KR20100062872A - Combination gateway communication apparatus and its method - Google Patents

Abstract

PURPOSE: An integrated gateway communication apparatus and a method of the same are provided to determine an approval for a message based on analyzed traffic information. CONSTITUTION: A policy configuration database(113) stores first information for filtering and switching a message which is received from a sub-network. An apparatus management unit(114) transmits and receives second information related to the sub-network and the interface of the sub-network. Based on the first information and the second information, a layer-filter unit filters and switches the message by each network layer. An integrated switch management unit(112) transmits the first information to the layer-filter unit. The integrated switch management unit controls the operation of the layer-filter unit.

Description

Integrated gateway communication device and its method {COMBINATION GATEWAY COMMUNICATION APPARATUS AND ITS METHOD}

The present invention relates to an integrated gateway communication apparatus and a method thereof, and more particularly, in an integrated gateway apparatus in a ship, analyzing traffic generated from each device connected to the integrated gateway, and whether the message is approved according to the analyzed information. And an apparatus and a method for communicating the approved message to the determined destination.

The present invention is derived from the research conducted as part of the IT growth engine technology development project of the Ministry of Knowledge Economy and the Ministry of Information and Communication Research and Development. [Task management number: 2008-S-038-01, Title: Development of IT-based ship's total solution] .

As is well known, gateway devices in ships are developed with network technology and with the development of e-navigation, it is possible to increase the stability in the ship and minimize the error of the navigator, and also the information of the ship Can be managed and monitored.

These gateway devices in general are developed as a factor of the change from the narrow-band but stability-based fieldbus protocol to the broadband base such as Ethernet and the gradual change that allows the devices in the ship to operate individually through a single integrated gateway. It's happening.

However, in the above-mentioned prior art gateway device in ships, the data generated by one device is unnecessarily transferred to another device or the performance of another device is degraded due to excessive traffic generated by one device. There is a drawback that results.

In addition, there is a problem that in-vehicle devices are randomly delivered to the device or the user that the important data is not approved, thereby exposing the risk of access and control to the on-board device by the unauthorized user.

In order to solve the above problem, an aspect of the present invention provides a policy configuration storage unit for storing first information regarding filtering and switching of a message received from a lower network, and a second network related to an interface between the lower network and the lower network. Device management unit for transmitting and receiving information, a layer-specific filter unit for filtering and switching the message for each network layer based on the first information and the second information, and the layer-specific filter unit for transmitting the first information and the Provided is an integrated gateway communication device including an integrated switch management unit for adjusting the operation of the filter unit for each layer.

The second information may include a MAC address and protocol information on the second layer, an IP address and TCP / UDP port information, and information on characteristics of the message. The layer-specific filter unit may include the MAC. A switch filter unit for performing message filtering and switching in a second layer according to an address and protocol information for the second layer, and filtering a message in a network and a transport layer according to the IP address and TCP / UDP port information; A route filter unit for performing switching and a gateway filter unit for performing message filtering and switching in an application layer according to the information on the characteristics of the message are provided.

The apparatus may further include a message conversion unit for performing message conversion between heterogeneous protocols on the message, wherein the gateway filter unit determines whether there is a need to convert the message to another protocol in switching the message. Provide a device.

The present invention also provides an integrated gateway communication device further comprising a resource management unit for allocating and managing resources for traffic of the message.

In addition, when heterogeneous devices are connected by the lower network, the same broadcasting group is set according to the characteristic information of the devices, and the characteristic information identifies the device group according to the IP address and the device according to the MAC addresses of the devices. It identifies groups and provides integrated gateway communication devices, which are identifiers for identifying groups of devices based on their physical ports.

In order to solve the above problem, another aspect of the present invention provides a method of storing a first information regarding filtering and switching of a message received from a lower network, and transmitting and receiving second information regarding an interface between the lower network and the lower network. And adjusting the filtering and switching for each network layer, and filtering and switching the message for each network layer based on the first information and the second information. To provide.

The second information may include a MAC address and protocol information about the second layer, an IP address and TCP / UDP port information, and information about a characteristic of the message. The filtering and switching may include: A switch filtering step of performing message filtering and switching in a second layer according to the MAC address and protocol information for the second layer, and a message in a network and transport layer according to the IP address and TCP / UDP port information A route filtering step of performing filtering and switching, and a gateway filtering step of performing message filtering and switching in an application layer according to the information about the characteristics of the message, provides an integrated gateway communication method.

The filtering of the switch may include determining whether the MAC address and protocol information about the second layer are included in the first information, and when the determination result is included in the first information, in the second layer. And switching the message to a destination or route filter based on the first information, and terminating the message if the message is not included in the first information.

The route filtering may include determining whether the IP address and the TCP / UDP port information are included in the stream registered in the first information, and as a result of the determination, included in the stream registered in the first information. Checking whether the stream is included in a system registered in the first information or an approved network protocol; and when the check result is included in a system registered in the first information or an approved network protocol, Switching the message to a destination or gateway filter based on the first information at a port layer, and terminating the message if it is not a system registered in the first information or an approved network protocol as a result of the checking; Provides an integrated gateway communication method.

The gateway filtering may include determining whether information regarding a characteristic of the message is included in the first information, and when the determination result is included in the first information, the application layer sends the message to the first information. And switching to a destination based on information, and discarding the message if it is not included in the first information.

The switching to the destination by the first information may include determining whether it is necessary to convert the message to another protocol in switching the message, and as a result of the determination, the message needs to be converted. In the case of providing an integrated gateway communication method comprising the step of performing a message conversion between the heterogeneous protocol for the message.

In addition, there is provided a method for integrated gateway communication further comprising the step of monitoring traffic generated from heterogeneous devices connected by the lower network, and allocating and managing resources for the traffic.

The method may further include setting the same broadcasting group according to characteristic information of devices when heterogeneous devices are connected by the lower network, wherein the characteristic information identifies a device group according to an IP address, A device group is identified according to a MAC address, and an integrated gateway communication method, which is a separator for identifying a device group according to a physical port, is provided.

The present invention allows the devices in the vessel to be connected through an integrated gateway, and then analyzes the traffic generated by each device connected to the integrated gateway, determines whether to approve the message according to the analyzed information, By determining the destination and communicating the approved message to the determined destination, unnecessarily delivered to another device as in the past, or by an unacceptable user or a defect that causes excessive traffic to degrade the performance of another device. Eliminate the problems of exposure to control and control of onboard equipment.

In addition, the present invention provides an integrated gateway communication method and an apparatus thereof, thereby allocating gateway resources according to service characteristics of a message to satisfy performance requirements of individual devices in a ship.

Hereinafter, with reference to the accompanying drawings will be described in detail the operating principle of the present invention. In the following description of the present invention, if it is determined that a detailed description of a known function or configuration may unnecessarily obscure the subject matter of the present invention, the detailed description thereof will be omitted. The following terms are defined in consideration of the functions of the present invention, and may be changed according to the intentions or customs of the user, the operator, and the like. Therefore, the definition should be made based on the contents throughout the specification.

1 is a diagram of an overall system configuration for integrated gateway communication according to an embodiment of the present invention, wherein the integrated gateway 100, the switching hubs 101 and 102, the navigation equipment 103, and a plurality of personal computers ( 104, the satellite receiver 105, the satellite 106, the VDR (videodisc recorder) equipment 107, the VDR capsule 108, the VDR server 109, and the like.

Here, all devices in the ship may be directly or physically connected with respect to the integrated gateway 100, or the switching hubs 101 and 102 (eg, the switching hubs 101 and 102 may simply be medium access controls). ), This integration gateway 100 determines switching for each layer for all traffic, determines whether to approve messages in each layer for all traffic, and You can also allocate resources for traffic.

For example, referring to FIG. 1, in the case of the VDR system, the VDR equipment 107, the VDR capsule 108, the VDR server 109, etc. are separately connected to the integrated gateway 100, whereas the navigation equipment 103 is used. Are connected through a switching hub 101 and a number of personal computers 104 are connected through a switching hub 102. In addition, the integrated gateway 100 performs a function of managing the connection with the satellite 106 through the satellite receiver 105. As such, when a plurality of devices are connected to the integration gateway 100, the device group is identified according to the characteristic information of the devices (eg, Internet protocol (IP) address information), and the device group is identified according to the MAC address information of the devices. In addition, the same broadcasting may be set according to a combination of all methods of identifying a device group according to a physical port of the integrated switching device.

In addition, in performing the identification of the device (shipping device), the integration gateway 100 generates identification information of the devices according to the integrated design information, and when the devices are added, the device identification information according to the physical information of the added devices. When the devices are added / deleted, each device generates device identification information according to a combination of all methods of registering and generating the characteristic information of the devices.

In addition, the integration gateway 100 sets the MAC broadcasting group according to the characteristics of the device (shipping device), sets the IP broadcasting group according to the stream in which the device is generated, and applies the application according to the characteristics of the message generated by the device. The broadcasting group is set up according to a combination of all methods of setting up the broadcasting group of the layer.

In addition, the integration gateway 100 monitors the traffic and allocates bandwidth for the link according to the type and characteristics of the traffic generated by the device, monitors traffic generated according to each stream of the device, and provides constant bandwidth and It allocates network resources, monitors traffic according to application messages generated by the device, and allocates certain network resources for each message.

In addition, the integration gateway 100 checks every frame in the MAC layer, determines whether to accept the frame according to the MAC address and MAC protocol information, and delivers a message to the destination port or internal application service for the approved frame. .

In addition, the integration gateway 100 determines whether to approve the message based on the IP address information and the TCP / UDP port information, and determines the approved TCP (user datagram protocol) / IP message. Determining the destination device (routing) and forwarding the message in an internal application message.

In addition, the integration gateway 100 determines the type of the application message, determines whether or not to process the message, and determines whether to determine the destination application service for the approved message or convert to another message.

FIG. 2 is a detailed block diagram of the integrated gateway 100 shown in FIG. 1. The resource manager 111, the integrated switch manager 112, a policy configuration database (hereinafter referred to as DB) 113 and an apparatus are shown in FIG. 1. The management unit 114, the switch filter unit 115, the route filter unit 116, the gateway filter unit 117, the message conversion unit 118, and the like may be included.

The resource manager 111 is a block for managing network resources inside the integrated gateway 100. The resource manager 111 allocates and manages a certain amount of resources for all traffic message streams that are collectively switched through the integrated switch manager 112.

The integrated switch manager 112 is a block that manages the overall functions of the switch. The switching filtering policy and the message filtering policy are read through the policy configuration DB 113 according to the resource allocation and management control of the resource manager 111. Each of the filter unit 115, the route filter unit 116, and the gateway filter unit 117 provides a corresponding policy (a switching filtering policy and a message filtering policy) so that the filtering can be performed.

The policy configuration DB 113 stores the switching filtering policy and the message filtering policy inputted from the policy / switch configuration profile 110, and includes user information including the user's access rights and rating information, and manufacturer information of individual ship devices. It stores access authority information for application services and access authority information for all vessel devices including integrated gateway device. Here, the policy / switch configuration profile 110 provides a switching filtering policy and a message filtering policy to the policy configuration DB 113 in the integration gateway 100.

The device manager 114 is a block for transmitting and receiving a message frame with the heterogeneous devices 101 to 109 shown in FIG. 1 through the heterogeneous network interfaces S1, and the heterogeneous network from the heterogeneous devices 101 to 109. The port and MAC address of various messages input through the interfaces S1 are extracted and provided to the switch filter unit 115, and the various messages input from the switch filter unit 115 are heterogeneous network interfaces S1. Through each of the heterogeneous devices (101 to 109) are provided.

In addition, the device manager 114 sets a MAC broadcasting group according to the characteristics of the heterogeneous devices 101 to 109, sets an IP broadcasting group according to a stream generated by the devices, and generates a message. Set the broadcast group of the application layer according to the characteristics of.

In addition, the device manager 114 monitors traffic according to the type and characteristic of the traffic generated by the specific device among the heterogeneous devices 101 to 109, allocates bandwidth for the link, and generates the stream according to each stream of the specific device. It monitors traffic, allocates constant bandwidth and network resources to each stream, monitors traffic according to application messages generated by a specific device, and allocates network resources for each message.

The switch filter unit 115 is a block for determining whether to filter and switch a message having a transmit / receive MAC address and protocol information about a second layer, and a switching filtering policy and a message filtering policy input from the integrated switch manager 112. That is, the device management unit determines the message switching at the MAC level with the MAC address information of the message input from the device manager 114 filtered according to the policy for the message approved or the message to be blocked in the second layer. The switching between the 114 and the route filter unit 116 is filtered.

In other words, the switch filter unit 115 determines the transfer to another node or the application service or to the route filter unit 116 according to the switching filtering policy and the message filtering policy, if MAC broadcasting or multicasting. In the case of a message not included in the MAC switching information including the message, switching of all messages is terminated.

The route filter unit 116 is a block for determining whether to filter and switch (routing) message frames of the network and the transport layer. The route filter unit 116 switches according to a switching filtering policy and a message filtering policy input from the integrated switch management unit 112. The IP address information of the message transmitted and received between the filter unit 115 and the gateway filter unit 117 and the port information of the TCP / UDP message are extracted to filter whether the message is transmitted or received.

In other words, the route filter unit 116 checks whether the IP address information of the transmitted / received message or the port information of the TCP / UDP message is a stream registered in the policy configuration DB 113 through the integrated switch management unit 112 and registered. In the case of a stream, it is determined whether to switch by checking whether it is a system registered in this policy configuration DB 113 or an approved network protocol such as address resolution protocol (ARP) or simple network management protocol (SNMP). Routing a message to a device belonging to a device or a group, or provides a message to the gateway filter unit 117. Here, the route filter unit 116 terminates switching of all messages when the message input from the switch filter unit 115 is an unregistered stream.

The gateway filter unit 117 is a block that determines whether filtering and switching (gateway) of the message frame of the application layer is possible, and message switching is performed according to a switching filtering policy and a message filtering policy input from the integrated switch manager 112. The message conversion unit 118 is provided to perform the message conversion function between the determined heterogeneous protocols, and the message is converted by the message conversion unit 118 to provide the route filter unit 116 with the message conversion between the heterogeneous protocols. do.

In other words, the gateway filter unit 117 acquires the switching information on the application message in the policy configuration DB 113 through the integrated switch management unit 112 and, if the message is an approved message, has the destination information for this message. Switching is performed. In this case, when the message needs to be converted, the message converting unit 118 performs the conversion of the message between heterogeneous protocols, and if the message is not approved, the message is discarded.

In addition, the gateway filter unit 117 inspects all frames in the MAC layer according to the switching and message filtering policy input from the integrated switch management unit 112, and determines whether to approve the frames according to the MAC address and the MAC protocol information. It provides a message to the destination port or internal application service for the approved frame.

In addition, the gateway filter unit 117 determines whether to approve the message based on the IP address information and the TCP / UDP port information according to the switching and message filtering policy inputted from the integrated switch manager 112, and determines whether to approve the message. Provides a message to the destination device for determination and internal application messages.

In addition, the gateway filter unit 117 determines the type of the application message according to the switching and message filtering policy inputted from the integrated switch management unit 112 to determine whether or not to process the message, and for the approved message of the destination application service Determine or decide whether to convert to another protocol message.

The message converting unit 118 converts a message between heterogeneous protocols input from the gateway filter unit 117 and provides the converted message to the gateway filter unit 117 again.

Accordingly, the present invention allows the devices in the vessel to be connected through an integrated gateway, and then analyzes the traffic generated by each device connected to the integrated gateway, determines whether to approve the message according to the analyzed information, and approves the approved message. Defective and / or unauthorized users, which determine the destination for and communicate unsolicited messages to the determined destination, unnecessarily forwarding to another device as in the past, or resulting in poor performance of another device due to excessive traffic. This solves the problem of exposing the risk of access and control to onboard equipment.

Next, an integrated gateway communication process in an embodiment of the present invention having the above-described configuration will be described.

3 is a flowchart sequentially illustrating the integrated gateway communication method according to an embodiment of the present invention.

First, in the policy / switch configuration profile 110, the switching filtering policy and the message filtering policy are provided to the policy configuration DB 113 in the integration gateway 100 (S301). Then, the switching filtering policy and the message filtering policy inputted from the policy / switch configuration profile 110 are stored in the policy configuration DB 113 (S303).

In addition, the integrated switch manager 112 reads the switching filtering policy and the message filtering policy through the policy configuration DB 113 according to the resource allocation and management control of the resource manager 111, and then switches the filter filter 115 and the route filter unit. Each of 116 and the gateway filter unit 117 provides a corresponding policy (a switching filtering policy and a message filtering policy) so that the filtering can be performed (S305).

In this case, the device manager 114 in the integration gateway 100 may select a port and a MAC address of a message input through a corresponding network interface of the heterogeneous network interfaces S1 from any of the heterogeneous devices 101 to 109. In step S307, the port and the MAC address of the extracted message are provided to the switch filter unit 115 in step S309.

In the switch filter unit 115, the device management unit 114 according to a switching filtering policy and a message filtering policy input from the integrated switch management unit 112, that is, a policy for a message approved in the second layer or a message to be blocked. In operation S311, it is determined whether the message inputted from the message is a message included in the MAC switching information, including the MAC broadcasting or the multicasting message.

As a result of the determination (S311), if the message is included, the message input from the device manager 114 is provided to the route filter unit 116 (S313). On the other hand, as a result of the determination (S311), if the message is not included, the switching operation is terminated (S315) for all the messages input from the device manager 114.

The route filter unit 116 determines whether the IP address information of the message input from the switch filter unit 115 or the port information of the TCP / UDP message is a stream registered in the policy configuration DB 113 through the integrated switch management unit 112. If the stream is registered by checking (S317), it is determined whether the network protocol is registered in this policy configuration DB 113 to determine whether to switch (S319), and then the input message is provided to the gateway filter unit 117. (S321). Here, when the message input from the switch filter unit 115 is an unregistered stream, the route filter unit 116 terminates the switching operation on all of these messages (S323).

The gateway filter unit 117 obtains the switching information on the application message in the policy configuration DB 113 through the integrated switch management unit 112 and checks whether the message input from the route filter unit 116 is approved (S325). do.

As a result of the check (S325), in the case of the approved message, switching is performed with destination information on the message input from the route filter unit 116. At this time, it is determined whether the message needs to be converted (S327).

As a result of the determination (S327), when the message needs to be converted, the message conversion unit 118 performs the message conversion between the heterogeneous protocols (S329), and then the route filter unit 116 and the switch filter unit 115 are used. And a message converted to the corresponding destination through the corresponding network interface among the heterogeneous network interfaces S1 through the device manager 114 to be switched (S331). On the other hand, if the result of the determination (S327), the conversion of the message is unnecessary, it passes through the route filter unit 116, the switch filter unit 115 and the device management unit 114 to the corresponding network interface of the heterogeneous network interfaces (S1) The message is immediately switched to the device of the destination through (S333).

As a result of the check (S325), if the message is not approved, the message input from the route filter unit 116 is discarded (S335).

As described above, the present invention provides a method and apparatus for integrated gateway communication, thereby allocating gateway resources according to service characteristics of a message to satisfy performance requirements required by individual devices in a ship.

Meanwhile, in the detailed description of the present invention, specific embodiments have been described, but various modifications are possible without departing from the scope of the present invention. Therefore, the scope of the present invention should not be limited to the described embodiments, but should be defined not only by the scope of the following claims, but also by those equivalent to the scope of the claims.

1 is a diagram of an overall system configuration for integrated gateway communication according to an embodiment of the present invention;

FIG. 2 is a detailed block diagram of an integrated gateway shown in FIG. 1;

3 is a flowchart sequentially illustrating the integrated gateway communication method according to an embodiment of the present invention.

<Description of the symbols for the main parts of the drawings>

100: integrated gateway 101, 102: switching hub

103: navigational equipment 104: multiple personal computers

105: satellite receiver 106: satellite

107: VDR Equipment 108: VDR Capsule

109: VDR Server 110: Policy / Switch Configuration Profile

111: resource management unit 112: integrated switch management unit

113: policy configuration DB 114: device management unit

115: switch filter unit 116: route filter unit

117: gateway filter unit 118: message conversion unit

Claims (13)

A policy configuration storage unit for storing first information regarding filtering and switching of a message received from a lower network; A device manager for transmitting and receiving second information about the interface between the lower network and the lower network; A layer-specific filter unit for filtering and switching the message for each network layer based on the first information and the second information, and Integrated switch management unit for transmitting the first information to the filter for each layer and coordinates the operation of the filter for each layer Integration gateway communication device comprising a. The method of claim 1, The second information includes a MAC address and protocol information about the second layer, an IP address and TCP / UDP port information, and information on characteristics of the message. The layer-specific filter unit, A switch filter unit for performing message filtering and switching in a second layer according to the MAC address and protocol information about the second layer; A route filter unit for performing message filtering and switching in a network and a transport layer according to the IP address and TCP / UDP port information, and A gateway filter configured to perform message filtering and switching in an application layer according to the information about the characteristic of the message; Integrated Gateway Communication Device. The method of claim 2, Further comprising a message conversion unit for performing a message conversion between heterogeneous protocols for the message, The gateway filter unit determines whether there is a need to convert the message to another protocol in switching the message. Integrated Gateway Communication Device. The method of claim 1, Resource management unit for allocating and managing resources for the traffic of the message Integration gateway communication device further comprising. The method of claim 1, When heterogeneous devices are connected by the lower network, the same broadcasting group is set according to the characteristic information of the devices. The characteristic information is a delimiter for identifying a device group according to an IP address, a device group according to a MAC address of the devices, and identifying a device group according to a physical port. Integrated Gateway Communication Device. Storing first information regarding filtering and switching of a message received from a lower network; Transmitting and receiving second information about the interface between the lower network and the lower network; Adjusting the filtering and switching for each network layer, and Filtering and switching the message for each network layer based on the first information and the second information Integration gateway communication method comprising a. The method of claim 6, The second information includes a MAC address and protocol information about the second layer, an IP address and TCP / UDP port information, and information on characteristics of the message. The filtering and switching step, A switch filtering step of performing message filtering and switching in a second layer according to the MAC address and protocol information for the second layer; A route filtering step of performing message filtering and switching at a network and transport layer according to the IP address and TCP / UDP port information; and A gateway filtering step of performing message filtering and switching at an application layer according to the information about the characteristic of the message; Unified gateway communication method. The method of claim 7, wherein The switch filtering step, Determining whether protocol information about the MAC address and the second layer is included in the first information; Switching the message to a destination or route filter based on the first information in a second layer when the determination result is included in the first information, and Terminating the message if it is not included in the first information as a result of the determination; Integration gateway communication method comprising a. The method of claim 7, wherein The route filtering step, Determining whether the IP address and the TCP / UDP port information are included in the stream registered in the first information; When the determination result is included in the stream registered in the first information, checking whether the stream is included in the system registered in the first information or an approved network protocol; Switching the message to a destination or gateway filter based on the first information in the network and transport layer when the check result is included in the registered system or the approved network protocol in the first information, and Terminating the message if it is not a system registered in the first information or an approved network protocol as a result of the checking; Integration gateway communication method comprising a. The method of claim 7, wherein The gateway filtering step, Determining whether information about a characteristic of the message is included in the first information; Switching the message to a destination based on the first information in the application layer when the determination result is included in the first information, and Discarding the message if it is not included in the first information as a result of the determination; Integration gateway communication method comprising a. The method of claim 10, Switching to the destination by the first information, Determining whether there is a need to convert the message to another protocol in the switching of the message, and Performing message conversion between heterogeneous protocols on the message when it is necessary to convert the message as a result of the determination; Integration gateway communication method comprising a. The method of claim 6, Monitoring traffic generated from heterogeneous devices connected by the lower network; and Allocating and managing resources for the traffic Integration gateway communication method further comprising. The method of claim 6, When heterogeneous devices are connected by the lower network, the method may further include setting the same broadcasting group according to the characteristic information of the devices. The characteristic information is a delimiter for identifying a device group according to an IP address, a device group according to a MAC address of the devices, and identifying a device group according to a physical port. Unified gateway communication method.

Images