KR20180065442A - Method and system for providing intranet service by customer using virtual networking technology - Google Patents

Abstract

The present invention relates to a method for providing an intranet service by client company using virtual networking technology. The method comprises the steps of: setting port isolation in an Ethernet switch located in a private network of a client company and a core switch located in a communication company service center; setting first VLAN ID information for identifying the client company in the Ethernet switch; setting second VLAN ID information for identifying a service provider in the core switch; and forming a virtual LAN communication network between the private network of the client company and the communication company service center by mapping the first and second VLAN ID information each other. Therefore, an independent VLAN communication network between the communication company and multiple client companies can be formed using P-VLAN technology.

Description

TECHNICAL FIELD [0001] The present invention relates to a method and system for providing intranet service by a customer using a virtual networking technology,

The present invention relates to a method and system for providing an intranet service for each customer using wired / wireless virtual networking technology. More particularly, the present invention relates to a method and system for providing an intranet service dedicated to security for each customer by expanding a plurality of customer premises networks to a service provider service infrastructure area through a virtual networking technology.

As information and communication technology develops day by day, the number of communication equipment and IT equipment used by enterprises is increasing, and the complexity of communication equipment and IT equipment is increasing. Accordingly, it is difficult for a company to provide space for installing communication equipment and IT equipment, and it is difficult to positively cope with failure and obstacle of communication equipment and IT equipment due to the absence of a specialized manpower. In addition, in the case of a corporate premises network, there is a problem that security is weak because the network is directly connected to the Internet through an Ethernet switch.

For telecom operators, it takes a lot of time and money to deal with the trouble and maintenance of communication equipment and IT equipment located inside the customer. In addition, since access to communication equipment and IT equipment located in the customer's company is not free, it is difficult to detect the abnormality of the equipment quickly.

Therefore, it is necessary to expand the number of customer premises networks to the service infrastructures of telecommunication carriers to provide services necessary for overall ICT operations such as equipment hosting, Internet access, security, integrated control and solutions.

The present invention is directed to solving the above-mentioned problems and other problems. Another object of the present invention is to provide an intranet service providing method and system that can form an independent VLAN communication network between a communication company and a plurality of customers using P-VLAN technology (i.e., Port Isolation technology).

Another object of the present invention is to provide an intranet service providing method and system for allowing a customer to remotely access ICT equipment located within a service company center through a wired / wireless connection utilizing authentication technology and VPN technology.

Another object of the present invention is to provide an intranet service providing method and system for providing various additional services based on a virtual network by building ICT equipment for each customer in a service center of a service provider.

According to an aspect of the present invention, there is provided a method for establishing port isolation between an Ethernet switch located in a customer premises network and a core switch located in a communication service center, Setting first VLAN ID information for identifying a customer in the Ethernet switch; Setting second VLAN ID information for identifying a service provider to the core switch; And mapping the first VLAN ID information and the second VLAN ID information to each other to form a VLAN (Virtual Local Area Network) communication network between the customer premises network and the service provider service center .

More preferably, the intranet service providing method is characterized in that a dedicated optical cable is connected between the Ethernet switch and the core switch.

More preferably, the intranet service providing method includes the steps of: when the ICT (Information Communication Technology) equipment of the customer is connected to the core switch, the ICT equipment of the customer located in the service company service center and the And a network is formed.

More preferably, in the intranet service providing method, the customer's ICT equipment includes at least one of a PC farm, a storage, and a customer-specific server.

More preferably, the method for providing an intranet service further includes the step of assigning an IP address to the ICT equipment of the customer and the terminal units, when a Dynamic Host Configuration Protocol (DHCP) server is connected to the core switch .

More preferably, the intranet service providing method includes: when an authentication server and a VPN (Virtual Private Network) server are connected to the core switch, the intranet service providing method comprises the steps of remotely accessing the ICT equipment of the customer using the terminal outside the customer premises network Further comprising the steps of:

More preferably, the intranet service providing method comprises: authenticating whether the terminal is an authorized terminal based on ID information and password information input from a user; And generating a VPN tunnel between the VPN server and the terminal when the terminal authentication is successful.

More preferably, the intranet service providing method further includes a step of providing a security solution function for protecting a VLAN communication network when a UTM (Unified Threat Management) server is connected between a communication service center and an Internet network .

More preferably, the method for providing the intranet service comprises the steps of allocating idle resources of the PC farm based on the first VLAN ID information transmitted from the subscriber terminal of the customer when the PC resource management server is connected to the core switch And further comprising:

More preferably, the intranet service providing method further includes a step of allocating an idle cluster of the storage based on the first VLAN ID information transmitted from the customer premises terminal when the storage virtualization management server is connected to the core switch .

More preferably, the method for providing an intranet service comprises the steps of: configuring a VLAN communication network through a leased line between a headquarters of a customer company and a service company service center of a first area, if the customer is a customer in a main-branch type; Configuring a VLAN communication network through a leased line between a branch office of the customer company and a service company service center of a second region; And a communication network service center in each country.

According to another aspect of the present invention, there is also provided a method of controlling a plurality of Ethernet switches located in a plurality of customer premises networks; A core switch disposed at a communication service center and connected to the plurality of Ethernet switches through a dedicated optical cable; And a second VLAN ID information for identifying a service provider, the second VLAN ID information for identifying a service provider, the first VLAN ID information for identifying a customer, the second VLAN ID information for identifying a service provider, And a controller for mapping the first VLAN ID information and the second VLAN ID information to each other to form an independent VLAN communication network between the customer premises network and the service provider service center, Providing system.

More preferably, the intranet service providing system further includes ICT equipment located at a service provider's service center and connected to the core switch.

More preferably, the intranet service providing system is connected to the core switch and allocates an IP address to ICT equipment located in a communication service center and IC terminals located in the plurality of customer premises networks And a DHCP server.

More preferably, the intranet service providing system includes an authentication server for authenticating the terminal when a terminal outside the customer premises network accesses a communication service service center, and an authentication server for authenticating the terminal, And a VPN server for creating a VPN tunnel between the VPN server and the VPN server.

More preferably, the intranet service providing system further includes a UTM server which is connected between a service provider's service center and the Internet network and provides a security solution function for protecting a VLAN communication network.

Preferably, the intranet service providing system further includes a PC resource management server connected to the core switch and allocating idle resources of the PC farm based on the first VLAN ID information transmitted from each of the customer premises terminals .

More preferably, the intranet service providing system further comprises a storage virtualization management server connected to the core switch and allocating an idle cluster of the storage based on the first VLAN ID information transmitted from each customer's premises terminal .

An intranet service method and an effect of the system according to embodiments of the present invention will be described as follows.

According to at least one embodiment of the present invention, a private VLAN technology is applied to an Ethernet switch and a core switch to form an independent single VLAN network between a communication service center and a plurality of customer premises networks, thereby providing an L2 intranet service dedicated to security It has the advantage that it can provide.

According to at least one embodiment of the present invention, a plurality of client premises networks are extended to a service provider service infrastructure area based on virtual networking technology, and access management / maintenance / maintenance work for an internal network and an ICT infrastructure equipment Can be efficiently performed.

In addition, according to at least one embodiment of the present invention, it is possible to provide a smart work environment capable of remotely accessing ICT equipment of each customer located in a communication service center through wired / wireless connection utilizing authentication technology and VPN technology There are advantages.

However, the method and system for providing intranet service according to the embodiments of the present invention are not limited to those described above, and other effects that are not mentioned are described in the following description, It will be understood by those of ordinary skill in the art.

1 is a diagram referred to explain P-VLAN technology applied to an Ethernet switch according to the present invention;
FIG. 2 is a diagram referred to explain an example of setting an access allow / disable matrix applying Port Isolation technology to the Ethernet switch of FIG. 1; FIG.
FIG. 3 is a system configuration diagram for providing an intranet service according to an embodiment of the present invention; FIG.
FIG. 4 is a flowchart illustrating a method for providing an intranet service according to an embodiment of the present invention; FIG.
5 is a system configuration diagram for providing an intranet service according to another embodiment of the present invention;
6 is a signaling flowchart for explaining a process of remotely connecting a client terminal to a client company server;
FIG. 7 is a system concept diagram illustrating the construction of a customer ICT equipment in a communication service center and providing various additional services; FIG.
8 is a diagram that is referenced to illustrate operations for providing PC and storage support services in a telecommunications service center;
9 is a diagram referred to explain an authentication and dynamic resource allocation method for using a PC farm of a service provider's service center in a customer premise network;
10 is a diagram for explaining an authentication and dynamic resource allocation method for using a storage of a service provider's service center in a customer's premises network.

Hereinafter, embodiments of the present invention will be described in detail with reference to the accompanying drawings, wherein like reference numerals are used to designate identical or similar elements, and redundant description thereof will be omitted. The suffix "module" and " part "for the components used in the following description are given or mixed in consideration of ease of specification, and do not have their own meaning or role. That is, the term 'part' used in the present invention means a hardware component such as software, FPGA or ASIC, and 'part' performs certain roles. However, 'minus' is not limited to software or hardware. The " part " may be configured to reside on an addressable storage medium and may be configured to play back one or more processors. Thus, by way of example, and by no means, the terms " component " or " component " means any combination of components, such as software components, object- oriented software components, class components and task components, Subroutines, segments of program code, drivers, firmware, microcode, circuitry, data, databases, data structures, tables, arrays and variables. The functions provided in the components and parts may be combined into a smaller number of components and parts or further separated into additional components and parts.

In the following description of the embodiments of the present invention, a detailed description of related arts will be omitted when it is determined that the gist of the embodiments disclosed herein may be blurred. It is to be understood that both the foregoing general description and the following detailed description are exemplary and explanatory and are intended to provide further explanation of the invention as claimed. , ≪ / RTI > equivalents, and alternatives.

The present invention proposes a method of providing an intranet service dedicated to security for each customer by expanding a plurality of customer premises networks to a service provider service infrastructure area through a virtual networking technology. More particularly, the present invention proposes an intranet service method and system for forming an independent VLAN communication network between a communication company and a plurality of customers using Port Isolation technology. Also, the present invention proposes an intranet service method and system for remotely accessing ICT equipment by a customer located in a service company center through a wired / wireless connection using VPN technology. In addition, the present invention proposes an intranet service method and system that can provide various additional services by building ICT equipment for each customer in a service company service center.

Hereinafter, various embodiments of the present invention will be described in detail with reference to the drawings.

1 is a diagram for explaining P-VLAN technology applied to an Ethernet switch according to the present invention.

Referring to FIG. 1, an Ethernet switch 100 located in a customer premises network includes a first port 110 connected to a first terminal 115, a second port 120 connected to a second terminal 125, A third port 130 connected to the third terminal 135, a fourth port 140 connected to the fourth terminal 145, and a core switch (or a concentrator switch) 160 located in a communication service center And a fifth port 150 connected through an optical cable.

Private VLAN technology (i.e., Port Isolation technology) is applied to each of the first to fifth ports 110 to 150 so that even if the terminals are accommodated in the same Ethernet switch, each port can be divided into a separate virtual network. Accordingly, even if a terminal connected to a specific port is exposed to a hacking, it is possible to prevent a danger from being transferred to another terminal accommodated in the same Ethernet switch.

Private VLAN technology allows the effective use of a limited number of VLANs per switch. Also, even the same subnet appears to use different VLANs. The private VLAN may be divided into a primary VLAN and a secondary VLAN, and the private VLAN port may be divided into a promiscuous port, an isolated port, and a community port.

The first to fourth terminals 115 to 145 connected to the respective ports of the Ethernet switch 100 individually transmit packets to the core switch 160 located in the communication service center through the fifth port (i.e., the uplink port) Lt; / RTI >

For example, the PC 115 connected to the first port 110 can isolate the printer 145 connected to the fourth port 140 from use, and send the packet only to the fifth port 150 so that only the Internet can be used. . This embodiment can be applied to the case of a PC dedicated to Internet search installed for the convenience of visitors in a store. Since the Port Isolation technology is set at the Ethernet level, the terminal and the network connected to the fourth port 140 can not be searched even if it is searched by a software tool of the IP-SCAN type in the PC 115 connected to the first port 110 .

FIG. 2 is a diagram referred to explain an example of setting an access allow / disable matrix applying Port Isolation technology to the Ethernet switch of FIG.

Referring to FIG. 2, the first port 110 may be isolated from the second to fourth ports 120 to 140, and may be connected to the fifth port 150. Accordingly, the terminal 115 connected to the first port 110 can not access the terminals 125 to 145 connected to the second to fourth ports 120 to 140, and can only use the Internet.

The second port 120 may be isolated from the first and third ports 110 and 130 and may be connected to the fourth and fifth ports 140 and 150. Accordingly, the terminal 125 connected to the second port 120 can not access the terminals 115 and 135 connected to the first and third ports 110 and 130, The connected terminal 145 can be used, and the Internet can be used.

The third port 130 may be isolated from the first port 110, the second port 120 and the fifth port 150 and may be connected to the fourth port 140. The terminal 135 connected to the third port 130 can not access the terminals 115 and 125 connected to the first port 110 and the second port 120 and can not use the Internet Only the terminal 145 connected to the fourth port 140 can use the terminal 145.

The fourth port 140 may be isolated from the first to third ports 110 to 130 and the fifth port 150. Accordingly, the terminal 145 connected to the fourth port 140 is a passive device that receives only a print request from the first to third terminals 115, 125, and 135, and does not permit outbound traffic do.

The fifth port 150 is an Internet connection port or an uplink port, and disallows inbound traffic and blocks access from the outside.

By using Port Isolation technology, it is possible to set an access allow / disable matrix according to the security policy and access policy of a communication company as a port unit of an Ethernet switch.

3 is a system configuration diagram for providing an intranet service according to an embodiment of the present invention.

Referring to FIG. 3, a system 300 for providing an intranet service according to the present invention includes a first Ethernet switch 310 located in a public network of a first customer, a first Ethernet switch 310 located in a public network of a second customer, A core switch 330 located in a communication service center, first and second client servers 340 and 350 connected to the core switch 330, a DHCP server 360, a UTM server 360, A controller 380, an optical cable 390 connecting the first and second Ethernet switches 310 and 320 and the core switch 330, and the like. The system 300 may further include an authentication server, a VPN server, a PC resource management server, and a storage virtualization management server.

The first Ethernet switch 310 includes first to fourth ports 311 to 314 connected to the first to fourth terminals located in the first customer's premises network and a core switch 330 And a fifth port 315 which is connected through an optical cable 390. Private VLAN technology is applied to each port of the first Ethernet switch 310 so that even if the terminal is accommodated in the same Ethernet switch, each port can be divided into a separate virtual network.

The second Ethernet switch 320 includes first to fourth ports 321 to 324 connected to first to fourth terminals located in a second customer's premises network and a core switch 330 And a fifth port 325 connected through an optical cable 390. Likewise, the private VLAN technology is applied to each port of the second Ethernet switch 320, so that even if the terminal is accommodated in the same Ethernet switch, each port can be divided into a separate virtual network. On the other hand, in the present embodiment, for convenience of description, the first and second Ethernet switches include five ports, but the present invention is not limited thereto.

The core switch 330 includes a first port 331 connected to the fifth port 315 of the first Ethernet switch 310, a second port 332 connected to the first client server 340, A third port 333 connected to the fifth port 325 of the switch 320, a fourth port 334 connected to the second client company server 350, and a fifth port 335 connected to the Internet network. . ≪ / RTI >

The first ports R11 and 331 and the second ports R12 and 332 of the core switch 330 may be connected to each other and the third ports R21 and 333 and the fourth ports R22 and 334 may be connected to each other So that they can be connected to each other. Similarly, for convenience of explanation, the core switch includes five ports, but the present invention is not limited thereto.

Private VLAN technology is applied to each port of the core switch 330 so that each port can be divided into a separate virtual network even if the customer equipment is accommodated in the same core switch. Accordingly, even if the first customer's virtual network connected to the specific port is exposed to the hacking, it is possible to prevent the risk from being transferred to the second customer's virtual network accommodated in the same core switch.

The first and second client company servers 340 and 350 are installed in a communication company service center, not in the premises of the first and second customer companies, and can access, manage, and maintain the communication company.

The fifth port 315 of the first Ethernet switch 310 and the first port 331 of the core switch 330 are connected through the optical cable 390 and the first port 331 of the core switch 330 The second port 332 of the core switch 330 is connected to the first client company server 340 so that a single connection is established between the communication company service center and the premises of the first client company. VLAN communication network.

 Likewise, the fifth port 325 of the second Ethernet switch 320 and the third port 333 of the core switch 330 are connected through the optical cable 390, The fourth port 332 and the fourth port 334 are connected to each other and the fourth port 332 of the core switch 330 is connected to the second client company server 350. Thus, To form a single VLAN communication network.

As described above, since the first client company's premises and the second client company's premises network are completely isolated from each other at the Ethernet level, the service provider can receive the intranet service without any information security problem.

A Dynamic Host Configuration Protocol (DHCP) server 360 is connected to the core switch 330 and allocates IP addresses to terminals and devices connected to the VLAN. That is, the DHCP server 360 can assign the same private subnet IP to the first customer's premises terminal (e.g., PC, printer, etc.) and ICT equipment (server, PC farm, storage, etc.). In addition, the DHCP server 360 may assign a private subnet IP that is the same as or different from that of the first client to the second client company's terminal and the ICT equipment.

The Unified Threat Management (UTM) server 370 is connected between the service provider's center and the Internet to provide various security solution functions such as a firewall, intrusion detection system, intrusion prevention system, virtual private network, and database security . In addition, the UTM server 370 may serve as a router or a gateway for connecting different heterogeneous networks (i.e., an internal network of a communication company and an Internet network).

The controller 380 can be connected to the Ethernet switches 310 and 320 or the core switch 330 to perform an overall operation for forming a dedicated network (i.e., a VLAN communication network) have. For example, the controller 380 may configure port isolation for each of the ports of the first and second Ethernet switches 310 and 320. In addition, the controller 380 may provide a Customer VLAN ID (hereinafter, referred to as 'CVLAN ID') to the first and second Ethernet switches 310 and 320.

The controller 380 may set port isolation for each of the ports of the core switches 310 and 320. In addition, the controller 380 may assign a Service Provider VLAN ID (hereinafter referred to as 'SVLAN ID') to the core switch 330. At this time, the controller 380 may be a PC, a notebook computer, a tablet PC, or the like, but is not limited thereto.

Through the intranet service providing system 100, the first and second customers can physically and logically transfer the network service functions and servers existing in the existing premises to the service area of the service provider, Access service and LAN / server management service can be received at the same time.

In particular, when constructing the DHCP server 360 and the UTM server 370 in the SVLAN, the service center of the service provider can grasp all the traffic of the IP devices located in the customer's premises network, Is possible. In addition, SVLAN and CVLAN mapped to the same ID can be used without changing the IP or network configuration of the equipment as they are recognized by the same single LAN communication network to the customer.

4 is a flowchart illustrating a method for providing an intranet service according to an embodiment of the present invention.

4, if there is an intranet service request from the first customer, the controller 380 may establish port isolation with the first Ethernet switch 310 by connecting to the first Ethernet switch 310 installed in the customer company (S410).

That is, the first to fourth ports 311 to 314 are isolated through Port Isolation technology, and only the fifth port 315 is allowed to communicate, so that all the traffic is transmitted to the first And forwarded to the port 331. In another embodiment, in the case of a specific port of the first Ethernet switch 310, the Port Isolation setting may be omitted according to the request of the first customer.

The controller 380 may assign the CVLAN ID to the first Ethernet switch 310 installed in the first customer company according to a predetermined rule (S420). Alternatively, in another embodiment, step 420 may be performed before step 410 is performed.

Thereafter, the controller 380 may establish port isolation in the core switch 330 by connecting to the core switch 330 installed in the service center of the service provider (S430). That is, only the fifth port 335 and the communication between the first port 331 and the second port 332 of the core switch 330 and the remaining ports can be isolated using the Port Isolation technology.

The controller 380 may assign the SVLAN ID to the core switch 330 installed in the service center of the service provider in accordance with predetermined rules (S440). Meanwhile, in another embodiment, step 440 may be performed before step 430 is performed.

The controller 380 may form an independent VLAN communication network between the first client company and the communication company by mapping the SVLAN ID and the CVLAN ID to each other (S450). That is, the fifth port 315 of the first Ethernet switch 310 and the first port 331 of the core switch 330 may be connected to each other through the ID mapping process. The first port 331 of the core switch 330 is connected to the fifth port 315 of the first Ethernet switch 310 through the optical cable 390 and the first port 331 of the core switch 330 is connected to the first port 331 of the core switch 330, The second port 332 of the core switch 330 and the first client company server 340 are connected to each other so that a single connection is established between the communication company service center and the first client company's premises network. VLAN communication network.

The terminals located in the premises of the first client company can perform bidirectional communication with the first client company server 340 located in the communication company service center. In addition, the terminals located in the premises of the first client company can access the Internet via the communication service center.

Meanwhile, if there is an intranet service request from the second customer, the above-described processes may be applied to the second Ethernet switch 320 and the core switch 330 in the same manner.

Even if the second customer company is newly added, since only the VLAN ID is assigned in accordance with the rule, the first customer company and the second customer company are completely isolated at the Ethernet level (i.e., L2), so that the intranet service dedicated to security can be provided from the communication company.

In the above, an intranet service method and system that can form an independent VLAN communication network between a communication company and a plurality of customers using Port Isolation technology have been described. In the following, an intranet service method and system for allowing a customer to remotely access ICT equipment within a communication service center through a wired / wireless connection using authentication technology and VPN technology will be described.

5 is a system configuration diagram for providing an intranet service according to another embodiment of the present invention.

Referring to FIG. 5, a system 500 for providing a customer-specific intranet service according to the present invention includes a first Ethernet switch 510 located in a public network of a first customer, a first Ethernet switch 510 located in a public network of a second customer, 2 Ethernet switch 520, a core switch 530 located in the service center of the service provider, first and second customer ICT equipment 540 and 550 connected to the core switch 530, a DHCP server 560, A VPN server 580, first and second client's remote access terminals 590 and 595 located at a remote location, and the like.

The first Ethernet switch 510 located in the premises of the first customer's office is connected to the core switch 530 located in the communication service center through the optical cable, A single VLAN communication network may be formed between the switch 530 and the first customer ICT equipment 540 between the core switch 530 and the VPN server 580.

Similarly, the second Ethernet switch 520 located in the premises of the second customer company is connected to the core switch 530 located in the communication service center through the optical cable, and is connected between the second customer premises network and the core switch 530 VLAN communication network between the core switch 530 and the VPN server 580 between the core switch 530 and the second customer ICT equipment 550.

1 and 2 may be applied to the first Ethernet switch 510, the second Ethernet switch 520, and the core switch 530. In this case, In addition, the first and second client ICT equipment 540 and 550 may include a server, a storage, and a PC farm allocated to the client company.

The DHCP server 560 is connected to the core switch 530 and allocates an IP address to terminals and devices connected to the VLAN. That is, the DHCP server 560 may assign the same private subnet IP (for example, 192.1.1.0 ~ 255) to the first client's terminal and the ICT equipment 540. In addition, the DHCP server 560 may assign different private subnet IPs (e.g., 172.1.1.0 to 255) to the second customer's terminal and the ICT equipment from the first customer.

The authentication server 570 serves to authenticate whether the device connected to the communication network or the remote terminal is a terminal registered in the first or second client company. At this time, the authentication server 570 may register MAC information, ID information, and the like for the terminals allocated to the first and second client companies.

For example, when a terminal located in a customer premises network accesses a network, the authentication server 570 can check whether MAC information and ID information about the terminal are registered. If the MAC information and the ID information of the corresponding terminal are not registered in the authentication server 570, the DHCP server 560 recognizes the terminal as an unauthorized terminal and does not rent the IP. If it is determined that the MAC information and the ID information of the corresponding terminal are registered in the authentication server 570, the DHCP server 560 recognizes the terminal as an authorized terminal and leases the IP.

A VPN (Virtual Private Network) server 580 provides VPN tunneling or LTE tunneling between the service center and the remote access terminals of the first and second client companies. At this time, the VPN server 580 can encrypt the data before transmitting the data through the public network such as the Internet, and decrypt it at the receiving side.

Through the intranet service providing system 500, the remote access terminals 590 and 595 of the first and second client companies can remotely access the ICT equipment 540 and 550 by the customer in the communication service center by utilizing the VPN technology Can be connected.

6 is a signaling flowchart for explaining a process of remotely accessing a client server by a client terminal.

Referring to FIG. 6, a user working at a remote location can drive an application installed in a client terminal 590 (i.e., VPN software) (S610). At this time, the application may be an application for remotely accessing a client company server located in a service provider's service center. In addition, the application may be provided in advance from the communication company and installed in the customer terminal 590.

The customer terminal 590 may request input of ID information and password information when the application is running (S620). When the ID information and the password information are inputted from the user in step S630, the customer terminal 590 can transmit the VPN connection request signal to the VPN server 580 in step S640. At this time, the VPN connection request signal may include MAC information, ID information, and password information corresponding to the corresponding customer terminal 590.

The VPN server 580 may transmit an authentication request signal including MAC information, ID information, and password information of the client terminal 590 to the authentication server 570 (S650). The authentication server 570 can confirm whether the MAC information and the ID information of the client terminal 590 are registered.

If the MAC information and the ID information of the corresponding terminal 590 are not registered in the authentication server 570, the DHCP server 560 recognizes the client terminal 590 as an unauthorized terminal and rents the IP Do not. If the MAC information and the ID information of the corresponding terminal 590 are registered in the authentication server 570, the DHCP server 560 recognizes the client terminal 590 as an authorization terminal and leases the IP .

The authentication server 570 may transmit an authentication response signal including information on the authentication result to the VPN server 580 (S660). The VPN server 580 may transmit a VPN connection response signal including information on the authentication result to the client terminal 590 (S670). At this time, the authentication response signal and the VPN connection response signal may include IP information allocated to the client terminal 590.

When the terminal authentication fails, the client terminal 590 can provide the user with notification information indicating that the client terminal 590 located at the service provider's service center has no user right to access the server 540.

On the other hand, when the terminal authentication is successful, the client terminal 590 can transmit a signal for creating the VPN tunnel to the VPN server 580 (S680). Accordingly, VPN tunneling or LTE tunneling may be generated between the VPN server 580 and the client terminal 590. [ Generic Routing Encapsulation (GRE), point-to-point tunneling protocol (PPTP), IPIP, IPSec, Layer 2 protocol, etc. may be used for the tunneling.

The remote worker can remotely access the client company server 540 through the client terminal 590 and process the work (690).

As described above, the embodiment of the present invention can provide a security-dedicated L2 intranet service by configuring a wired / wireless virtual LAN between a customer premises network, a customer ICT equipment, and a remote access terminal.

In the foregoing, an intranet service method and system for allowing remote access to ICT equipment in each customer service center via a wired / wireless connection using VPN technology have been described. In the following, an intranet service method and system for providing various additional services by constructing ICT equipment for each customer in a communication service center will be described.

7 is a conceptual diagram of a system for providing various supplementary services by building customer ICT equipment at a communication service center.

Referring to FIG. 7, a communication company can provide a variety of additional services by constructing a PC, a storage, and a server to support an intranet service by a customer in a separate data center (or a communication service center). At this time, an independent VLAN communication network can be formed between the communication company and a large number of customers through the virtual networking technology.

The service provider can provide the PC support service by constructing the PC main body which is located in the existing network of the customer in the communication service center. Accordingly, since there is only a monitor and a decoder device (that is, a KVM set-top box) in the customer's premises network, the business environment of the customer is simplified, and the customer does not need to perform PC management and PC update directly.

In addition, the service provider can provide storage support services by establishing the storage that was located in the existing customer premises in the communication service center. Because the customer network is composed of a Layer 2 network, it is possible to use storage such as NFS (network file system) and iSCSI (Internet Small Computer System Interface).

In addition, a telecom company can provide a server support service by constructing a server located in a public network of a customer in a telecom service center. This eliminates the need for the customer to maintain and manage the large capacity server.

In addition, the communication company can provide a management service for efficiently managing the VLAN information of each customer, the MAC information of the ICT equipment by the customer, the traffic information, the alarm of failure, and the log information.

In addition, when the customer is a main-branch type customer, the communication company can provide a link service between the main-branch office by constructing a separate virtual private network (Multi-Protocol Label Switching).

In other words, a VLAN communication network is configured between the headquarters of a customer company and a service provider center of a region A through a leased line, and a VLAN communication network is configured by a leased line between a customer company's branch office and a communication company service center of the D region. (MPLS), it is possible to establish a secure communication network between the customer's main office and branch office.

8 is a diagram referred to explain an operation of providing a PC and a storage support service in a service provider service center.

8, when a PC farm 850 and a storage 860 are installed in a communication company service center, a keyboard 810, a mouse 820, a video monitor 830, and a KVM set- A box 840 may be provided.

The PC farm 850 of the service company center can transmit a video image of the PC to the KVM set-top box 840 of the customer's premises network using protocols such as RDP (Remote Desktop Protocol) and PCoIP (PC over Internet Protocol). At this time, the PC palm 850 can encode and transmit a video image of the PC using a separate encoder. The KVM set-top box 840 can decode the video screen of the PC and output it to the video monitor 830.

A WOL (Wake On LAN) function that is available only in the Layer 2 network can be implemented between the KVM set-top box 840 and the PC farm 850. That is, when the KVM set-top box 840 is powered on, a WOL packet is automatically transmitted from the KVM set-top box 840 to the PC farm 850 to power on the PC farm 850.

A storage packet using a protocol such as NFS or iSCSI can be transmitted between the KVM set-top box 840 and the storage 860. Because the customer network is composed of Layer 2 network, it is possible to access the storage packet much faster and securely.

9 is a diagram for explaining an authentication and dynamic resource allocation method for using a PC farm of a service provider's service center in a customer's premises network.

9, the first customer premises network includes a first Ethernet switch 910, a plurality of KVM set-top boxes 911 connected to the first Ethernet switch 910, and a plurality of video monitors 913 .

The second customer premises network may include a plurality of KVM set-top boxes 921 and a plurality of video monitors 923 connected to the second Ethernet switch 920 and the second Ethernet switch 920.

The third customer premises network may include a plurality of KVM set-top boxes 931 and a plurality of video monitors 933 connected to the third Ethernet switch 930 and the third Ethernet switch 930.

The carrier service center may include a core switch 940, an authentication server 950, a PC resource management server 960, and a PC farm 970. Meanwhile, the service center of the communication service company may include various devices in addition to the above-mentioned devices, but the description of the devices which are not directly related to the embodiment of the present invention will be omitted.

The first to third Ethernet switches 910 to 930 located in the first to third customer premises networks are connected to the core switch 940 of the communication service center through an optical cable, An independent VLAN communication network can be configured between the centers.

When a user at a specific customer enters ID information and password information after turning on the KVM set-top boxes 911, 921 and 931, the KVM set-top boxes 911, 921 and 931 transmit ID information and password information, And CVLAN information assigned to the customer can be transmitted to the core switch 940 of the service center.

The authentication server 950 may perform a user authentication procedure using at least one of the information (ID information, password information, terminal MAC information, and CVLAN information) transmitted from the core switch 940. [

When the user authentication fails, the authentication server 950 can transmit to the KVM set-top boxes 911, 921, and 931 notification information indicating that the authority to use the PC farm does not exist. On the other hand, upon successful user authentication, the authentication server 950 can transmit a resource allocation request signal to the PC resource management server 970. At this time, the resource allocation request signal may include the CVLAN information.

The PC resource management server 970 can allocate idle PC resources of the PC farm 970 to the corresponding customer based on the CVLAN information. Thereafter, when the KVM set-top boxes 911, 921, and 931 are powered off, the PC resource management server 970 can convert the PC resources allocated to the corresponding customer into the idle state.

10 is a diagram for explaining an authentication and dynamic resource allocation method for using a storage of a service provider's service center in a customer's premises network.

10, the first customer premises network includes a first Ethernet switch 1010, a plurality of KVM set-top boxes 1011 connected to the first Ethernet switch 1010, and a plurality of video monitors 1013 .

The second customer premises network may include a plurality of KVM set-top boxes 1021 and a plurality of video monitors 1023 connected to the second Ethernet switch 1020 and the second Ethernet switch 1020.

The third customer premises network may include a plurality of KVM set-top boxes 1031 and a plurality of video monitors 1033 connected to the third Ethernet switch 1030 and the third Ethernet switch 1030.

The carrier service center may include a core switch 1040, an authentication server 1050, a storage virtualization management server 1060, and a storage 1070. Meanwhile, the service center of the communication service company may include various devices in addition to the above-mentioned devices, but the description of the devices which are not directly related to the embodiment of the present invention will be omitted.

The first to third Ethernet switches 1010 to 1030 located in the first to third customer premises networks are connected to the core switch 1040 of the communication service center through the optical cable, An independent VLAN communication network can be configured between the centers.

When a user working at a specific customer enters ID information and password information after powering on the KVM set top boxes 1011, 1021 and 1031 or the customer premises terminal (not shown), the KVM set top boxes 1011, 1021 and 1031 or The customer premises terminal can transmit the ID information and the password information, the terminal MAC information, the CVLAN information given to the customer, and the like to the core switch 1040 of the communication service center.

The authentication server 1050 can perform a user authentication procedure using at least one of the information (ID information, password information, terminal MAC information, and CVLAN information) transmitted from the core switch 1040.

When the user authentication fails, the authentication server 1050 can transmit to the KVM set top boxes 1011, 1021, and 1031 or the customer premises terminal notification information indicating that the right to use the storage does not exist. On the other hand, when the user authentication is successful, the authentication server 1050 can transmit a resource allocation request signal to the storage virtualization management server 970. At this time, the resource allocation request signal may include the CVLAN information.

The storage virtualization management server 1070 can map a storage cluster allocated to the customer based on the CVLAN information. Accordingly, the user can utilize the network and storage resources allocated solely for himself / herself.

Thereafter, when the customer closes the storage related service, the storage virtualization management server 1070 can manage the network and storage resources allocated to the customer as idle resources.

The present invention described above can be embodied as computer-readable codes on a medium on which a program is recorded. The computer readable medium includes all kinds of recording devices in which data that can be read by a computer system is stored. Examples of the computer readable medium include a hard disk drive (HDD), a solid state disk (SSD), a silicon disk drive (SDD), a ROM, a RAM, a CD-ROM, a magnetic tape, a floppy disk, , And may also be implemented in the form of a carrier wave (e.g., transmission over the Internet). Also, the computer may include a control unit 180 of the terminal. Accordingly, the above description should not be construed in a limiting sense in all respects and should be considered illustrative. The scope of the present invention should be determined by rational interpretation of the appended claims, and all changes within the scope of equivalents of the present invention are included in the scope of the present invention.

300: Intranet service system 310: First Ethernet switch
320: second Ethernet switch 330: core switch
340: first client company server 350: second client company server
360: DHCP server 370: UTM server
380: controller 390: dedicated optical cable

Claims (18)

Setting a port isolation to an Ethernet switch located in a customer's premises network and a core switch located in a communication service center;
Setting first VLAN ID information for identifying a customer in the Ethernet switch;
Setting second VLAN ID information for identifying a service provider to the core switch; And
And mapping the first VLAN ID information and the second VLAN ID information to each other to form a VLAN (Virtual Local Area Network) communication network between the customer premises network and the service company service center. The method according to claim 1,
And a dedicated optical cable is connected between the Ethernet switch and the core switch. The method according to claim 1,
Wherein a virtual network is formed between ICT equipment of a customer located in the service company center and terminals on the premises connected to the Ethernet switch when the ICT equipment of the customer is connected to the core switch. Service delivery method. The method of claim 3,
Wherein the ICT equipment of the customer includes at least one of a PC farm, a storage, and a customer-specific server. The method of claim 3,
Further comprising the step of assigning an IP address to the ICT equipment of the customer and the terminals of the premise equipment when a Dynamic Host Configuration Protocol (DHCP) server is connected to the core switch. The method of claim 3,
Further comprising the step of remotely accessing the ICT equipment of the customer using the terminal outside the customer premises network when an authentication server and a VPN (Virtual Private Network) server are connected to the core switch. 7. The method of claim 6,
Authenticating whether the terminal is an authorized terminal based on ID information and password information input from a user; And
And generating a VPN tunnel between the VPN server and the terminal upon successful authentication of the terminal. The method according to claim 1,
Further comprising the step of providing a security solution function for protecting the VLAN communication network when a Unified Threat Management (UTM) server is connected between the communication service center and the Internet network. The method according to claim 1,
And allocating idle resources of the PC farm based on the first VLAN ID information transmitted from the customer premises terminal when the PC resource management server is connected to the core switch. The method according to claim 1,
And allocating an idle cluster of the storage based on the first VLAN ID information transmitted from the customer premises terminal when the storage virtualization management server is connected to the core switch. 2. The method of claim 1, wherein if the customer is a customer in the form of a main-branch,
Configuring a VLAN communication network through a dedicated line between the headquarters of the customer company and a service company service center of the first area;
Configuring a VLAN communication network through a leased line between a branch office of the customer company and a service company service center of a second region; And
Further comprising the step of constructing a dedicated network between service centers of respective regional telecommunication companies nationwide. A plurality of Ethernet switches located in a plurality of customer premises networks;
A core switch disposed at a communication service center and connected to the plurality of Ethernet switches through a dedicated optical cable; And
Sets Port Isolation to the Ethernet switches and the core switch, sets first VLAN ID information for identifying a customer in the plurality of Ethernet switches, and provides second VLAN ID information for identifying a service provider A controller for establishing a virtual local area network (VLAN) communication network between the plurality of client premises networks and the service provider service center by mapping the first VLAN ID information and the second VLAN ID information to the core switch, And an intranet service providing system. 13. The method of claim 12,
And an ICT (Information Communication Technology) equipment located at the service center of the service provider and connected to the core switch. 14. The method of claim 13,
And a Dynamic Host Configuration Protocol (DHCP) server connected to the core switch and allocating an IP address to ICT equipment located in the communication service center and ICT equipment in the plurality of customer premises networks An intranet service providing system. 13. The method of claim 12,
An authentication server for authenticating the terminal when the terminal outside the customer premises network accesses the service company service center; And
And a VPN server for creating a VPN tunnel between the communication service center and the terminal when the terminal authentication is successful. 13. The method of claim 12,
Further comprising a Unified Threat Management (UTM) server connected between the communication service center and the Internet network to provide a security solution function for protecting the VLAN communication network. 13. The method of claim 12,
And a PC resource management server connected to the core switch and allocating idle resources of the PC farm based on the first VLAN ID information transmitted from each customer premises terminal. 13. The method of claim 12,
And a storage virtualization management server connected to the core switch and allocating an idle cluster of the storage based on the first VLAN ID information transmitted from each customer premises terminal.

Images