TW200901679A - Network redundancy system and processing method therefor - Google Patents

Abstract

A network redundancy system is disclosed. A router of a transmitter detects that the primary line is off-line and transmits an access point name of a subscriber identity module card to a 3G network. The 3G network identifies the name and introduces the IP route of the transmitter to the MPLS network, creating an IPSec tunnel to introduce the traffic from the transmitter to the tunnel. A first network device of the MPLS network looks up a routing table and IP routing information corresponding to the tunnel, attaches a VPN label and an MPLS label to a package from the transmitter, and transmits the package to the MPLS network. A second network device of the MPLS network detects a belonging network of the package, removes the labels from the package, and transmits the package to the IP network of a receiver.

Description

The invention relates to a network communication system, and particularly to a virtual private network (VPN) network backup system and Approach. [Prior Art] "Virtual Private Network (VPN)" is the most popular mode of operation in network applications in recent years, because it uses public networks to replace the regional network of private lines. Significantly reduce the cost of construction and increase the convenience of future expansion. A general VPN can be divided into a customer premises-based (Customer Premises Equipment (CPE)-based) VPN and a network-based VPN. The former is mainly used by the enterprise user terminal to utilize the technologies of Layer 2 Tunneling Protoco (L2TP) or Internet Protocol Security (IPSec) for its own equipment. Establishing a virtual private channel across the public network with a remote CPE-based VPN device is the most common VPN solution today. The latter is a VPN service that is directly provided by a network service provider (Service Providers, SP for short). At present, the technology used in CPE-based VPN can be divided into Layer 2 PPTP or L2TP tunneling technology, and Layer 3 IPsec technology. Because these VPN technologies are all encapsulated through IP

Client's Docket No. : N/A TT's Docket No : 0695-A41231-TW / Draft-Final/Alex Chen 6 200901679 The type of transmission is therefore also collectively referred to as the ΙΡ-VPN technology. In addition, due to the rapid growth of the Internet, the use of the Internet Protocol (Internet Protocol, 简称ρ) network for the development of the United States is increasing the number of applications, enterprises use the Internet to build enterprises The demand for the intranet is also increasing. The network is based on ^, the address is the basis for transmitting packets. However, in the traditional packet transmission process, each node device must repeat the header I of the checked packet to resolve the __ path until it reaches the destination, so the larger the network, the more efficient the transmission will be. Poor, will not meet the needs of future high-speed and large-scale transmission of Internet. Multi-ProvGt(10)1 Label Switehing, (4) technology is the best choice to meet the requirements of the (four) requirements and is compatible with =. Figure 1 shows the architecture of the vpN system using the dial-up connection to provide backup services. The 2A~2C diagram shows the workflow diagram of the VPN backup system using the dial-up connection ^ for the backup service. +Shengli, the network backup (4) the transmission end of the towel and all the computers of Wei Duan To the same 'but mainly based on the computer equipment on the transmission side and the network media used to illustrate the implementation process'. The operation process of the computer equipment on the receiving end is explained separately. 'The dial-up connection includes the integrated service digital network ( Integmed se_es

Dlgltal Network (referred to as ISDN) and public telephone network (p Fully Switched Telephone Network, referred to as pSTN). ISDN is a combination of integrated (lmegrated), service (s-), digital (Dlgltal) and network (Nefk), which will provide various information and communication.

Client's Docket No. : N/A TT's Docket No : 0695-A41231-TW/Draft-Final/Alex Chen 7 200901679 The pipeline is integrated into a common network, allowing users to enjoy voice and data simultaneously using a pair of telephone lines. Diversified digital communication services such as video and video, and the inconvenience of continuously converting data between analog and digital types can be eliminated, thus greatly increasing the technology of the telephone line digit (four) transmission speed. The principle of PSTN (ie, general telephone and mobile phone) is to convert the computer's .1 and 1# digital data into an analog sound similar to the human audio range by means of a modem (MODEM), and then connect to the indoor telephone network through a general-purpose telephone network. The data machine of another computer restores the sound to digital data in the opposite way. 0 The first picture is signed, and the host 11 of the transmitting end A (Tran_A) passes the asynchronous digital user line data machine (Asymmetric Digital).

Subscriber Line, abbreviated as ADSL), the connection path of the data machine 13 to the remote receiving end B (Rec_Β) is the main line, and the host 110 of the transmitting end a is connected to the remote end via the dialing data machine 140. The line connection of terminal B is the backup line. Referring to FIG. 1 and FIG. 2A, first, in the transmitting terminal A, a router 120 connected to the host 110 detects an Ethernet wide area network (wide area network ' that connects the ADSL modem 130 to the Ethernet (Ethernet). Referred to as WAN) interface is open (up, that is, the connection is normal), then via PSTN 150 and asynchronous transfer mode (Asynchr〇n〇us

Transfer Mode 'abbreviated as ATM) Network 16 Detect (ping) MPLS Network (VPN) 170 uses the broadband edge access server (Br〇adband Remote Access Server, BRAS for short) to set the edge of the supplier The ιρ address of the device (Provider Edge Device 'abbreviated as ρΕ) 17ι.

Client's Docket No. : N/A TT's Docket No : 0695-A41231-TW / Draft-Final / Alex Chen 200901679 It should be noted that 'ADSL modem 13〇 must use Bridge Mode to detect the condition of the entire line. . Atm is an advanced packet switching technology that can be applied to both regional and wide area networks. The transmission speed per second can theoretically reach 1.2 Gbps, but in practice it can only reach 155 Mbps. The ATM network 160 and the MPLS network 170 can be connected by the Asynchronous Transfer Mode-1 (STM-1). The routing state 120 commands its ip stack to send an Internet Control Message Protocol (ICMP) echo request (Echo) request to the BRAS PE 171, and then waits for the ICMP Echo response. When the IP stack of router 120 receives an ICMP Echo response, it indicates that BRAS PE 171 is functioning properly and reachable. After determining that the line of the ADSL modem 130 of the primary line is normal, the router 120 directs the traffic of the local area network (LAN) to the ADSL modem 130. The BRAS PE 171 queries the virtual path identification (Virtual Channel Identification, VPI for short) and the Virtual Routing Identification (VCI) virtual routing forwarding (Table). After routing information for VFR and its IP, the packet is tagged with a VPN label and an MPLS label and transmitted to the MPLS network 170. VRF refers to the place where each VPN client stores its own enterprise IP routing information in MPLS VPN. MPLS belongs to the third generation network architecture and is a new generation of ip high-speed backbone.

Client's Docket No. : N/A TT's Docket No : 0695-A41231-TW / Draft-Final / Alex Chen 200901679 Network Exchange Standard, by Internet Engineering Task Force (mTF), 3Com, etc. The network device is large_dominant. The operation principle of the pLS is to provide each IP packet-label, thereby determining the path and priority of the packet. With the MPLS phase (4), the packet H is forwarded to its path and only read. The packet label does not need to read the Ip address and header of each packet, so the network speed is much faster, and the transmitted packet is classified by the quality of service (Quality 〇f Sendee's QoS) (5) mechanism. , in turn, greatly improve the quality of network services and provide more diverse services. MPLS VPN is a technology that uses νρΝ tags to distinguish packets of different enterprise networks in an MPLS network. Next, the packet is transmitted in the MPLS network no, and the PE 175 of the MpLS network 170 queries the VpN to which the packet belongs, removes the VPN signature in the packet, and then transmits the 5 packet to the network of the receiving end b. Then, the PE 175 checks the VRF of the private line of the transmitting end A and its IPP routing resource, and puts the vpN tag and the MpLS tag on the packet from the receiving port B, and then transmits the packet to the MPLS network. The BRAS pE 171 queries the VPN to which the packet belongs, removes the vpN tag in the packet, and then transmits the packet to the IP network of the transmitting end A, thus completing the packet transmission between the transmitting end A and the receiving end B. Referring to FIG. 1 and FIGS. 2B and 2C, when the router 12 detects that the Ethernet (WAN) connection of the ADSL modem 130 is disconnected, the data modem is driven to dial the number. PSTN 15〇, at this time, the data machine H0 and psTN 15 are being exchanged.

Client’s Docket No, : N/A TT’s Docket No : 0695-A41231-TW / Draft-Final / Alex Chen 10 200901679 (Handshake) Dial-up speed. After the dialing operation of the data machine 140 is completed, the account password of the transmitting end A (i.e., the client) is transmitted to the MPLS network 170 via the PSTN 150 to utilize the remote access server (Remote).

The PE 173 set by the Access Server ‘short for rAs is authenticated. The PSTN 150 and the MPLS network 170 are connected by a PrimaTy Rate Interface (PRI) T1 line (PRI-T1). After the authentication is successful, RASPE 173 transmits the account password to its Remote Authentication Dial-In User Service (Radius) server (not shown) for authentication, and then the protocol is set by the mobile host. A (Dynamic Host Configuration Protocol, abbreviated as DHCP) server (not shown) specifies an ip address to the router 120 of the transmitting end A. After the IP address is specified, the router 120 imports the network traffic of the back-end area network into the Point-to-Point Protocol (PPP) channel of the dialer (not shown) of the data machine 140. At the same time, RAS PE 173 transfers the routing information of the transmitting end A to the VRF of the receiving end B. Next, the RASPE 173 queries the VRF and routing table of the transmitting end A according to the PPP channel of the dialer (not shown), and puts the packet from the dialer (not shown) with the VPN label and the MPLS label, and then forwards the packet into the packet. MPLS network 170. The packet is transmitted in the MPLS network 170, and the PE 175 queries the VPN to which the packet belongs, removes the VPN label in the packet, and then transmits the packet to the IP network of the receiving end B.

Next, the PE 175 queries the VRF to which the network private line transmitting the packet belongs.

Client's Docket No. : N/A TT's Docket No : 0695-A41231-TW / Draft-Final/Alex Chen 11 200901679 with the routing table 'Put the VPN tag and MPLS label on the packet from the receiving end B, and then send the packet to In the MPLS network 170. RAS PE (IPsec ΡΕ) Π3 queries the VPN to which the packet belongs according to IPSec, removes the VPN label of the packet and then transmits the packet to the PPP channel of the dialer (not shown) of the transmitting end a.

As mentioned above, the traditional VPN backup line uses the specification psTN or ISDN. The way to detect the main line disconnection is as follows. The detected main line must be directly connected to the CPE device by a physical circuit (such as a 'dedicated line'). It can only determine whether the physical signal is disconnected. Therefore, the connected ADSL must be a module of the ADSL data machine built in the CPE device. Because the external ADSL modem usually has one RJ-11 port connected to the telephone line of the telecommunications company, the other port is the Ethernet interface, and the Ethernet line is connected. On the CPE, if the line connected to cpe is disconnected' but the WAN interface of the Ethernet is not disconnected, the CPE device cannot detect whether the external ADSL modem is disconnected. In addition, it takes more than 90 seconds to detect the main line disconnection and switch backup. In summary, the shortcomings of the current VPN backup system are as follows. With ISDN or dial-up (PSTN) network backup, the bandwidth of the main line of the central office is not flexible enough. Only the T1 or E1 lines can be used for each extended bandwidth. The number of customers that can be dialed in is limited' where T1 allows up to 23 channels to be dialed in at the same time, and one channel is used by one client. Heterogeneous network backup cannot be achieved, that is, the main line and the backup line must use the physical telephone line of the same telecommunications company. The client backup bandwidth is up to 128k, which will cause bottlenecks in future use. Backup

Client’s Docket No. : N/A TT's Docket No : 0695-A41231-TW / Draft-Final / Alex Chen 12 200901679 ISDN or dial-up billing is not good. Therefore, the present invention provides a VPN network backup system and a processing method thereof. SUMMARY OF THE INVENTION Based on the above objectives, an embodiment of the present invention discloses a method for processing a network backup system. One of the transmitters detects that a primary line is disconnected. Dialing to a wireless base station by a wireless router and a wireless network card, and transmitting the access point name of the subscriber identity card in the wireless network card to the wireless network. After the authentication point name is authenticated, the IP route of the transmitting end is turned on to an intermediate network. The transmitting end establishes a secure channel with the intermediate network, wherein the secure channel is represented as a backup dedicated line. The router imports the network traffic of the transmitting end into the secure channel. The first network device (IPsec PE) of the intermediary network queries a routing table (VRF) and IP routing information corresponding to the secure channel, and transmits a first packet to the first network via the secure channel ( A VPN) tag and a first intermediate (MPLS) tag, and the first packet is transferred into the intermediate network. The second network device of the intermediary network queries the network to which the first packet belongs, removes the network label in the first packet, and transmits the first packet to an IP network of a receiving end. The embodiment of the invention further discloses a network backup system, comprising: a receiving end, a wireless network, an intermediate network and a transmitting end. The intermediary network further includes a first network device and a second network device. The transmitting end further includes a router, a wireless router and a wireless network card. The router detects that a primary line is disconnected. The wireless router and wireless network card

Client's Docket No. : N/A TT's Docket No * 0695-A41231-TW / Draft-Fina]/Alex Chen 13 200901679 Dials to a wireless base station when the primary line is disconnected and transmits the wireless network The access point name of the subscriber identity card in the card is given to the wireless network. After authenticating the access point name, the wireless network conducts the IP route of the transmitting end to an intermediary network to establish a secure channel between the transmitting end and the intermediate network, wherein the secure channel is represented as a backup device. Aid line. The r router imports the network traffic of the transmitting end into the secure channel. The first network device queries a routing table and IP routing information corresponding to one of the secure channels, and transmits a first packet (a label and a first intermediate label) to the first packet transmitted through the secure channel, and the The first packet is transmitted into the intermediate network. The second network device queries the network to which the first packet belongs, removes the network label in the first packet, and transmits the first packet to a receiving end. [Embodiment] In order to make the objects, features, and advantages of the present invention more comprehensible, the preferred embodiments are described below, and in conjunction with the accompanying drawings, Figures 3 through 6, The description of the present invention is provided to illustrate the technical features of the various embodiments of the present invention. The configuration of the various elements in the embodiments is for illustrative purposes, and is not intended to limit the present invention. The present invention is directed to a network backup system and a processing method thereof for the purpose of simplifying the description. VPN network backup system using a series of cases of third-generation mobile communication system (3fd Generation, referred to as 3G) to provide enterprise customers

Client's Docket No. · N/A TT5s Docket No : 0695-A41231-TW / Draft-Final / Alex Chen 14 200901679 Fixed-line (eg ADSL) backup applications and mainline applications. 3G is a new generation communication technology that combines multimedia communication with the Internet and Wireless Network. 3G technology can support the processing of images, music, multimedia formats, and provide a variety of information services such as web page browsing, e-commerce (e-Commerce, E (?), multi-party online meeting (v〇ice c〇nfer?nce) · 'And provide 2Mbps, 384kbps and 144kbps data transmission rate. Figure 3 shows 3G network (Wideband Code Division Multiple Access (WCDMA) / Universal Mobile Telecommunications (Universal Mobile Telecommunications) Schematic diagram of Systems 'referred to as UMTS). 3G network mainly includes the following components. Gateway integrated packet radio service support node (Gateway General

Packet Radio Service (GPRS) Support Node (referred to as GGSN), which is responsible for a gateway between the 3G network and the external IP network. The Serving GPRS Support Node (SGSN) is responsible for recording which users are in the service area. If the user transmits the data belonging to the packet, the data of the packet is transmitted to the SGSN by the BSC, and the SGSN performs the exchange and transmission of the packet. The Mobile Switching Center (MSC) is responsible for the control of voice handoff (Hand-Off) and roaming (Roaming). Home Location Register (Home Location Register, referred to as

Client's Docket No. · N/A TT's Docket No : 0695-A41231-TW / Draft-Final / Alex Chen 15 200901679 HLR) 'The device that stores user data. Each user will belong to the exclusive HLR. When the mobile phone's ip address is statically configured, the IP address used is stored in the HLR. Visiting the 'Visitor Location Register (VLR)' is all the current data in the MSC management area, and a VLR can also be used by multiple MSCs at the same time. Each time the user enters a new location area (LA), a registration action is performed on the VLR owned by the new area MSC, and the current location information in the original HLR is updated. In order to facilitate the access of the user's telephone, the HLR can find the location of the MSC where the user is currently located, and then transfer the telephone connection to the MSC where the current user is located for subsequent actions. s End of the Center (Authoration Center, AUC for short), its main job is to authenticate users in the mobile communication network. The radio network controller (Radio Network Controller, RNC for short) is the base station controller (Base Station)

Controller' is simply referred to as BSC). An RNC connects to a number of base stations (BTS) at the same time. The area where the RNC and BTS are located constitutes a service area of the Global Mobile Communication System (Gi〇bai SyStern for Mobile Communication, GSM for short) network. To manage wireless bandwidth resources. Node B (Node B), which is called the BTS under the GSM architecture, accepts the user interface (User Equipment, UE for short).

Client’s Docket No. : N/A TT^sDocketNo : 0695-A41231-TW / Draft-Final/Alex Chen 16 200901679 Mobile phone connection is the so-called mobile base station (Μ. Station, referred to as MS). The operation process of the 3G network is a related technology, and the network backup system of the embodiment of the present invention only uses the 3G network to achieve heterogeneous backup = purpose, so the following is not a separate 3G network. The operational process is clear. Fig. 4 is a block diagram showing the architecture of a network backup system using 3G to provide backup services according to an embodiment of the present invention. The 5A~5D diagram shows the workflow of using the 3G long: network backup system for backup services. In the network backup system of the embodiment of the present invention, the transmitting end is substantially the same as the receiving end, but mainly based on the computer device on the transmitting end and the network media used. The flow of the computer equipment at the receiving end is not described otherwise. Referring to FIG. 4, the host path 41 of the transmitting end a (Tran_A) is connected to the remote receiving end b (Rec_B) via the ADSL modem 430 as the main line 'and the host 410 of the transmitting end A via the host 410 The connection path between the 3G router 441 and the 3G network 450 connected to the remote receiving end B is a backup line.

Referring to FIG. 4 and FIG. 5A, first, in the transmitting end A, a router 420 connected to the host 410 detects the BRAS PE 471 in the MPLS network (VPN) 470 via the ATM network 4. The IP address is used to detect whether the line of the ADSL modem 430 of the main line is normal (Up or Down). It is pinged every 3 seconds, and it is judged to be normal if a response is received within 1 second. Need / think, ADSL

Client’s Docket No· : N/A TT's Docket No : 0695^A41231-TW / Draft-Final/Alex Chen 200901679 The data machine 130 must use the Bridge Mode to check the condition of the entire line. The ATM network 460 and the MPLS network 470 can be connected by STM-1. When the router 420 detects (Ping) the IP address of the BRAS PE 471 and judges that the line of the ADSL modem 430 is normal, the IP stack is commanded.

I (Stack) send: an ICMP Echo request to BRAS PE 47;!, and then wait for ICMP Echo to respond. When the IP stack of router 120 receives an ICMP Echo response, it indicates that BRAS PE 471 is functioning properly and reachable. After determining that the line of the ADSL data machine 430 of the main line is normal, the router 420 directs the traffic of the back-end LAN to the ADSL modem 430 〇BRAS PE471 to query the VPI of the ADSL modem 430 of the transmitting end A and the VRF to which the VCI belongs. After the EP routing information, the packet is marked with a VPN label and an MPLS label and transmitted to the MPLS network 470. The packet is transmitted in the MPLS network 470. The PE 475 of the MPLS network 470 queries the VPN label of the packet to remove the VPN label from the packet, and then transmits the packet to the IP network of the receiving end B. Next, the PE 475 queries the VRF of the private line of the transmitting end A and its IP routing information, and puts a VPN label and an MPLS label on the packet from the receiving end B, and then transmits the packet to the MPLS network 470. The BRAS PE 471 queries the VPN to which the packet belongs, removes the VPN label in the packet, and then transmits the packet to the IP network of the transmitting end A, thus completing the packet transmission between the transmitting end A and the receiving end B. Referring to FIG. 4 and FIG. 5B to FIG. 5D, when the router 42 (M) pings the IP address of the BRAS 471, and judges the line of the ADSL modem 430.

Client's Docket No. : N/A TT's Docket No : 0695-A41231-TW/Draft-Final/Alex Chen 200901679 When it is off (Down), the routing information of the main line is deleted, and the routing information of the backup line is selected. At this time, the 3G router 441 performs PPP dialing through the 3G network card 443 including the Subscriber Identity Module (SIM) Card to connect with the 3G base station 445. The access point name of the user identification card sent by the 3G router 441 (Access Point t

Name, referred to as: ΑΡΝ) to the 3G network 450. After the 3G network 450 is authenticated by the AUC, the HLR specifies the IP address to the transmitting end A (ie, the client), and then the IP routing is conducted to the MPLS network by the GGSN, so that the router 420 starts to prepare IPsec with the IPsecPB 473. Tunnel (Tunnel), that is, the establishment of a backup line. The 3G network 450 and the MPLS network 470 can be connected by a fiber to a building (Fiber Ding The Building, FTTB for short) or a dedicated line (Lease Line). First, establish the IPsec of the first phase (Phase 1), that is, establish a secure channel (Security Association, SA for short) of the Internet Key Exchange (IKE) to provide the second channel. The parameters of the phase (Phase 2) are used interchangeably. It is important to note that the IKE protocol is the mechanism by which IPsec SAs negotiate a protection suite and exchange signatures or encryption keys. IKE defines how the two parties communicate policy information and how they build and exchange authentication messages. IKE is a protocol that is a mixture of three other protocols, ISAKMP (Internet Security Association and Tiddle Management Protocol), Oakley, and SKEME. IKE uses two phases of ISAKMP. Phase 1 (Phase 1), negotiate to create a communication channel (IKE SA), and verify the channel to provide confidentiality, message integrity, and message for further IKE communication between the two parties.

Client’s Docket No. : N/A TT's Docket No : 0695-A41231-TW / Draft-Final / Alex Chen 19 200901679 Source Verification Service. In the second phase (Phase 2), an ipsec SA is established using the established ι SA. The related technical content of IKE SA and ipsec is a conventional technology, and therefore will not be described again. The network backup system of the embodiment of the present invention achieves the desired purpose by using IKE SA and IP sec. Next, the router 420 transmits the host name (Host Name) of the transmitting end A (ie, the client) and the pre-shared key (Preshared Key) to the IPsec PE 473 via the 3G road register 441 for authentication. By using the Encapsulating Security Payload (ESP) mode of ipsec, it is not affected by the Network Address Translation (NAT) function of the 3G router 441. Next, the IPsec PE 4 transmits the key of the Phasel SA to the router 420, and the router 420 exchanges the parameters of the IPsec SA through the IKE SA secure channel of Phase 1 to establish IPsec Phase 2. The router 420 then uses the gold record of Phasel SA to encrypt the record of the Phase 2 SA and related parameters (for example, ESP, Data Encryption Standard (DES), Message-Digest Algorithm 5 (referred to as Message-Digest Algorithm 5). For MD5), Diffie-Hellman (DH) Group2 (1024 bits), etc., then pass the Phase2SA key and related parameters to IPsec PE 473. The IPsec PE 473 verifies the parameters and, after verification, responds with a confirmation message to the router 420 and, based on the IPsec channel to which it belongs, transfers the path to the corresponding client-specific VRF. Next, after the IPsec tunnel is established, the router 420 imports the traffic of the back-end LAN into the IPsec tunnel. At this time, IPsec PE 473 queries the private one according to the IPsec channel of the transmitting end A.

Client's Docket No. : N/A TT's Docket No ; 0695-A41231-TW / Draft-Final / Alex Chen 20 200901679 VRF and its IP routing information, the packets from the IPsec channel are marked with VPN tags and MPLS labels and transmitted to the MPLS network. 47 〇. The packet is transmitted in the MPLS network 470. The PE 475 of the MPLS network 47 queries the VPN to which the packet belongs, removes the VPN ladder in the packet, and then transmits the s packet to the network of the receiving end B. Next, the PE 475 queries the vrf and the IP routing information of the private line of the transmitting end A, and puts the VPN label and the MPLS label on the packet from the receiving end B, and then transmits the packet to the MPLS network 470. Ipsec PE 473 queries the VPN to which the packet belongs, removes the VPN label in the packet, and then transmits the packet to the IPsec channel of the transmitting end A, thereby transmitting it to the IP network of the transmitting end A, thus completing the main line disconnection. In the case of a line, the purpose of transmitting a packet between the transmitting end A and the receiving end B via the backup line. The reason why the backup path of the network backup system of the embodiment of the present invention uses the I p S e C technology is as follows. Using IPsec channel mode, the client can route information on multiple network segments and directly connect to the MPLS VPN network through the 3G network architecture. This allows the 3G network partner to manage the client routing information. In addition, it can be enhanced. 3G wireless network security. The following is a brief description of the technology of IPSec connection. The IPSec connection is divided into two logical phases, Phase 1 and Phase 2. In Phase 1, an IPSec node initiates a connection to the remote node. The remote node checks the trustworthiness of the node, and then both parties determine the way to authenticate for this connection. The Exchange Mode includes Aggressive Mode and Main Mode, which can reduce the load when setting IPSec connection between multiple hosts at the same time. set

Client's Docket No. : N/A TT's Docket No : 0695-A41231-TW/Draft-Final/Alex Chen 21 200901679 The identification method (my_identifier) used by the node to authenticate is based on the host name or IP address. The host name management is relatively simple, and it is not necessary to plan the use of the IP network segment for the client network. Initial Connection Definition The Authentication Method adopted between nodes includes the use of Preshared Gold Recording or RS+ Public Input. The use of Preshared Keys is safe and fast. No complex authentication methods need to be established. The Encryption Algorithm used in the authentication process includes DES or 3DES, where DES encryption and decryption is faster. The hash algorithm used between nodes includes MD5 or SHA1, which uses MD5 faster. The Diffie-Hellman key used in the stage of establishing the dynamic key is DH Group 2 (1024 bits). In Phase 2, when SA is established between nodes, the SA database is built using some setting information (for example, encryption method, parameters of secret exchange key, etc.). This phase is responsible for managing the actual IPSec connections to the remote nodes and the network. The hashing algorithms supported by the authentication process include HMAC-MD5 or HMAC-SHA1, where MD5 is faster. Encryption methods include DES or 3DES, where DES encryption and decryption is faster. The Diffie-Hellman record length used in the stage of creating a dynamic record is DH group 2 (1024 bits). The security protocol used includes ESP Mode or AH Mode, in which ESP Mode can be used to traverse the NAT device of the client, and the scalability is superior. The packet format includes a tunnel mode (Tunnei Mode) or a transmission mode (Transparent Mode). Use IPsec channel mode to enable client multi-network segment routing information to directly penetrate the 3G network architecture and connect to our MPLS VPN network, so that 3G network partners do not

Client’s Docket No,: N/A TT's Docket No : 0695-A41231-TW / Draft-Final / Alex Chen 22 200901679 The problem of managing client routing information. Fig. 6 is a flow chart showing the steps of the processing method of the network backup system according to the embodiment of the present invention.

First, a transmitting end detects that a main line is in a disconnected state (step S601), and dials a 3G network to a 3G base station by a 3G router (step S602), and transmits the 3G network. The access point name (APN) of the subscriber identity card in the card is given to the 3G network (step S603). After authenticating the access point name (APN) of the subscriber identity card, the 3G network conducts the IP route of the transmitter to an MPLS network (step S604). Then, the transmitting end establishes an IPSec channel with the MPLS network (step S606), and then imports the network traffic (Traffic) into the IPsec channel (step S607). The IPSec channel is represented as a backup line.

Next, the IPsec PE of the MPLS network queries the VRF and IP routing information dedicated to the IPsec channel (step S608), tags the packet transmitted through the IPsec tunnel with the VPN label and the MPLS label, and transmits the packet into the MPLS network. Medium (step S69). The packet is transmitted in the MPLS network, and the PE of the MPLS network queries the VPN to which the packet belongs (step S610), removes the VPN label in the packet (step S611), and then transmits the packet to an IP network of the receiving end. (Step S612). Then, the PE of the MPLS network queries the VRF and the IP routing information of the private line of the transmitting end (step S613), puts a VPN label and an MPLS label on the packet from the receiving end, and then transmits the packet to the MPLS network. Medium (step S614). The IPsec PE of the MPLS network queries the VPN to which the packet belongs (step S615), and removes the VPN in the packet.

Client's Docket No. : N/A TT's Docket No : 0695-A41231-TW / Draft-Final / Alex Chen 23 200901679 ^Iron (step S616) 'The packet is then transferred to the IPsec channel of the transmitter A' and transmitted In the IP network to the transmission terminal A (step S617), 7L is used for the purpose of transmitting the packet between the transmission terminal A and the reception terminal b via the backup line in the case where the main line is disconnected. In the embodiment of the present invention, the acceptable line specification of the cpE of the vpN 3G backup is ADSL (external ADSL modem) or FTTB. The specification of the backup line is either 3.5G. The way the CPE detects the main line disconnection is as follows. The main line physical circuit does not need to be directly connected to the CPE equipment, so the telephone line of the telecommunication company can be connected to the RJ-11 connection port on the external ADSL data machine. 'Another Rj_45 connection is connected to the Ethernet (Ethernet) The wiring is connected to the Ethernet interface of the CPE device. The Ethernet WAN interface must be set to 〇> address, and the WAN IP address must be set on the BRAS of the ADSL office and must belong to the same network segment as the WAN IP address of the client. The general ADSL (Bridge Mode) connection method does not set the WAN IP address on the BRAS, but only provides an initial Gateway IP address. The connection method is as follows: PC-ADSL data machine (Bridge Mode) ) —DSLAM—BRAS. The WAN IP address is set on the CPE and BRAS in this case. The connection method is as follows: PC-CPE-ADSL Data Mode (Bridge Mode)-DSLAM-BRAS. In addition, detecting whether the main line is disconnected or the network quality is poor is judged based on the condition of the Ping BRAS WAN IP address, and the time required to detect the main line disconnection and switch the backup is 30 seconds.

Client's Docket No. : N/A TT's Docket No : 0695-A4123 l-TW / Draft-Final / Alex Chen 24 200901679 Compared with the traditional VPN backup system, the backup rate of the present invention is based on 3G wireless network preparation. Shake, A protects the details of the system, knows the use of r Bureau * line bandwidth expansion is very flexible, can allow access to the number of households more than the number of parents (ipsec through the use of customers - channel) can be built / inside The number of channels should be one, fixed network and different access media), Erda, heterogeneous network backup (using different 384/fi4v customers know that the backup bandwidth has a future (3G frequency is 384/64k or 384/) 128k, 3 sr stickers* '

The MPG of 3.5G is 3.6M/128k), and the billing method of 3G is flexible. It can be billed, and the amount of time is used for billing, and the amount of time is used.

It takes less time to change the 3G backup route. In addition, the VPN 3 backup server uses the μ ^ ^ ώ x-h At application to detect the main line disconnection switching function, 3G connection function, and network security design.彳 叫 叫 路由 路由 路由 路由 路由 路由 路由 路由 路由 路由 路由 路由 路由 路由 路由 路由 路由 路由 路由 路由 路由 路由 路由 路由 路由 路由 路由 路由 路由 路由 路由 路由 路由 路由 路由 路由 路由 路由 路由 路由 路由 路由 路由 路由 路由 路由 路由 路由 路由 路由 路由 路由 路由When the network is restored, it changes back to the main line. In terms of 3G connection function, it has a function of calling number, which can plan a specific APN to the VPN provider, and ask the 3G network to issue a fixed IP address to the customer. In addition, the device will automatically re-dial (Auto-Reconnection) if it encounters a 3G network transient. In the case of multi-segment routing through 3G network functions, 3〇 network providers do not need to manage client routing data. In terms of network security design, the 3G network and the Internet are completely separated from each other. 'Establishing IPsec channel to protect data through 3G network security, and when Inter-mobile delay occurs' can prevent VPN customers from being on 3G network. Intercommunication is on the road.

Client's Docket No. : N/A TT's Docket No : 0695-A41231-TW / Draft-Final / Alex Chen 25 200901679 The present invention further provides a recording medium (such as a disc, a floppy disk, a removable hard disk, etc.), It records a computer-readable permission sign-off program to perform the above-mentioned network backup system processing method. Here, the permission signing program stored on the recording medium is basically composed of a plurality of code segments (for example, creating an organization chart code segment, signing a form tr code segment, setting a code segment, and deploying) The code segment), and the function of these code segments corresponds to the steps of the above method and the functional block diagram of the above system. While the present invention has been described above by way of a preferred embodiment, it is not intended to limit the invention, and the present invention may be modified and modified without departing from the spirit and scope of the invention. The scope of protection is subject to the definition of the scope of the patent application. [Simple description of the diagram] Figure 1 shows the architecture of the VPN backup system that provides backup services using dial-up connections. The 2A~2C diagram shows the workflow of the VPN backup system that provides the backup service by using the dial-up connection. Figure 3 is a schematic diagram showing the architecture of a 3G network (WCDMA/UMTS). Figure 4 is a block diagram showing the architecture of a network backup system using 3G to provide backup services according to an embodiment of the present invention. The 5A~5D diagram shows the workflow of the network backup system using 3G to provide backup services. Figure 6 is a diagram showing the processing side of the network backup system of the embodiment of the present invention.

Client's Docket No. N/A TT5s Docket No : 0695-A41231-TW / Draft-Final/Alex Chen 26 200901679 Step flow of the method. [Main component symbol description] 110~host 120~router '130~ADSL data machine' 140~data machine 15 0~public telephone network 160~asynchronous transmission mode network 170~multiple protocol label switching network 171~wideband remote Supplier edge device 17 3 to the remote access server vendor edge device 175 ~ supplier edge device 410 ~ host 420 ~ router 430 ~ ADSL data machine 441 ~ 3G router 443 ~ 3G network card 450 ~3G network 4 6 0~ asynchronous transfer mode network 470~multi-protocol label switching network 4 71~ wideband remote access server vendor edge device 4 7 3~ internet communication protocol security supply Merchant edge device 475 ~ supplier edge device AUC ~ certification center

Client's Docket No. : N/A TT^ Docket No : 0695-A41231-TW / Draft-Final / Alex Chen 27 200901679 BTS ~ Base Station EIR ~ Device Identification Register GGSN ~ Gateway Integration Packet Radio Service Support Node GMSC ~ Mobile switching center gateway GSM BSS ~ Global mobile communication system base station system t HLR ~ original location logger MSC ~ mobile switching center

Node B ~ Node B PDN ~ Public Data Network PSTN ~ Public Telephone Network RNC ~ Radio Network Controller S G S N ~ Service Integration Packet Radio Service Support Node T R A U ~ Transfer Code and Rate Adapter Unit VLR ~ Visit Location Register

Client’s Docket No. : N/A TT5s Docket No : 0695-A41231-TW / Draft-Final/Alex Chen 28

Claims (1)

200901679, the scope of application for patents: ^--------------------------------------------------------------------- The road card dials to - the wireless base wireless ^ the access point name of the subscriber identity card in the wireless network card is given to the one: ί: the point name is authenticated, and the 1P route of the transmitting end is turned on to the edge phase establishment and The security channel between the Internet is represented as a backup line; = the network traffic of the transmitting end is channeled into the secure channel; μ mediation network - the network is set to p security Channel - routing table (v bar and 1? routing information ί - should be transmitted via the secure channel one of the first (VPN) standard # and a gentleman, beat a brother a network ... titanium weaving and - an intermediary (MPLS) tag, and the first packet is transmitted into the intermediary network, and the person is in the intermediary network - 锢玖π供太# network; "―,,,罔路汉备查_ the first packet belongs to the removal of the net road sign in the first packet; and will be ° The first packet is transmitted to the IP network of the receiving end. 2. As for the method of applying for the patent garden, it further includes the following steps: the processing of the network backup system described in the page «Haizhong" The network device queries the backup client's Docket No. of the transmitting end: N/A TT, sDocketNo ·· 0695_A4123]_TW/D眺Fina]/A]^ 29 200901679 routing table and IP routing information belonging to the private line; The second packet from the receiving end is tagged with the second network road sign and the second and second media tags, and then the second packet is transmitted to the mediation network; "Hai intermediary network of the first network device Querying the network to which the second packet belongs; t removing the second network label in the second packet; and ',, transmitting the second packet to the secure channel of the transmitting end, thereby transmitting to the 3. The method of processing the network backup system according to the application of the patent specification, wherein the authentication operation further comprises the following steps: the wireless network by the authentication center (AUC) authentication for this access; w recognition After completion, an IP address is assigned to the transmitting end by a home location register (HLR); and, by means of the gateway integrated packet radio service support node (ggsn), the IP route of the transmitting end is forwarded to the intermediate network. 4. The processing method of the network backup system described in the patent application scope item, wherein the operation of establishing the secure channel further comprises the following steps: establishing a network of the first phase (Phase丨) The communication protocol security (IPsec), and constructs a secure channel of the Internet Key Exchange (ικε) security association (SA); the host name and the pre-key of the transmitting end are transmitted to the [via] via the wireless router [ The network device performs (4); ..., the first network device transmits the security association corresponding to the first phase Client's Docket No. : N/A TT-s Docket No : 〇695-A41231-TW / Draft-Final/Alex Chen 30 200901679 (Phasel SA) - the first - Jin Yu to the router; the number six ^ route the 1M SA secure channel for the SA parameter parent change to establish - the second phase (phase2), ·. Phase safety Union (Phasel (4) SA'V = secret security of the second phase · ( Ph-2 _ brother - one key and complex encryption parameters; , prepared; A - money and the # encryption parameters are transmitted to the first - Network setting = the first, the material δ backup to verify the parameters, and H - confirmation message to the router, · Α 雉 雉 口 应 应 应 根据 根据 根据 根据 根据 根据 根据 根据 根据 根据 根据 根据 根据 根据 根据 根据 根据 根据The routing table is specific to the transmitting end. Fang, the application of the network backup system described in the first paragraph of the patent scope, the router, by the pinging (ping) the rabbit frequency in the intermediary network, the server is connected to the server The IP address of the edge device PE) '(four) _ whether the main line is disconnected. 6=In the processing of the network backup system described in item i of the patent application scope, / , /, the secure channel is an IpSec channel. 7, 7, for example, the processing of the network backup system described in the first application of the patent scope /, in the middle of the network " network is a multi-protocol label switching (mpls) network. y,, & the processing method of the network backup system as described in item 1 of the scope of the patent application: wherein the 'the first network device is the lpsee provider edge device (PE) 〇mal/Alex Chen Client's Docket No, : n/A TT's Docket No : 0695-A41231-TW / Draft-Fi 31 200901679 9 · The processing method of the network backup system described in the first application of the patent scope, Gan. The road label is a virtual private network (VPN) label. 10. The processing method of the network backup system according to claim 1, wherein the mediation tag is an MpLS tag. n. The processing method of the network backup system described in claim 1 of the patent scope, wherein the Guzhanyi, the Qidiyi-罔road device is a supplier edge device (ρε). The processing method of the network backup system according to claim 1, wherein the wireless network is a 3G network. 13. A network backup system, comprising: a receiving end; a wireless network; an intermediate network, further comprising: - a first network device; and - a second network device; and a transmitting end, It also includes: The six main lines are the main line is broken - ϋ ^ ήΚ 1%., mouth - ... line router and - wireless network card, lightly connected to the two to Dial the line to the -I 2 base station: and transmit the subscriber identity card in the wireless network card: pick up the point name for the wireless network; , where 'the wireless network is at the access point Conducted to an intermediary network to establish a good mountain to the transit road - An (four) road, its material table tr-mt network Wei from the transmitter to the network traffic into the security ^ special line Client's Docket No. : N/A TT's Docket No : OePS^^Sl-TW/Draft-Fmal/AlexChen 32 200901679 The first routing information 1 device check should be in the full channel - road shirt and IP, and will The first packet is transmitted into the network, and the first packet is transmitted through the first channel.轼 and a first intermediary label is inserted into the intermediary network; and 0 hai, the first - 'network device query the first packet of the first packet of the first packet of the package to remove the network And transmitting the first-: packet to the network backup system as described in claim 13 of the patent application scope, which is prepared for the routing information of the backup line to which the transmission end belongs. In the network tag from the receiving end and _筮__ by the younger brother _, ^ brother one; f private wear, and then the second packet is transmitted to S Hai; 丨 network; and ~ The first network device queries the network to which the second packet belongs, removes the 4th network label 'in the packet of the younger brother' and transmits the second packet to the heart of the beta transmission. The network backup system according to claim 13, wherein the wireless network authenticates the access point name by a certification center, after the authentication is completed, An original location register specifies an address to the transmitting end' and is integrated by the gateway. The packet radio service support node ((5) calls the ip route of the transmitting end to the intermediate network. 16. The network backup system described in claim 13 of the patent scope, /:, Client's Docket No. : N /A TT's Docket No : 〇695-A41231-TW / Draft-Final/Alex Cher 33 200901679 The router establishes the first phase (Phase 1) Internet Protocol Security (IPsec) and constructs an Internet Gold Key exchange (IKE) security association (SA) security channel, the host name of the transmitting end and the pre-shared key are transmitted to the first network device for authentication via the wireless router; J!: the first network The road device transmits a first key corresponding to the first phase of the security association (Phasel SA) to the router; the router performs parameter exchange of the IPsec SA via the IKE SA secure channel to establish a second phase (Phase2) Encrypting the second key and the complex encryption parameter of the second phase of the security association (Phase2 SA) by using the first key of the first phase security association (Phasel SA), and two Keys and the encryption parameters are transmitted to the first network device; and the first network device verifies the parameters and, after the verification is correct, responds to an acknowledgement message to the router, and according to the secure channel to which the transmitter belongs The packet routing path is transferred to the routing table dedicated to the transmitting end. 17. The network backup system according to claim 13, wherein the router pings the intermediary network. One of the roads is remotely connected to the IP address of the vendor's edge device (BRAS PE) of the server to determine whether the primary line is disconnected. 18. The network backup system of claim 13, wherein the secure channel is an IPSec channel. 19. In the network backup system described in claim 13, the client's Docket No.: N/A TT's Docket No: 0695-A41231-TW / Draft-Final/Alex Chen 34 200901679 The road is a multiple protocol label switching (MPLS) network. 20. The network backup system of claim 13, wherein the first network device is an IPsec provider edge device (PE). 21. The network backup system of claim 13, wherein the network tag is a virtual private network (VPN) tag. T 22. The network backup system described in claim 13 of the patent scope, wherein the intermediary label is an MPLS label. 23. The network backup system of claim 13, wherein the second network device is a 'provider edge device (PE). 24. The network backup system of claim 13, wherein the wireless network is a 3G network. Client’s Docket No. : N/A TT's Docket No : 0695-A41231-TW / Draft-Final/Alex Chen 35