WO1998011699A1

WO1998011699A1 - Data transferring process

Info

Publication number: WO1998011699A1
Application number: PCT/AT1997/000195
Authority: WO
Inventors: Johann Pfeiffer
Original assignee: Ericsson Austria Aktiengesellschaft
Priority date: 1996-09-09
Filing date: 1997-09-09
Publication date: 1998-03-19
Also published as: JP2001500683A; AT406320B; AU4289897A; EP0923831A1; ATA159196A; CA2265588A1

Abstract

The invention concerns a procedure to transfer wideband data from a large number or peripheral subscribers to a long-range communication network, for instance, Internet, through two or several two-wire cables allocated to each subscriber. The data of the peripheral subscribers who are arranged in a media access layer (MAC) is sent to a central switching unit (ROUTER) which is arranged in a network layer and through which the subscribers are linked to a long-range communication network, for instance, Internet. The data sent by the subscribers is subdivided into data packages and routed successively through the individually allocated two-wire cables and through a central LAN, for instance, at least one central node distributor (HUB), the addressing of each data package being checked respectively at the central and/or peripheral bridge (4, 7, 40, 70). A data package will be transmitted through the central node distributor(s) (HUB) (2, 20) to the central switching unit(s) (ROUTER) (1, 10) only when an allocation of the subscriber (9, 11, 13, 90) and the central switching unit (ROUTER) (1, 10) has been unequivocally verified.

Description

Data transmission method

The invention relates to a method for data transmission of data from a plurality of peripheral subscribers via two or more two-wire lines assigned to them to a wide area network, e.g. Internet, preferably simultaneously with analog signals, such as POTS or the like. or digital telephone services such as ISDN, whereby the data from the peripheral subscribers arranged in a media access layer (MAC), which are at least partially combined in one or more local area networks (LAN), into which connection point (MAC) destination and source addresses are assigned, to one in one Network layer arranged, central switching unit (ROUTER) are sent, via which the subscriber with a wide area network, for example Internet, can be connected, the data sent by the participants, divided into data packets, one after the other, each via the assigned two-wire line and via a central LAN, e.g. at least one central node distributor (HUB), in which the data streams of the data transmitted via the two-wire lines are combined, are routed to the central switching unit (ROUTER) and the data forwarding and filtering in the media access layer (MAC) are arranged at the ends of each two-wire line , central and peripheral data bridges is carried out, the data packets each comprising the connection point (MAC) destination and source address and a wide area network protocol packet with protocol source address.

Furthermore, the invention relates to a method for data transmission of data from a wide area network, e.g. Internet, to a plurality of peripheral subscribers via two or more two-wire lines assigned to them, preferably simultaneously with analog signals such as POTS or the like or digital telephone services such as ISDN, the Data from the wide area network from a switching unit (ROUTER) arranged in a network layer to the peripheral subscribers arranged in a media access layer (MAC), which are at least partially combined in one or more local area networks (LAN), into which connection point (MAC) target and source addresses are assigned, are sent, the data sent from the wide area network, divided into data packets, successively via the central switching unit (ROUTER) and via a central LAN, for example at least one central node distributor (HUB), in which the data streams are transmitted via the two-wire lines n transmitted data are summarized, and are each routed via the two-wire line assigned to the subscriber and to the subscriber, and the data forwarding and filtering in the media access layer (MAC) is carried out in central and peripheral data bridges arranged at the ends of each two-wire line, the Data packets each the connection point (MAC) target and Source address, include a wide area network protocol packet with protocol source address.

Known methods of this type have the advantage of a much higher transmission rate (up to 512 kbit / s), for example for Internet access, compared to comparable transmission methods with a modem (28,800 bit / s) or with ISDN (64 kbit / s) on the other hand, there is the serious disadvantage that security against unauthorized access to data or improper circumvention of the central switching unit is not guaranteed.

The object of the invention is therefore to provide a data transmission method which offers a high transmission rate with high data security.

According to the invention, this is achieved in a method mentioned at the outset for the transmission of data from peripheral subscribers to a wide area network in that the addressing of each data packet is checked in each case in the central and / or peripheral bridge, and in that a data packet is only then via the central LAN, e.g. the at least one central node distributor (HUB) is forwarded to the central switching unit (ROUTER) when a clear assignment of subscriber and central switching unit (ROUTER) is established.

As a result, only direct data traffic between peripheral subscribers and the central switching unit is permitted and other side routes are excluded. This can on the one hand prevent another subscriber from gaining unauthorized access to the data of other subscribers and, on the other hand, make it impossible for a subscriber to bypass the fee clearing house accommodated in the central switching unit. The direct data traffic between the individual participants in the central LAN is therefore prohibited by the function of the bridge according to the invention.

In a further embodiment of the invention it can be provided that a forwarding to the central switching unit (ROUTER) is carried out either when the connection point (MAC) destination address corresponds to the address of the central switching unit (ROUTER) and the wide area network protocol (IP protocol) packet corresponds to the protocol of the central switching unit (ROUTER) and the wide area network protocol (IP protocol) source address is a valid one

Wide area network protocol address of the peripheral subscriber for the assigned two-wire line or when the connection point (MAC) destination address is BROADCAST and the connection point (MAC) source address is different from the central switching unit (ROUTER).

These measures make it possible to restrict the data traffic in a simple manner so that circumvention of the central switching center is avoided. BROADCAST means sending a data packet from a data source to all receiving stations regardless of their actual address. NOT BROADCAST is the logical reversal of BROADCAST, synonymous with the absence of BROADCAST.

Furthermore, the above-mentioned object is achieved according to the invention in a method of the type mentioned at the outset for transmitting data between a wide area network and peripheral subscribers in that the addressing of each data packet is checked in each case in the central and / or peripheral bridge, and in that a data packet only then is forwarded to the subscriber if a clear assignment of the central switching unit (ROUTER) and subscriber is established.

As a result, only direct data traffic between the central switching unit and a peripheral subscriber is permitted and other side routes are excluded. This can prevent the data coming from the Internet from being assigned to a wrong subscriber.

In a further embodiment of the invention, it can be provided that the data packet is forwarded from the central switching unit to a subscriber, either when the connection point (MAC) destination address is NOT BROADCAST and the connection point (MAC) source address of the address of the central switching unit (ROUTER) corresponds and and the wide area network protocol (IP protocol) packet corresponds to the protocol of the central switching unit (ROUTER) and the wide area network protocol (IP protocol) destination address is a valid one

The peripheral subscriber's wide area network protocol address for the associated two-wire line is, or if the destination point (MAC) destination address is BROADCAST and the destination point (MAC) source address is the same as the address of the central switching unit (ROUTER).

These measures make it possible to restrict the data traffic in a simple manner so that circumvention of the central switching center is avoided.

In a further embodiment of the invention, it can be provided that the data forwarding or filtering of the central and peripheral bridges is set via a protocol that is different from the protocol of the media access layer, preferably via a separate interface.

As a result, the bridge manager cannot be reached by the subscriber using the MAC protocol, which means that bypassing the central switching unit can be prevented even more reliably.

The invention is explained in detail below using an exemplary embodiment. It shows

Fig.l is a block diagram of an arrangement for performing the data transmission method according to the invention and

2 shows a block diagram for a further embodiment according to the invention. The block diagram shown in FIG. 1 shows an arrangement for data transmission of data from two peripheral subscribers 90 to the Internet 95 via two two-wire lines 12 assigned to them. The subscribers 90 arranged in a media access layer MAC, which are generally to be regarded as data sources of any kind, such as a PC device, are combined in a local area network LAN, in which connection point (MAC) destination and source addresses are assigned for the data traffic. The data transmission takes place in one direction to a central switching unit ROUTER 10 which is arranged in a switching layer and which establishes a connection to the wide area network 95, in this example the Internet.

The data sent by the subscribers 90 and subdivided into data packets are successively routed in each case via the assigned two-wire line 12 to a central LAN, which is designed as a node distributor HUB 20 in which the data streams of the two two-wire lines 12 are combined in a star shape, and then to the router 10 forwarded. The data forwarding and filtering is carried out in the media access layer (MAC) in central and peripheral data bridges 40, 70 respectively arranged at the ends of each two-wire line 12, the data packets in each case the connection point (MAC) destination and source address and a wide area network protocol packet with protocol source address. So that the bypassing of the router 10 is avoided or a data flow between the subscribers 90 can take place via the node 20 without using the router 10, the invention provides that the addressing of each data packet is checked in each case in the central and / or peripheral bridge 40, 70 and that a data packet is only forwarded to the router 10 via the central node distributor HUB 20 if a clear assignment of subscriber 90 and ROUTER 10 is found. Forwarding to the central switching unit 10 is only carried out either when the connection point (MAC) destination address corresponds to the address of the central switching unit 10 and the wide area network protocol (IP protocol) packet corresponds to the protocol of the central switching unit 10 and the wide area network protocol (IP -Protocol) -source address a valid one

Wide area network protocol address of the peripheral subscriber 90 for the associated two-wire line 12 or when the connection point (MAC) destination address is BROADCAST and the connection point (MAC) source address is a different one from the central switching unit ROUTER 10.

BROADCAST means sending a data packet from a data source to all receiving stations regardless of their actual address. NOT BROADCAST is the logical inverse of BROADCAST, synonymous with the absence of BROADCAST.

In the opposite direction, data traffic should also be subject to such control. The addressing of the data packet stream, which is routed from the Internet 95 via the router 10 and via the HUB 20 to the bridges 40, 70, is checked and it is determined whether there is a clear assignment of ROUTER and subscriber. Only at; only when If the result of the check is positive, the data packet is forwarded by bridges 40 and 70, respectively.

The addressing check is carried out in such a way that the data packet is forwarded from the central switching unit 10 to a subscriber 90 only when the connection point (MAC) destination address is NOT BROADCAST and the connection point (MAC) source address of the address corresponds to the central switching unit 10 and and the wide area network protocol (IP protocol) packet corresponds to the protocol of the central switching unit (ROUTER) and the wide area network protocol (IP protocol) destination address is a valid one

Wide area network protocol address of peripheral subscriber 90 for the associated two-wire line, or when the connection point (MAC) destination address is BROADCAST and the connection point (MAC) source address is equal to the address of central switching unit 10.

As a further security measure against unauthorized manipulation of the data transmission, provision can be made for the data forwarding or filtering of the central and peripheral bridges 40, 70 to be set via a protocol different from the protocol of the media access layer (MAC), preferably via a separate interface 42, 72 . As a result, it is not possible for a subscriber to influence the bridges within the protocol known to him.

The exemplary embodiment shown in FIG. 2 includes a large number of subscribers 9, 11, 13, which represent data output and input units and obtain data from a wide area network 95, which in this example is represented by the Internet, or send it via this. The peripheral participants can be organized in individual local networks such as Token Ring, Ethernet or the like. The nature of the local network is not subject to any restrictions. In FIG. 2, the subscribers 9 are arranged in an Ethernet configuration, which are connected in a star shape to a distributor (HUB) 8, which is connected to a remote bridge 7 at its output. Likewise, subscribers 10 and 11 are combined in an Ethernet, any number of subscribers being connectable in each network. However, nodes without a local network can also be connected directly to a remote bridge. The remote bridges 7 serve to couple the subscribers to a two-wire transmission line 12, via which the data can be transmitted bidirectionally and symmetrically at a transmission rate of, for example, up to 512 kbit / s. However, the type of data or the transmission mode used are not subject to any restrictions within the scope of the invention. In this exemplary embodiment, the normal telephone lines are used as the two-wire line 12, but any other two-wire or multi-wire transmission lines can be used as desired. The transmitted digital data is superimposed on the analog or digital standard telephone services such as POTS or ISDN. For this purpose, a splitter filter 5, 5 'is provided at the ends of the two-wire line 12, which separates the telephone baseband signals from the broadband data signals. The telephone subscribers 6 can therefore conduct unimpeded calls at the same time as data transmission without mutual interference.

As a counterpart to each remote bridge 7, a central bridge 4 is provided at the other end of the two-wire line 12. All central bridges 4 are brought together in a star shape in a central distributor HUB 2, which is connected at its output to the input of a central router 1, which establishes the connection to the Internet.

The security measures already given for the exemplary embodiment of FIG. 1 are reproduced below in abbreviated form, as can be represented in a logical sequence.

One arriving from the Internet via the central switching unit at bridge 4, 7

Data packet is transmitted to a peripheral subscriber 9, 1 1, 13 if either

[the MAC destination address is NOT BROADCAST] AND

[the MAC source address is ROUTER] AND

[IP Protocol packet] AND

[the destination IP address is a valid IP address of the LAN for the assigned two-wire line]

or

[the MAC destination address is BROADCAST] AND [the MAC source address is ROUTER].

A data packet sent by a peripheral subscriber 9, 11, 13 towards the Internet is checked for its addressing at the bridge 4, 7 and then forwarded to the central switching unit 1 if either

[the MAC destination address is ROUTER] AND

[IP protocol package] AND

[the IP source address is a valid IP address of the LAN of the assigned two-wire line]

or

[the MAC destination address is BROADCAST] AND [the MAC source address is NOT ROUTER] For the exemplary embodiment according to FIG. 2 there is also the possibility of providing a further data backup by using, as in the exemplary embodiment according to FIG. 1, a different MAC protocol than the one known to the participants for access to the bridges 4, 7, and that the bridge manager is accessible via a specially trained interface.

Claims

PATENT CLAIMS

1. Method for data transmission of data from a plurality of peripheral users via two or more two-wire lines assigned to them to a wide area network, e.g. Internet, preferably simultaneously with analog signals, such as POTS or the like. or digital telephone services such as ISDN, whereby the data from the peripheral subscribers arranged in a media access layer (MAC), which are at least partially combined in one or more local area networks (LAN), into which connection point (MAC) destination and source addresses are assigned, to one in one Network layer arranged, central switching unit (ROUTER) are sent, via which the subscriber with a wide area network, for example Internet, can be connected, the data sent by the participants, divided into data packets, one after the other, each via the assigned two-wire line and via a central LAN, e.g. at least one central node distributor (HUB), in which the data streams of the data transmitted over the two-wire lines are combined, are routed to the central switching unit (ROUTER) and the data forwarding and filtering in the media access layer (MAC) are arranged at the ends of each two-wire line , central and peripheral data bridges is carried out, the data packets each comprising the connection point (MAC) destination and source address and a wide area network protocol packet with protocol source address, characterized in that the addressing of each data packet in each case in the central and / or peripheral bridge (4, 7, 40, 70) is checked, and that a data packet only then via the central LAN, for example the at least one central node distributor (HUB) (2, 20) is forwarded to the central switching unit (ROUTER) (1, 10) if there is a clear assignment of subscribers (9, 11, 13, 90) and central switching unit (ROUTER) ( 1, 10) is determined.

2. The method according to claim 1, characterized in that a forwarding to the central switching unit (ROUTER) (1, 10) is carried out either when the connection point (MAC) destination address corresponds to the address of the central switching unit (ROUTER) (1, 10) and the wide area network protocol (IP protocol) packet corresponds to the protocol of the central switching unit (ROUTER) and the wide area network protocol (IP protocol) source address is a valid wide area network protocol address of the peripheral subscriber (9, 1 1, 13, 90) for the assigned two-wire line (12) or if the connection point (MAC) destination address is BROADCAST and the connection point (MAC) source address is a different one from the central switching unit (ROUTER).

3. Method for data transmission of data from a wide area network, e.g. Internet, to a large number of peripheral users via two or more two-wire lines assigned to them, preferably simultaneously with analog signals, such as POTS or the like. or digital telephone services such as ISDN, the data from the wide area network from a switching unit (ROUTER) arranged in a network layer to the peripheral subscribers arranged in a media access layer (MAC), which are at least partially combined in one or more local area networks (LAN), in which connection point (MAC ) - Destination and source addresses are assigned, are sent, the data sent from the wide area network, divided into data packets, successively via the central switching unit (ROUTER) and via a central LAN, for example at least one central node distributor (HUB), in which the Data streams of the data transmitted over the two-wire lines are combined, and are each routed to the subscriber via the two-wire line assigned to the subscriber, and the data forwarding and filtering in the media access layer (MAC) in central and peripheral data bridges arranged at the ends of each two-wire line n is carried out, the data packets each comprising the connection point (MAC) destination and source address and a wide area network protocol packet with protocol source address, characterized in that the addressing of each data packet in each case in the central and / or peripheral bridge (4, 7 , 40, 70) is checked and that a data packet is only forwarded to the subscriber (9, 1 1, 13, 90) if there is a clear assignment of the central switching unit (ROUTER) (1, 10) and subscriber (9, 11 , 13, 90) is determined.

4. The method according to claim 3, characterized in that a forwarding of the data packet from the central switching unit (ROUTER) (1, 10) to a subscriber (9, 1 1, 13, 90) is carried out either when the connection point (MAC ) Destination address is NOT BROADCAST and the connection point (MAC) source address corresponds to the address of the central switching unit (ROUTER) (1, 10) and and the wide area network protocol (IP protocol) packet corresponds to the protocol of the central switching unit (ROUTER) and the wide area network protocol (IP protocol) - destination address is a valid wide area network protocol address of the peripheral subscriber (9, 11, 13, 90) for the assigned two-wire line or if the connection point (MAC) - destination address is BROADCAST and the connection point (MAC) source address is the same the address of the central switching unit (ROUTER) (1, 10).

5. The method according to any one of claims 1 to 4, characterized in that the data forwarding or filtering of the central and peripheral bridges (4, 7, 40, 70) on a protocol different from the protocol of the media access layer (MAC) is set, preferably via a separate interface (42, 72).