terminals 10 without a separate hub switch It can also be connected to other hub switches.

As a memory block used in the VPN unit 200, a flash memory 220 and a RAM type memory 219 are used as shown, and the flash memory 220 is configured for storing a kernel and an application, and RAM Type of memory 219 is a memory that is frequently accessible during device operation.

 In the present invention, the connector unit 400 is provided to integrate the modem unit 300 and the VPN unit 200 having the above-described configuration to form a single terminal, and the configuration of the connector unit 400 is also illustrated. It is well illustrated in the block diagram of 3.

Connector 400 is largely composed of a power connection unit 401, a network connection unit 402, RS232 connection unit 403 and LEDS connection unit 404, the power connection unit 401 is the power applied to the VPN unit 200 It is a configuration for providing a connection path for authorization to the modem unit 300 side, the network connection unit 402 is a configuration for providing a connection path of data transmitted and received between the VPN unit 200 and the modem unit 300, The RS232 connection unit 403 is configured to provide a path for console communication for transferring various control data output from the central processing unit 230 of the VPN unit 200 to the modem DSP unit 304 of the modem unit 300. Will be.

On the other hand, the LEDS connection unit 404 is a configuration for indicating the network state and data flow state of the modem unit 300 and the VPN unit 200, this configuration is the modem unit 300 and VPN unit 200 in accordance with the present invention Considering only the basic function of the can be omitted as much as possible, in order to be monitored by the control center 500 or the user is also a configuration that can be added as much as possible.

Figure 4 shows an embodiment of the preferred pin configuration of such a connector 400 of the present invention, Table 1 below shows the signal name and its meaning, the flow direction of the signal, etc. assigned to each pin.

Hereinafter, a process of performing modulation / demodulation of data signals by the modem unit 300 and encryption / decryption processing by the VPN unit 200 in the integrated terminal 100 of the VPN and the modem having the above-described configuration will be described below. I will explain in.

 First, when the ISP describes the process of transferring data to the computer terminal 10 through the integrated terminal 100 according to the present invention, ADSL input and output unit 305 of the modem unit 300 side connected to the DSLAM 40 of ADSL The data is applied through the control panel, and the ADSL input / output unit 305 demodulates and amplifies the signal in the ADSL AFE 306 and applies it to the modem DSP unit 304 through the protection device 307.

The modem DSP unit 304 converts an analog signal into a digital signal, and then converts the analog signal into an Ethernet signal through the Ethernet PHY block unit 302, and the converted Ethernet signal is converted into a VPN unit through the network connector 402 on the connector 400 side. Applied to the network interface card 208 of the (200), the network interface card 208 is a network interface processing the Ethernet signal received from the Ethernet PHY block unit 302 to deliver to the central processing unit (230).

The central processing unit 230 of the VPN unit 200, with the support of the built-in acceleration chipset 212, decrypts the data according to an encryption algorithm, and transmits the decrypted data to the LAN 205 via the switch 210 to the end. The decoded data is transmitted to the computer terminal 10.

On the contrary, the process of transferring data from the computer terminal 10 to the ISP through the integrated terminal 100 according to the present invention proceeds in the opposite flow to the above-described flow, and the difference from the above-described flow is the VPN. The difference that the central processing unit 230 of the unit 200 performs the data encryption process by the encryption algorithm, the difference that the modem DSP unit 304 converts the digital signal into an analog signal, and the modulation in the ADSL AFE 306 (Modulation) is performed.

On the other hand, Figure 5 shows a control center 500 according to the present invention in a block, the functional connection of the control center 500 and the integrated terminal 100 of the present invention from the VPN unit 200 to the modem unit 300 It is made by transmitting the control signal controlled overall to the control center 500, the connection can be made through the WAN 204 or ISP network as much as possible, the control center 500 is scattered in a number of places Among the integrated terminals 100 of the present invention to be distributed, when a failure occurs in a predetermined integrated terminal 100, whether the failure occurs in the network connection part of the modem unit 300 or the disabled occurred in the VPN unit 200 side. It's easy to see.

According to the integrated terminal according to the present invention having the configuration and operation process as described above, it is possible to perform the modulation / demodulation and encryption / decryption processing for the data signal between the ISP and the computer terminal, reducing the cost of installation and configuration When a data transmission failure occurs, it is easy to monitor in real time whether the failure is caused by a failure in the network connection part of the modem part or by the VPN part responsible for encryption and decryption. Even in remote places such as the state can be easily grasped without a visit, it is possible to accurately deal with the type of the disorder.

Claims (5)

A modem unit for performing modulation / demodulation of data signals transmitted and received between a predetermined computer terminal and an ISP public network; A VPN unit which performs encryption and decryption processing on the data signal; And And a connector unit providing a connection path between the modem unit and the VPN unit. The method of claim 1. The modem unit is connected to the DSLAM of the ISP public network ADSL input and output unit for analog data exchange with the ISP network: and ADSL AFE unit for performing the modulation / demodulation and amplification of analog data transmitted and received through the ADSL input and output unit: A modem DSP unit connected to the ADSL AFE unit and converting the analog data into digital data; an Ethernet PHY block unit converting the converted digital data into an Ethernet signal and performing Ethernet communication; The VPN unit receives a network interface card for processing a network interface to the Ethernet signal, and receives an Ethernet signal applied through the network interface card to perform data decryption processing by a predetermined encryption algorithm, and received from a computer terminal. A central processing unit for performing data encryption processing and transmitting the data to the network interface card; The connector unit is a power connection unit for applying the power applied to the VPN unit to the modem side, and a network connection unit for providing a connection path of the data transmitted and received between the VPN unit and the modem unit: and is output from the central processing unit of the VPN unit RS232 connection unit for providing a path of the console communication for transferring various control data to the DSP unit of the modem. The method of claim 1, The central processing unit of the VPN unit is integrated terminal of the VPN and modem, characterized in that it includes a built-in acceleration chipset for accelerating encryption. The method of claim 1, The VPN unit is integrated terminal of the VPN and modem, characterized in that connected to the UTP cable to be connected to the WAN, the external network. The method of claim 2, The connector unit further comprises an LED signal connection unit for transmitting the network and data flow status signals of the modem unit to the VPN unit.

Images