WO2004030306A1

WO2004030306A1 - Protocol selection method for transmitting data packets

Info

Publication number: WO2004030306A1
Application number: PCT/DE2003/002579
Authority: WO
Inventors: Norbert Schönfeld; Gonzalo Lucioni
Original assignee: Siemens Aktiengesellschaft
Priority date: 2002-09-25
Filing date: 2003-07-31
Publication date: 2004-04-08
Also published as: DE10244710A1

Abstract

The invention relates to a method for carrying out an application-specific protocol selection for transmitting data packets involving the use of a packet-oriented network based on a common access method and of a network element (PC), which is connected to the packet-oriented network while provided with an address that is uniquely allocated only within the network. A verification is carried out for an ensuing transmit access of the network element (PC) to the packet-oriented network. This verification requests the transmit access from the application (A1) that is running in the network element (PC) and determines a communications protocol for the transmit access according to the determined application (A1). The transmit access subsequently ensues while using the determined communications protocol.

Description

description

Protocol selection procedure for the transmission of data packets

The invention relates to a method and an arrangement for application-specific protocol selection in the event of transmission access by a network element located in a packet-oriented network to an external device.

In order to reduce the number of global addresses required for worldwide communication in packet-oriented networks, local area network (LAN) processes are often used for address conversion. Such procedures are usually carried out with an assignment of private, i.e. only locally unique and therefore only locally valid addresses for communicating network elements in the local network to global addresses. Addressing usually takes place e.g. with an IP address (Internet Protocol).

For communication with communication partners outside the local network, it is necessary to convert the local addresses into other local or global addresses. This process is known in the professional world as address translation.

Communication with a network element which is located outside of the LAN, in particular on the Internet, is assigned a global address via a reserved network element, hereinafter referred to as network node device. Functions of such a network node device usually take over a router provided for this purpose, or also a computer system used for network management, also called a proxy server or gateway. In the following, all such network node devices are referred to for simplification with the term "router". The address conversion has the advantage that several network elements with different IP addresses that are only valid internally in LAN are involved in data communication via a single IP address of the router. This IP address is usually assigned by a so-called provider for the respective data communication session. The network available through the provider - usually the Internet - is connected to the local network via the router.

To connect the router to the provider, for example, communication connections according to the well-known standards ISDN (Integrated Services Digital Network), ADSL (Asymmetrical Digital Subscriber Line) etc. are used. Depending on the logical interfaces supported by the provider, the router supports one or more communication protocols. A selection of supported communication protocols is specified, for example, in publications by the IETF (Internet Engineering Task Force), also called RFC (Request for Comment).

Examples of such communication protocols are PPP (Point to Point Protocol), defined in RFC 1661; PPP over ISDN, defined in RFC 1618; PPPoA (PPP over ATM Adaptation Layer 5, Asynchronous Transfer Mode); PPPoE (PPP over Ethernet), defined in RFC 2516; PPTP (Point to Point Tunneling Protocol), defined in RFC 2637 etc.

Various applications or communication protocols are mentioned in document RFC 3027 of the IETF, the use of which causes problems with address conversion. These problems largely arise from the fact that applications running in a network element of the local network for sending access to communication partners outside the packet-oriented network use the address - usually the IP address - of the router as the source address via the address conversion. The router's address in turn has been assigned to the router by the provider. With the applications mentioned, however, a "transparent" connection to the provider is necessary, ie a connection without router interaction with direct addressing of the network element.

A transparent connection is understood to mean a communication session which is carried out over a packet-oriented network, which is usually designed without a connection, with the character of a "permanently assigned" connection (also called a "session"). One aspect of such a transparent connection is that when the network element communicates with the provider, the network element, which usually acts as a so-called client, may also function as a server. If the network element arranged in a packet-oriented network with address conversion consequently wants to set up transmission access, it is "invisible" outside of this network, i.e. cannot be assigned via a unique global address. Numerous applications or their associated communication protocols on an application layer require such a transparent connection for communication, however, so that these applications cannot be used in the arrangement described above with a local network and a router that connects the local network with the provider and performs an address conversion are.

Examples of applications that require a transparent connection are VoIP applications ("Voice over Internet Protocol") with known communication protocols such as H.323 or SIP (Session Initiation Protocol), "active ftp" (File Transfer Protocol) and many other.

A procedure for establishing a transparent connection as required was proposed in the application filed on the same day with the internal file number 2002P12810DE and the title "Procedure for the transparent exchange of data packets", which is characterized by a network node element. draws, over which a network element can establish a transparent connection by initiating a communication connection according to a reserved communication protocol. The router recognizes the communication protocol used by the relevant network element and sets up a transparent connection for reserved communication protocols. The reserved communication protocol is set here by an operator of the network element, for example by selecting a driver to be used for the reserved communication protocol.

The object of the invention is to provide a method which enables a more flexible setting of a respective communication protocol.

The problem is solved with regard to its method aspect by a method with the features of patent claim 1 and with regard to its device aspect by an arrangement with features 7.

The method according to the invention can be used, for example, for network elements connected via a packet-oriented network, to which an address that is unique only within the network is assigned. The network elements are connected to a data communication network such as the Internet via an external device - for example an Internet service provider, ISP for short. The transition from the packet-oriented network to the provider takes place via a network node device, preferably a multiprotocol router.

According to the invention, when the network element sends access, a check is carried out, which application running in the network element requests the send access. Depending on the application determined, a communication protocol is then selected for the send access and the send access under

Use of this communication protocol initiated via an interface unit to the packet-oriented network. An important advantage of the method according to the invention is that the communication protocol is selected automatically. This relieves an operator of the network element from manually selecting a communication protocol required for certain applications. Instead, the communication protocol is advantageously selected according to the circumstances and requirements of the application requesting the transmission access.

This connection-dependent access control, that is to say the selection of a communication protocol for a specific application, advantageously provides protection against unauthorized communication accesses to the network element, for example by a computer which is located outside the packet-oriented network. For example, during an independent communication of a first application A and a second application B with the external device, it is not possible for application A to have an unauthorized communication access to application B.

Another advantage of the method according to the invention can be seen in the fact that only applications registered on the network element can establish a connection to the external device. This establishment of a connection is to be understood as meaning transmission access from other network elements connected to the network of the external device. Unauthorized access from a network element in the communication network of the external device is therefore only possible in connection with an assigned application. This advantageously provides a high level of security against unauthorized access to the network element.

The method according to the invention also allows non-critical applications to be assigned, which are permitted exclusive communication access. A selection of non-critical applications is limited to, for example Applications such as VoIP client applications (Voice over Internet Protocol), browsers such as Internet Explorer, or communication applications such as Netmeeting, which are carried out under the control of an operator.

Advantageous developments of the invention are specified in the subclaims.

An embodiment of the invention is explained in more detail below with reference to the drawing. It shows:

1: a structural diagram for the schematic representation of a data communication connection between a network element and a network node device.

1 shows a network element PC and a network node device ROU. Both the network element PC and the network node device ROU are connected to a — not shown — packet-oriented network.

The network element PC, which is designed, for example, as a computer system, has — not shown — further components typical of the computer system, a connection unit LAN, a protocol selection unit PS and an access control unit AS.

Applications are executed on the network element PC, of which a first application API, a second application AP2 and a third application AP3 are shown as examples. The points in the drawing symbolize that, in addition to the three applications AP1, AP2, AP3 mentioned, other applications are carried out on the network element PC. In addition to communicating applications API, AP2, applications that do not require communication are executed on the network element PC, for example the third application AP3. The protocol selection unit PS contains a PPPoE protocol module (Point-to-Point Protocol over Ethernet) POE, an IP protocol module (Internet Protocol) PIP ("Pure IP") and a PPTP protocol module (Point to Point Tunneling Proto - col) PTP. The dots in the drawing symbolize that, in addition to the three protocol modules POE, PIP, PTP mentioned, other protocol modules are managed by the protocol selection unit PS if required.

For better reference to associated data packet streams - also referred to below as "communication paths" - of the first and second applications AP1, AP2, the communication path of the second application AP2 is shown with a dash-dotted line, the communication path of the first application API with a solid line. Since communication takes place via data packets, the representation of the communication paths with lines is only to be understood as symbolic. A circled '2' is assigned to the communication path of the second application AP2 as a reference symbol, a circled '1' corresponding to the communication path of the first application API.

In the following illustration, the communication paths 1, 2 are described in a direction starting from the communicating applications AP1, AP2. Irrespective of this, the communication paths 1, 2 are assumed to be bidirectional. The analog representation of the direction of these communication channels 1, 2 is omitted for reasons of space.

The access control unit AS assigns each of the communicating applications AP1, AP2 a protocol module PIP, POE suitable for the application in the protocol selection unit PS. In the protocol modules POE, PIP, PTP, data packets of the communicating applications AP1, AP2 are converted into the corresponding communication protocols and each transferred to the connection unit LAN. Optionally, this transfer also takes place to different types of connection units, for example to a serial connection unit USB, which converts the data packets into a USB communication standard (Universal Serial Bus).

For the sake of clarity, the access control unit AS and the protocol ^selection unit PS are shown as separate functional units. In real technical implementations, these functional units can be implemented as a coherent unit.

In the exemplary embodiment, data packets of the first application API are encoded using the IP protocol module PIP in accordance with the Internet protocol; accordingly, data packets of the second application AP2 are encoded using the PPPoE protocol or POE module in accordance with the PPPoE communication protocol.

A suitable assignment of communication protocols to the respective communicating application A1, A2 is determined, for example, on the basis of an assignment table (not shown) managed by the access control unit AS, in which the communication protocol suitable for the respective application A1, A2 is noted. This assignment table can be configured by the operator of the network element PC or by administrative measures and, alternatively, is localized on a central unit (not shown), such as a server. In addition to organizing the assignment table in the form of a table, technically more sophisticated embodiments such as database management can also be carried out.

The connection unit LAN connects the network element PC to the - not shown - packet-oriented network, via which data packets of the first and second applications AP1, AP2 reach the network node device ROU, which is also connected to the packet-oriented network, via the respective communication paths 1, 2. The network node device ROU is designed as a multiprotocol network node device ROU. For this purpose, it contains a multiprotocol proxy unit MPP, which contains a first proxy PR1 and a routing unit IPR. The points shown in the drawing symbolize that, in addition to the first proxy PR1, further proxies (not shown) can be part of the multiprotocol proxy unit MPP if required.

The multiprotocol proxy unit MPP is connected via a connection unit LAN largely analogous to the connection unit LAN of the network element PC to the packet-oriented network (not shown). Both the communication of the first application API via communication path 1 and the communication of the second application AP2 via communication path 2 are transferred to the multiprotocol proxy unit MPP via the connection unit LAN of the network node device ROU.

In the multiprotocol proxy unit MPP, the communication protocol of the data packets arriving at the network node device ROU via the connection unit LAN is evaluated by a functional unit (not shown) of the multiprotocol proxy unit MPP and, depending on the detected communication protocol, to the first proxy PR1 or to the routing unit IPR transferred, the multiprotocol proxy unit MPP symbolically separates the first and second communication paths 1, 2 in connection with a respective assignment to the first proxy PR1 or to the routing unit IPR.

The routing unit IPR processes data packets of the first application API coded according to the Internet protocol. Data packets received at the entrance of the routing unit IPR are converted using an address conversion and encapsulation of the IP datagrams contained in the data packets into another communication. tion protocol - for example PPPoE or PPP - encapsulated predetermined frame and passed on to the exit of the routing unit IPR. The routing unit also carries out classic routing functions, ie routing of the received data packets.

The data packets arriving at the input of the first proxy PR1 are forwarded transparently to the output of the first proxy PR1 without address conversion. The first proxy PR1 also manages any termination of the communication connection that may be required or the initiation of a transparent communication connection (“session”).

The data packets of both communication paths 1, 2 are transferred via the outputs of the first proxy PR1 or the routing unit IPR to a modulating / demodulating unit ADSL which modulates or demodulates the data packets in the ADSL standard (Asymmetrical Digital Subscriber Line). The modulating / demodulating unit ADS then transfers the data stream to the output of the network node device ROU, which is connected to an external device, for example an Internet service provider ISP. Alternatively, depending on the interface of the external device ISP, a conversion to the ISDN standard (Integrated Services Digital Network) by a corresponding - not shown - modulating / demodulating unit is required. Furthermore, the modulating / demodulating unit ADS is arranged as an independent unit outside the network node device ROU in an alternative embodiment.

The communication of the first or second application AP1, AP2 with the Internet service provider ISP via the communication paths 1, 2 is clear in both directions, so that an assignment of the first or second application AP1, AP2 including connection parameters - such as a required one ID or a password authorization - is unique.

Claims

claims

1. Method for protocol selection for the transmission of data packets in a packet-oriented network with at least one network element (PC) connected to the packet-oriented network with an address that is uniquely assigned only within the packet-oriented network, with access by network elements (PC) to the packet-oriented network Network takes place by means of an equal access method, characterized in that

for a transmission access to be carried out by the network element (PC) on the packet-oriented network, a check is carried out, which application (AI) running in the network element (PC) requests the transmission access,

- Depending on the application (AI) determined, a communication protocol for the transmission access is determined and

- That the send access takes place using the communication protocol.

2. The method according to claim 1, characterized in that the transmission access establishes communication with an external device (ISP) arranged outside the packet-oriented network.

3. The method according to claim 2, characterized in that the communication with the external device (ISP) takes place via a network node device (ROU) connecting the packet-oriented network (LAN) with the external device (ISP).

4. The method according to claim 3, characterized in that the communication protocol used is detected by the network node device (ROU) and a communication protocol implementation is carried out for certain communication protocols before forwarding the data packets to the external device (ISP).

5. The method according to claim 3, characterized in that an address conversion is carried out by the network node device (ROU) in certain communication protocols before forwarding the data packets to the external device (ISP).

6. The method according to claim 3, characterized in that a transparent connection with the external device (ISP) is established by the network node device (ROU) for certain communication protocols.

7. Network element (PC) for executing an application (API) with

- an access control unit (AS), in which a communication protocol preset for the application (API) is assigned, - a protocol selection unit (PS) for assigning data packets to be transmitted by the application (API) to a protocol module (PIP), in which implements the communication protocol of the data packets,

- A connection unit (LAN) for exchanging data packets with a packet-oriented network.