WO2025041280A1 - Dispositif d'interruption de communication - Google Patents

Dispositif d'interruption de communication Download PDF

Info

Publication number
WO2025041280A1
WO2025041280A1 PCT/JP2023/030204 JP2023030204W WO2025041280A1 WO 2025041280 A1 WO2025041280 A1 WO 2025041280A1 JP 2023030204 W JP2023030204 W JP 2023030204W WO 2025041280 A1 WO2025041280 A1 WO 2025041280A1
Authority
WO
WIPO (PCT)
Prior art keywords
communication
cutoff
unit
blocking
communication device
Prior art date
Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
Pending
Application number
PCT/JP2023/030204
Other languages
English (en)
Japanese (ja)
Inventor
達也 出水
俊之 金澤
寛規 井上
浩輝 細野
眞成 渡辺
Current Assignee (The listed assignees may be inaccurate. Google has not performed a legal analysis and makes no representation or warranty as to the accuracy of the list.)
NTT Inc
Original Assignee
Nippon Telegraph and Telephone Corp
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by Nippon Telegraph and Telephone Corp filed Critical Nippon Telegraph and Telephone Corp
Priority to PCT/JP2023/030204 priority Critical patent/WO2025041280A1/fr
Priority to JP2025541229A priority patent/JPWO2025041280A1/ja
Publication of WO2025041280A1 publication Critical patent/WO2025041280A1/fr
Anticipated expiration legal-status Critical
Pending legal-status Critical Current

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L41/00—Arrangements for maintenance, administration or management of data switching networks, e.g. of packet switching networks
    • H04L41/06—Management of faults, events, alarms or notifications
    • H04L41/0604—Management of faults, events, alarms or notifications using filtering, e.g. reduction of information by using priority, element types, position or time

Definitions

  • the present invention relates to a communication cutoff device that controls traffic when settings are applied to devices that make up a communication network.
  • telecommunications carriers when implementing the above-mentioned expansion or preventive maintenance, telecommunications carriers first complete the work of connecting the physical wiring of the communication devices, etc., and then remotely input the configuration to the communication devices via the network controller. As a result, communication devices in the process of completing the communication settings may be temporarily connected to the communication network.
  • Hiroki Inoue Toru Okugawa, Akio Masuda, Practical Evaluation of WAN Acceleration Function Virtualization in vCPE, IEICE Technical Report, April 10, 2014, Vol. 114, No. 6, pp. 125-130.
  • conventional technology has the problem that it can be difficult to block unexpected communication between a communication device and a terminal device.
  • conventional technology has difficulty in considering all devices that may exist beyond the responsibility demarcation point (UNI: User Network Interface) and carrying out appropriate control.
  • the communication cutoff device of the present invention is characterized by having an update unit that updates the cutoff judgment conditions used to judge whether or not to cut off a specific communication between a communication device and a terminal device based on the setting status of the communication device that accommodates communication from the terminal device, and a judgment unit that judges whether or not the specific communication between the communication device and the terminal device is a communication to be cut off based on the cutoff judgment conditions and information related to the specific communication.
  • the present invention has the effect of making it possible to block unexpected communication between a communication device and a terminal device.
  • Fig. 1 is a diagram for explaining a communication cutoff device 100 according to the present embodiment.
  • the communication cutoff device 100 shown in Fig. 1 is an example of a computer that provides a technology for determining whether or not to cut off a specific communication between a communication device and a terminal device based on a setting status of the communication device in a communication network, and cutting off the communication determined to be cut off.
  • the "specific communication” refers to any communication performed between an end user's terminal device and a communication device, and is not limited to a specific communication.
  • the telecommunications carrier completes the work of connecting the physical wiring of the communication devices in advance, and then remotely configures the communication devices via a network controller.
  • the above-mentioned communication settings may use Config, which is generated for each device type or target device.
  • Config which is generated for each device type or target device.
  • Figure 2 shows an example of Config settings according to this embodiment.
  • the device that manages and controls the communication device (hereinafter, may be referred to as the "communication control device") mechanically combines Config components prepared in advance for each device type to generate and input Config for setting up communication for each communication device 300.
  • the communication control device 200 stores a Config component for device type a and a Config component for device type b ((1-1) and (1-2) in FIG. 2). Then, when the communication control device 200 performs communication settings for the communication devices 300A to 300C, it generates an input Config for each communication device 300.
  • Figure 3 is a diagram showing an example of the reference technology.
  • Figure 3 shows a failure example ⁇ 1> in which a failure occurs in the system due to communication from the end user to the communication device 300 in progress, and a failure example ⁇ 2> in which the end user is cut off due to communication from the communication device in progress.
  • failure example ⁇ 1> communication is performed from terminal device 400 to service providing server 600.
  • communication from terminal device 400 is accommodated by communication device 300b in operation, and is connected to service providing server 600 via communication device 300b in operation and higher-level device 500b.
  • communication device 300a in preparation is installed in the communication network as a new communication device, and communication settings are incomplete.
  • the communication path shown in FIG. 3 (1-1) is normal because the communication is routed through the communication device 300b in operation.
  • the communication path shown in FIG. 3 (1-2) the communication of the terminal device 400 is accommodated under the communication device 300a in progress. Then, the communication routed through the communication device 300a in progress is connected to the service providing server 600 via the higher-level device 500a and the higher-level device 500b (FIG. 3 (2)).
  • terminal device 400 transmits a packet based on a broadcast to simultaneously communicate with communication devices 300 included in the communication network ((1-1) and (1-2) in FIG. 3).
  • communication device 300a Upon receiving the packet, communication device 300a recognizes that terminal device 400 is under communication device 300a, and transmits this recognition to higher-level device 500, which causes the communication path to be recalculated and the communication path to be switched ((3) in FIG. 3).
  • the service providing server 600 then communicates with the terminal device 400 to send a response ((4) in FIG. 3).
  • the communication path is switched since the communication of the terminal device 400 is assumed to be under the control of the in-progress communication device 300a, and the communication is connected to the in-progress communication device 300a via the higher-level device 500b and higher-level device 500a.
  • the in-progress communication device 300a is unable to send packets to the terminal device 400 because communication settings have not been completed, and a communication failure occurs ((5) in FIG. 3).
  • failure example ⁇ 2> in which an end user is cut off due to communication from a communication device in progress.
  • a user's terminal device 400, a communication device 300 that accommodates the communication of the terminal device 400, and a higher-level device 500 that accommodates each communication device are shown.
  • the communication device 300 etc. performs IPv6 RA (Router Advertisement), which distributes information required for IPv6 address generation and default routes to the terminal device 400, and ARP (Address Resolution Protocol), which is a process for checking the correspondence between IP addresses and MAC addresses, etc.
  • IPv6 RA Route Advertisement
  • ARP Address Resolution Protocol
  • the in-progress communication device 300a transmits packets related to IPv6 RA and ARP to the terminal device 400 ((7) in FIG. 3). Based on this, the terminal device 400 switches the packet transmission destination to the in-progress communication device 300a, so that the communication from the terminal device 400 is accommodated in the in-progress communication device 300a ((8) in FIG. 3). However, because the in-progress communication device 300a has not completed communication settings, it is unable to circulate the packets transmitted from the terminal device 400, and a communication failure occurs ((9) in FIG. 3).
  • settings such as “do not send broadcasts” and “do not communicate with communication device 300a in progress” can be set based on a technology called vCPE, in which a communication carrier virtually provides and controls a communication device (CPE: Customer Premises Equipment) installed on the end user side.
  • CPE Customer Premises Equipment
  • the end user's communication network beyond the responsibility demarcation point may contain communication devices 300 that are not compatible with vCPE, making it difficult for the communication carrier to control everything.
  • a different Config setting process than usual such as "enabling communication after Config setting is complete,” may be required, which may be difficult to apply from the perspective of strengthening the communication network or preventive maintenance.
  • the communication cutoff device 100 updates the cutoff judgment conditions used to judge whether or not to cut off a specific communication between a communication device and a terminal device, based on the setting status of the communication device that accommodates communication from the terminal device.
  • the communication cutoff device 100 judges whether or not a specific communication between a communication device and a terminal device is a communication to be cut off, based on the cutoff judgment conditions and information related to the specific communication.
  • the above-mentioned communication cutoff process is realized by installing a communication cutoff device 100 between a terminal device 400 located on the end user side from the responsibility demarcation point (UNI) and a communication device 300 located on the telecommunications carrier side from the responsibility demarcation point (UNI).
  • a communication cutoff device 100, a communication control device 200, a communication device 300, a terminal device 400, and a higher-level network are shown as an example on a specific communication network.
  • the communication control device 200 controls the communication between the communication devices 300a and 300b (FIG. 1 (1-1)).
  • the communication control device 200 also issues cutoff instructions and uncut instructions between the communication device 300 and the terminal device 400 to the communication cutoff device 100 (FIG. 1 (1-2)).
  • the communication cutoff device 100 determines that the communication between the terminal device 400 and the communication device 300b in operation is not to be cut off ((2-1) in FIG. 1). On the other hand, the communication cutoff device 100 determines that the communication between the terminal device 400 and the communication device 300a in progress is to be cut off ((2-2) in FIG. 1).
  • the communication cutoff device 100 updates the cutoff judgment conditions used to judge whether to cut off communication at a predetermined timing ((3-2) in FIG. 1) based on the setting status, such as when only planned installation is registered but not yet installed, when installation is complete but communication settings are not complete, or when a cutoff command is received from the communication control device 200 ((3-1) in FIG. 1).
  • the communication cutoff device 100 uses the above-mentioned cutoff judgment conditions and information related to the specified communication, such as header information related to the communication between the terminal device 400 and the communication device 300a in progress, the interface number used, arbitrary information included in the packet, and the communication wavelength band, to judge whether the communication is to be cut off ((4-1) and (4-2) in FIG. 1).
  • the communication cutoff device 100 determines that a specific communication between a terminal device 400 and a communication device 300 included in the communication network is to be cut off based on the setting status of the communication device 300 and the cutoff determination conditions. Therefore, the communication cutoff device 100 makes it easy to prevent the occurrence of unexpected communication with a communication device 300a that is in progress, etc.
  • the communication cutoff device 100 updates the cutoff judgment condition based on the setting status of the communication device 300 received from the communication control device 200. Then, the communication cutoff device 100 determines whether or not the communication is a target for cutoff using the cutoff judgment condition and information related to a predetermined communication between the terminal device 400 and the communication device 300, and cuts off the target communication for cutoff.
  • Fig. 4 is a diagram showing an example of the configuration of the communication cutoff device 100 and the communication control device 200 according to the first embodiment.
  • the communication cutoff device 100 has a communication unit 110, a storage unit 120, and a cutoff control unit 130.
  • the communication cutoff device 100 can be provided with an input unit such as a keyboard or a mouse for receiving input such as operations by an administrator or the like.
  • the communication cutoff device 100 can be provided with a display unit such as a display for displaying information related to communication cutoff such as a communication cutoff history and errors to an administrator or the like.
  • the communication unit 110 performs data communication related to reception of packets and the like from a user's terminal device and reception of information on the setting status of the communication device from the communication control device 200 and information on a communication cutoff instruction or a communication cutoff release instruction.
  • the communication unit 110 is realized by a NIC (Network Interface Card) or the like, and controls communication via an electric communication line such as a LAN (Local Area Network) or the Internet.
  • the communication unit 110 is connected to a network by wire or wirelessly as necessary, and can transmit and receive information in both directions. For example, the communication unit 110 can perform two-way data communication with the communication unit 210 of the communication control device 200.
  • the storage unit 120 stores data and programs used for various processes by the cutoff control unit 130, and various data acquired by the operation of the cutoff control unit 130.
  • the storage unit 120 is realized by a semiconductor memory element such as a random access memory (RAM) or a flash memory, or a storage device such as a hard disk or an optical disk. As shown in FIG. 4, the storage unit 120 has a device status management DB 121.
  • the device status management DB 121 is a database that stores cutoff judgment conditions and communication device registration information.
  • the cutoff judgment conditions are conditions used by the cutoff control unit 130 (described later) to judge whether or not a communication is to be cut off.
  • the communication device registration information is information about communication devices installed in a specific communication network, and is information used by the cutoff control unit 130 (described later) to judge whether or not a communication device in progress exists.
  • the device status management DB121 stores, as blocking determination conditions, a No., the communication device side interface number of the communication blocking device, the terminal device side interface number of the communication blocking device, a VLAN ID, an EtherType, a source MAC address, a destination MAC address, a protocol number, a source IP address, a source port number, a destination IP address, a destination port number, and pass/block, each corresponding to one another.
  • the above-mentioned No. is a unique number for identifying each of the blocking judgment conditions.
  • the communication device side interface number of the communication blocking device is a number that identifies the interface through which the communication blocking device 100 connects to the carrier side communication device.
  • the terminal device side interface number of the communication blocking device is a number that identifies the interface through which the communication blocking device 100 connects to the end user side terminal device.
  • the VLAN ID is identification information that identifies each VLAN (Virtual LAN).
  • the EtherType is identification information that identifies the type of communication protocol (type of network layer) to be transmitted.
  • the source MAC address and destination MAC address are identification information that identify the device that is the source or destination of the packet.
  • the protocol number, source IP address, source port number, destination IP address, and destination port number are information contained in the 5-tuple.
  • Pass/block is information that indicates whether the communication that meets the above-mentioned conditions is passed or blocked.
  • FIG. 5 is a table diagram showing an example of the blocking judgment condition according to the first embodiment.
  • the device status management DB 121 stores, as blocking judgment conditions, the communication device side interface number of the communication blocking device "any", the terminal device side interface number of the communication blocking device "2", VLAN ID "any”, EtherType "any", source MAC address "any", destination MAC address "any", protocol number "any”, source IP address "any", source port number "any”, destination IP address "any”, destination port number "any”, pass/block “block”, etc., all of which are identified by No. "1".
  • any is a character string that indicates a condition such as "any value is acceptable.”
  • the blocking judgment condition identified by No. “1” means that if the interface number on the terminal device side of the communication blocking device is "2,” then “the communication is judged to be a target for blocking” regardless of the values of the other items.
  • the blocking judgment condition identified by No. “2” means that if the interface number on the communication device side of the communication blocking device is "1,” then “the communication is judged to be a pass-through (not a target for blocking)” regardless of the values of the other items.
  • the device status management DB 121 can also store information related to optical communications, including, for example, LLID or communication wavelength bands.
  • the device status management DB 121 stores, as communication device registration information, a number, the communication device side interface number of the communication cutoff device, and a VLAN ID, each associated with each other. Note that the above-mentioned number is a unique number for identifying each piece of information in the communication device registration information.
  • FIG. 6 is a table diagram showing an example of communication device registration information according to the first embodiment.
  • device status management DB 121 stores, as communication device registration information, the communication device side interface number "1" of the communication cutoff device identified by No. "1", VLAN ID "any”, etc.
  • any is a character string that indicates the condition "any value is acceptable.” In other words, it means that the communication device is connected to the interface identified by the interface numbers "1," "2,” and "3" on the communication cutoff device's communication device side as the communication device registration information identified by No. "1.”
  • the cutoff control unit 130 has an internal memory for temporarily storing a program defining the cutoff processing procedure of the communication cutoff device 100 and processing data, and is realized by electronic circuits such as a CPU (Central Processing Unit) and an MPU (Micro Processing Unit), and integrated circuits such as an ASIC (Application Specific Integrated Circuit) and an FPGA (Field Programmable Gate Array). As shown in FIG. 4, the cutoff control unit 130 has a reception unit 131, an update unit 132, a determination unit 133, and a cutoff unit 134.
  • the receiving unit 131 receives information transmitted from an external device and stores it in the storage unit 120 .
  • the reception unit 131 receives packets sent from the end user's terminal device and stores the header information and the like contained in the packets.
  • the reception unit 131 also receives and stores information related to a specific communication, such as a port number and an interface number, collected from a communication device and the like.
  • the reception unit 131 also receives and stores registration information (communication device registration information) related to communication devices installed in the communication network from the communication control device 200.
  • the reception unit 131 also receives and stores information such as a specific communication blocking instruction or a blocking release instruction output from the communication control device 200. Note that the reception unit 131 is not limited to the above-mentioned information, and can receive any information related to communication blocking processing.
  • the update unit 132 updates the blocking judgment condition used to judge whether or not to block a specific communication between a communication device and a terminal device, based on the setting status of the communication device that accommodates the communication from the terminal device.
  • the "setting status of the communication device” includes setting statuses such as: only the planned installation is registered but not yet installed; installation is completed but communication setting is not yet completed; there is an instruction to set blocking or release blocking from the communication control device 200; and a setting is made to block or pass specific communication related to the communication device.
  • the update unit 132 updates the blocking judgment conditions so that the communication device is judged to be a target for blocking. For example, when information on the setting status such as "communication setting is incomplete for the communication device 300 connected to the terminal device side interface number "2" of the communication blocking device” or "communication blocking is implemented for the communication device connected to the terminal device side interface number "2" of the communication blocking device" is received from the communication control device 200, the update unit 132 updates the pass/block item to "block" for the blocking judgment condition identified by No. "1" in FIG. 5 so that it is judged that the specified communication related to the communication device is a target for blocking.
  • the update unit 132 updates the blocking judgment conditions so that the communication device is judged not to be blocked when at least one of the communication settings is completed or an instruction to cancel the blocking setting is received. For example, when information on the setting status such as "communication settings are completed for the communication device connected to the terminal device side interface number "2" of the communication blocking device” or "communication blocking for the communication device connected to the terminal device side interface number "2" of the communication blocking device is canceled" is received from the communication control device 200, the update unit 132 updates the pass/block item to "pass" for the blocking judgment condition identified by No. "1" shown in FIG. 5 so that it is judged that the specified communication related to the communication device is not to be blocked.
  • the determination unit 133 determines whether or not the predetermined communication between the communication device and the terminal device is a communication to be blocked, based on the blocking determination condition updated by the update unit 132 and information on the predetermined communication between the terminal device 400 and the communication device. For example, the determination unit 133 determines that the communication is a communication to be blocked when the information on the predetermined communication satisfies a blocking determination condition including one or more combinations of an interface number, 5 tuple, arbitrary information included in a packet such as a VLAN ID and Ether Type, and information on optical communication including an LLID or a communication wavelength band.
  • the determination unit 133 determines that a communication is to be blocked when information about a specific communication between a communication device and a terminal device satisfies a combination of communication targets included in a preset blocking determination condition. For example, when information about a specific communication between a communication device and a terminal device includes information such as "Terminal device side interface number of communication blocking device: 2", the determination unit 133 determines that the communication is to be blocked based on the blocking determination condition identified by No. "1" described in FIG. 5. Furthermore, based on information about optical communication including an LLID or a communication wavelength band, the determination unit 133 determines that communication using an optical wavelength other than the specified optical wavelength is to be blocked when optical communication is carried out using a certain optical wavelength.
  • the determination unit 133 determines that the communication is to be blocked when the information about the specified communication does not include registration information of a communication device installed in the communication network. For example, when the information about the specified communication between a communication device and a terminal device includes information such as "Terminal device side interface number of communication blocking device: 4", the determination unit 133 determines that the communication is to be blocked because the corresponding interface number is not included in the communication device registration information described in FIG. 6.
  • the cutoff unit 134 cuts off a communication that is determined by the determination unit 133 to be a communication to be cut off. Specifically, the cutoff unit 134 performs cutoff processing such as discarding packets or not transmitting packets for a communication including the "terminal device side interface number of the communication cutoff device: 2" that is determined by the determination unit 133 to be a communication to be cut off.
  • the communication control device 200 is an example of an information processing device that controls the communication device and the like using Config and issues an instruction to the communication cutoff device 100 to perform or release cutoff.
  • the communication control device 200 has a communication unit 210, a storage unit 220, a control unit 230, and a cutoff control unit 240.
  • the communication control device 200 can be provided with an input unit such as a keyboard or a mouse for receiving input such as operations by an administrator.
  • the communication control device 200 can be provided with a display unit such as a display for displaying information related to communication cutoff such as the history and results of communication control, errors, etc. to the administrator.
  • the communication unit 210 performs data communication such as issuing instructions to the communication cutoff device 100 to cut off or release the cutoff of communication, and inputting configuration information to the communication device.
  • the communication unit 210 is realized by a NIC or the like, and controls communication via an electric communication line such as a LAN or the Internet.
  • the communication unit 210 is connected to the communication cutoff device 100 or the communication device or the like via a wired or wireless network as necessary, and can transmit and receive information in both directions.
  • the storage unit 220 stores data and programs used for various processes by the control unit 230, and various data acquired by the operation of the control unit 230.
  • the storage unit 220 is realized by a semiconductor memory element such as a RAM or a flash memory, or a storage device such as a hard disk or an optical disk. As shown in FIG. 4, the storage unit 220 has a config storage DB 221.
  • the Config storage DB 221 is a database that stores Config components (templates) used by a Config generation unit 231 (described later) and generated input Configs.
  • the control unit 230 has an internal memory for temporarily storing programs and processing data that define various processing procedures of the communication control device 200, and is realized by electronic circuits such as a CPU and an MPU, and integrated circuits such as an ASIC and an FPGA. As shown in FIG. 4, the control unit 230 has a config generation unit 231 and a config input unit 232.
  • the Config generation unit 231 generates an input Config for a Config corresponding to each communication device to be controlled by combining Config components stored in the Config storage DB 221.
  • the Config generation unit 231 can generate the input Config using a known method.
  • the Config input unit 232 performs communication settings by inputting the input Config generated by the Config generation unit 231 to each communication device to be controlled. For example, when the Config input unit 232 receives an instruction to input a Config from the control unit 230 of the communication control device 200, the Config input unit 232 inputs the generated Config to the target communication device to perform communication settings.
  • the cutoff control unit 240 has an internal memory for temporarily storing a program that defines the cutoff processing procedure of the communication control device 200 and processing data, and is realized by an electronic circuit such as a CPU or an MPU, or an integrated circuit such as an ASIC or an FPGA.
  • the cutoff control unit 240 has a cutoff setting instruction unit 241 as shown in FIG.
  • the cutoff setting instruction unit 241 instructs the communication cutoff device 100 to cut off or release a cutoff of a predetermined communication between a communication device and a terminal device.
  • the blocking setting instruction unit 241 when the Config setting for a communication device in progress is completed, the blocking setting instruction unit 241 outputs an instruction to the communication blocking device 100 to "cancel blocking.” On the other hand, when a Config to be applied to a communication device in progress has been generated but the Config setting has not been completed, the blocking setting instruction unit 241 outputs an instruction to the communication blocking device 100 to "perform blocking.”
  • the blocking setting instruction unit 241 outputs an instruction to "block" a specific communication between the communication device and an end user's terminal device, etc., based on the operation of an administrator, etc.
  • Fig. 7 is a diagram showing an example of a flowchart of the communication cutoff method according to the first embodiment. Note that each step may be interchanged and executed within a range where there is no contradiction, and there may be steps that are not executed.
  • the reception unit 131 receives information related to the setting status of the communication device (S101).
  • the update unit 132 updates the blocking judgment conditions based on the received information related to the setting status of the communication device (S102).
  • the determination unit 133 determines whether or not a specific communication between the terminal device and the communication device is to be blocked (S103). If it is determined that the communication is to be blocked (Yes in S104), the blocking unit 134 blocks the specific communication determined to be to be blocked (S105). Then, the communication blocking device 100 ends the process.
  • the communication blocking device 100 continues the communication without blocking it (S106). Then, the communication blocking device 100 ends the process.
  • effect Hereinafter, a description will be given of the effects provided by the communication cutoff device 100 according to the first embodiment.
  • a problem that has been encountered up until now is that it may be difficult to prevent the occurrence of unexpected communication with a communication device that is in process.
  • the update unit 132 of the communication cut-off device 100 updates the cut-off judgment conditions used to judge whether or not to cut off a specific communication between a communication device and a terminal device, based on the setting status of the communication device that accommodates communication from the terminal device.
  • the judgment unit 133 of the communication cut-off device 100 judges whether or not the communication between the communication device and the terminal device is communication to be cut off, based on the cut-off judgment conditions and information related to the specific communication. Therefore, the communication cut-off device 100 according to the first embodiment has the effect of making it possible to cut off unexpected communication between a communication device and a terminal device.
  • the determination unit 133 determines that the communication is to be blocked when the information about the specified communication satisfies a blocking determination condition that includes one or a combination of the following: an interface number, 5tuple, arbitrary information contained in the packet such as VLAN ID and EtherType, and information about optical communication including an LLID or communication wavelength band.
  • a blocking determination condition that includes one or a combination of the following: an interface number, 5tuple, arbitrary information contained in the packet such as VLAN ID and EtherType, and information about optical communication including an LLID or communication wavelength band.
  • the determination unit 133 determines that the communication is to be blocked when the information relating to the specified communication does not include registration information for a communication device installed in the communication network.
  • the communication blocking device 100 determines whether the specified communication related to the communication device is to be blocked based on whether the communication device is registered in the communication control device 200 or the like. Therefore, when a communication device is newly added to the communication network but its information is not registered and it is unusable, the communication blocking device 100 can determine that the communication with the communication device is to be blocked. Furthermore, the communication blocking device 100 can detect an unknown communication device whose information is not registered, and determine that the communication with the communication device is to be blocked.
  • the communication cutoff device 100 performs cutoff processing for a specific communication between a target communication device and a terminal device based on cutoff judgment conditions that are updated according to the setting status of the communication device.
  • the communication cutoff device 100 can prevent an in-progress communication device from performing unexpected operations by preventing unnecessary packets from reaching the in-progress communication device from the end user side.
  • the communication cutoff device 100 can prevent an in-progress communication device from being cut off due to the interception of the end user's communications, by preventing the end user's terminal device from detecting the presence of a newly installed device.
  • the communication cutoff device 100 can flexibly control the determination of communication to be cut off using interface numbers, 5 tuples, VLAN IDs, EtherTypes, etc., so it can appropriately determine and cut off communication to be cut off even when the communication cutoff device 100 and the communication device in progress are not directly connected or when multiple VLANs are superimposed on one interface by VLANs for each end user.
  • the communication blocking device 100 can block specific communications, it can block all communications or only a portion of the communications. Therefore, in cases where the communication device in progress is designed to prepare for switching in advance or where the end user's terminal device is designed to automatically switch communication paths, the communication blocking device 100 blocks only the communications from the communication device in progress to the end user's terminal device and allows the reverse communications to pass, making it possible to quickly switch paths after the communication settings of the communication device are complete.
  • the communication cutoff device 100 can prevent communication failures that may occur when an end user's terminal device uses an unexpected optical wavelength by cutting off communications at any wavelength other than the specified optical wavelength.
  • the communication blocking device 100 automatically changes the communications to be blocked in accordance with changes in the settings of the communication device, thereby reducing the amount of computer processing required to determine which communications should be blocked.
  • the communication control device 200 performs the process of updating the blocking judgment conditions in the first embodiment and determining whether a specific communication is to be blocked or not, and outputs a blocking instruction to the communication blocking device 100, thereby blocking the communication to be blocked.
  • Fig. 8 is a diagram showing an example of the configuration of the communication cutoff device 100 and the communication control device 200 according to the second embodiment.
  • the communication cutoff device 100 has a communication unit 110, a storage unit 120, and a cutoff control unit 130. Since the communication cutoff device 100 according to the second embodiment has the same functions as the communication cutoff device 100 according to the first embodiment, the communication unit 110, the storage unit 120, etc., whose functions overlap between the first embodiment and the second embodiment, will be appropriately omitted in the description.
  • the cutoff control unit 130 includes a reception unit 131 , a cutoff unit 134 , and a query unit 135 .
  • the receiving unit 131 receives information such as a cutoff instruction or a cutoff release instruction for a predetermined communication output from the communication control device 200 .
  • the cutoff unit 134 cuts off communication to be cut off based on a predetermined communication cutoff instruction output from the communication control device 200 received by the reception unit 131. Specifically, the cutoff unit 134 performs cutoff processing such as discarding packets or not transmitting packets for communication including "terminal device side interface number of communication cutoff device: 2" determined by the communication control device 200 as a communication to be cut off. On the other hand, when a cutoff release instruction is output from the communication control device 200, the cutoff unit 134 does not perform cutoff processing.
  • the communication control device 200 has a communication unit 210, a storage unit 220, a control unit 230, and a cutoff control unit 240. Note that since the communication control device 200 according to the second embodiment has the same functions as the communication control device 200 according to the first embodiment, the communication unit 210, the storage unit 220, and the control unit 230, whose functions overlap between the first embodiment and the second embodiment, will be described in abbreviated form as appropriate.
  • the cutoff control unit 240 has a cutoff setting instruction unit 241, a reception unit 242, an update unit 243, and a determination unit 244.
  • the reception unit 242 has the same function as the reception unit 131 according to the first embodiment
  • the update unit 243 has the same function as the update unit 132 according to the first embodiment, and therefore the description thereof will be omitted in this section.
  • the cutoff setting instruction unit 241 instructs the communication cutoff device 100 to cut off or release a cutoff of a predetermined communication between a communication device and a terminal device based on a determination result of a determination unit 244 described later.
  • the judgment unit 244 judges whether the communication between the communication device and the terminal device is communication to be blocked based on the blocking judgment conditions updated by the update unit 243, information regarding specific communication related to the communication between the terminal device and the communication device, and information regarding the setting status of the communication device.
  • Fig. 9 is a sequence diagram for explaining an example of communication cutoff processing according to the second embodiment.
  • Fig. 9 explains (1) before installation of the communication device 300, (2) when installing the communication device 300, (3) after installation of the communication device 300 and before completion of setting, (4) setting of the communication device 300, and (5) after installation of the communication device 300 and after completion of setting.
  • the communication cutoff device 100 queries the cutoff control unit 240 about cutoff (S1-1).
  • the cutoff control unit 240 refers to the communication device registration information stored in the device status management DB 222 (S1-2).
  • the device status management DB 222 does not store communication registration information for the target communication device 300 (S1-3). Therefore, the cut-off control unit 240 instructs the communication cut-off device 100 to cut off specific communications between the communication device 300 and terminal devices, etc. (S1-4). The communication cut-off device 100 then cuts off the specific communications (S1-5).
  • the cutoff control unit 240 Based on instructions from the control unit 230, the cutoff control unit 240 performs cutoff registration to update the cutoff determination conditions so as to set the cutoff setting for the communication device 300 (S2-3).
  • the communication cutoff device 100 queries the cutoff control unit 240 about cutting off (S3-1).
  • the cutoff control unit 240 refers to the communication device registration information stored in the device status management DB 222 (S3-2).
  • the device status management DB 222 stores the communication registration information and cut-off judgment conditions of the target communication device 300 (S3-3). Then, based on the communication registration information and the cut-off judgment conditions, the cut-off control unit 240 instructs the communication cut-off device 100 to cut off a specific communication between the communication device 300 and a terminal device or the like (S3-4). Then, the communication cut-off device 100 cuts off the specific communication (S3-5).
  • the control unit 230 instructs the cutoff control unit 240 to set the communication device to cutoff (S4-4). Then, based on the instruction from the control unit 230, the cutoff control unit 240 performs cutoff registration to update the cutoff determination conditions so as to set the communication device 300 to cutoff (S4-5).
  • the device status management DB 222 stores the cutoff judgment condition registered as "cutoff performed" for the target communication device 300 (S4-6). Then, the cutoff control unit 240 instructs the communication cutoff device 100 to cut off specific communications between the communication device 300 and a terminal device, etc., based on the cutoff judgment condition (S4-7). The communication cutoff device 100 then cuts off the specific communications (S4-8). The cutoff control unit 240 also notifies the control unit 230 that the cutoff has been completed (S4-9).
  • the control unit 230 which has received the cutoff completion notification, issues an instruction to input the generated input Config (S4-10).
  • the Config input unit 232 then obtains the input Config stored in the Config storage DB 221 (S4-11) and inputs the Config to the target communication device 300 (S4-12).
  • the communication device 300 reflects the input config (S4-13) and notifies the control unit 230 that the config has been input (S4-14).
  • the control unit 230 which has received the notification that Config has been entered, instructs the cutoff control unit 240 to unblock the specified communications related to the communication device 300 (S4-15). Then, based on the instruction from the control unit 230, the cutoff control unit 240 performs cutoff unblocking registration, which updates the cutoff judgment conditions so as to unblock the communication device 300 (S4-16).
  • the device status management DB 222 stores the "unblocked" status of the target communication device 300 and the registered blocking judgment condition (S4-17). Based on the blocking judgment condition, the blocking control unit 240 then instructs the communication blocking device 100 to block specific communications between the communication device 300 and a terminal device or the like (S4-18). The communication blocking device 100 then unblocks the specific communications (S4-19). The blocking control unit 240 also notifies the control unit 230 of the completion of the blocking unblocking registration (S4-20).
  • the communication cutoff device 100 queries the cutoff control unit 240 about cutting off (S5-1).
  • the cutoff control unit 240 refers to the communication device registration information stored in the device status management DB 222 (S5-2).
  • the device status management DB 222 stores the cutoff judgment condition for the target communication device 300, with the information updated to "cutoff released" (S5-3). Then, the cutoff control unit 240 instructs the communication cutoff device 100 to release the cutoff of a specific communication between the communication device 300 and a terminal device, etc., based on the cutoff judgment condition (S5-4). Then, the communication cutoff device 100 releases the cutoff setting for the specific communication (S5-5).
  • the communication cutoff process according to the second embodiment can be realized by being separated into a plurality of devices, namely, the communication cutoff device 100 and the communication control device 200. Therefore, the communication cutoff process can be realized based on a flexible device configuration without being limited by the configuration or constraints of the communication network.
  • the items of the blocking judgment conditions such as No, the communication device side interface number of the communication blocking device, the terminal device side interface number of the communication blocking device, the VLAN ID, the EtherType, the source MAC address, the destination MAC address, the protocol number, the source IP address, the source port number, the destination IP address, the destination port number, and pass/block, which are stored in the device status management DB121 or the device status management DB221, etc., can be changed as desired.
  • the items of the communication device registration information stored in device status management DB121 or device status management DB221, such as the No., the communication device side interface number of the communication cutoff device, and the VLAN ID, can be changed as desired.
  • the process related to blocking is described as being performed by the communication blocking device 100 in the first embodiment and by the communication blocking device 100 and the communication control device 200 in the second embodiment, the present invention is not limited to this.
  • a functional unit that executes the process related to blocking may be implemented in another information processing device having a function different from that of the communication blocking device 100 and the communication control device 200.
  • the communication cutoff device 100 has been described as being configured to be directly connected to the end user's terminal device or communication device, but this is not limited to this and the device may be installed at any location on the communication path between the end user's terminal device and the communication device.
  • a communication device having the function of blocking specified communications may be placed in place of the communication blocking device 100.
  • the communication cutoff device 100 cuts off a predetermined communication between the terminal device 400 and the communication device 300, but the target communication is not particularly limited.
  • the communication cutoff device 100 or the communication control device 200 may cut off the predetermined communication as "all communication between the communication device in progress and the terminal device on the end user side", or "only communication including predetermined destination information", "only communication among broadcasts that reaches the communication device in progress", “only communication related to RA or ARP from the communication device in progress”, etc.
  • each component of each device shown in the figure is a functional concept, and does not necessarily have to be physically configured as shown in the figure.
  • the specific form of distribution and integration of each device is not limited to that shown in the figure.
  • all or part of them can be functionally or physically distributed and integrated in any unit depending on various loads, usage conditions, etc.
  • each component of each device shown in the figure is a functional concept, and does not necessarily have to be physically configured as shown in the figure.
  • the specific form of distribution and integration of each device is not limited to that shown in the figure, and all or a part of it can be functionally or physically distributed and integrated in any unit depending on various loads, usage conditions, etc.
  • each processing function performed by each device can be realized in whole or in any part by a CPU and a program analyzed and executed by the CPU, or can be realized as hardware using wired logic.
  • the various devices constituting the communication cutoff device 100 and the communication control device 200 can be implemented by installing a communication cutoff program as package software or online software on a desired computer.
  • the above-mentioned communication cutoff program can be executed by an information processing device to function as various devices constituting the communication cutoff device 100 and the communication control device 200.
  • the information processing device here includes desktop or notebook personal computers.
  • the information processing device also includes mobile communication terminals such as smartphones and mobile phones, and slate terminals such as PDAs (Personal Digital Assistants).
  • FIG. 10 is a diagram showing an example of a computer that executes the communication cutoff process according to this embodiment.
  • the computer 1000 has, for example, a memory 1010 and a CPU 1020.
  • the computer 1000 also has a hard disk drive interface 1030, a disk drive interface 1040, a serial port interface 1050, a video adapter 1060, and a network interface 1070. Each of these components is connected by a bus 1080.
  • the memory 1010 includes a ROM (Read Only Memory) 1011 and a RAM 1012.
  • the ROM 1011 stores a boot program such as a BIOS (Basic Input Output System).
  • BIOS Basic Input Output System
  • the hard disk drive interface 1030 is connected to a hard disk drive 1090.
  • the disk drive interface 1040 is connected to a disk drive 1100.
  • a removable storage medium such as a magnetic disk or optical disk is inserted into the disk drive 1100.
  • the serial port interface 1050 is connected to a mouse 1110 and a keyboard 1120, for example.
  • the video adapter 1060 is connected to a display 1130, for example.
  • the hard disk drive 1090 stores, for example, an OS 1091, an application program 1092, a program module 1093, and program data 1094. That is, the programs that define the processes of the various devices that constitute the communication cutoff device 100 and the communication control device 200 are implemented as program modules 1093 in which computer-executable code is written.
  • the program modules 1093 are stored, for example, in the hard disk drive 1090.
  • the program modules 1093 for executing processes similar to the functional configurations of the various devices that constitute the communication cutoff device 100 and the communication control device 200 are stored in the hard disk drive 1090.
  • the hard disk drive 1090 may be replaced by an SSD (Solid State Drive).
  • the setting data used in the processing of the above-mentioned embodiment is stored as program data 1094, for example, in memory 1010 or hard disk drive 1090.
  • the CPU 1020 reads out the program module 1093 or program data 1094 stored in memory 1010 or hard disk drive 1090 into RAM 1012 as necessary, and executes the processing of the above-mentioned embodiment.
  • the program module 1093 and program data 1094 are not limited to being stored in the hard disk drive 1090, but may be stored in a removable storage medium, for example, and read by the CPU 1020 via the disk drive 1100 or the like. Alternatively, the program module 1093 and program data 1094 may be stored in another computer connected via a network (such as a LAN or a WAN (Wide Area Network)). The program module 1093 and program data 1094 may then be read by the CPU 1020 from the other computer via the network interface 1070.
  • a network such as a LAN or a WAN (Wide Area Network)

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Data Exchanges In Wide-Area Networks (AREA)

Abstract

Un dispositif d'interruption de communication (100) met à jour, sur la base de réglages d'un dispositif de communication qui gère une communication à partir d'un dispositif terminal, une condition de détermination d'interruption à utiliser pour déterminer s'il faut ou non interrompre une communication spécifique entre le dispositif de communication et le dispositif terminal. Le dispositif d'interruption de communication (100) détermine s'il faut ou non interrompre une communication spécifique entre le dispositif de communication et le dispositif terminal sur la base de la condition de détermination d'interruption et d'informations relatives à la communication spécifique.
PCT/JP2023/030204 2023-08-22 2023-08-22 Dispositif d'interruption de communication Pending WO2025041280A1 (fr)

Priority Applications (2)

Application Number Priority Date Filing Date Title
PCT/JP2023/030204 WO2025041280A1 (fr) 2023-08-22 2023-08-22 Dispositif d'interruption de communication
JP2025541229A JPWO2025041280A1 (fr) 2023-08-22 2023-08-22

Applications Claiming Priority (1)

Application Number Priority Date Filing Date Title
PCT/JP2023/030204 WO2025041280A1 (fr) 2023-08-22 2023-08-22 Dispositif d'interruption de communication

Publications (1)

Publication Number Publication Date
WO2025041280A1 true WO2025041280A1 (fr) 2025-02-27

Family

ID=94731759

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/JP2023/030204 Pending WO2025041280A1 (fr) 2023-08-22 2023-08-22 Dispositif d'interruption de communication

Country Status (2)

Country Link
JP (1) JPWO2025041280A1 (fr)
WO (1) WO2025041280A1 (fr)

Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
JP2008015786A (ja) * 2006-07-06 2008-01-24 Hitachi Ltd アクセス制御システム及びアクセス制御サーバ
JP2018019160A (ja) * 2016-07-26 2018-02-01 富士通株式会社 ネットワーク制御装置、及び、アクセス制御方法
JP2018121320A (ja) * 2017-01-23 2018-08-02 アラクサラネットワークス株式会社 ネットワークシステム、及びネットワークコントローラならびにネットワーク制御方法
JP2020141359A (ja) * 2019-03-01 2020-09-03 日本電気株式会社 通信遮断方法、通信システム、装置とプログラム

Patent Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
JP2008015786A (ja) * 2006-07-06 2008-01-24 Hitachi Ltd アクセス制御システム及びアクセス制御サーバ
JP2018019160A (ja) * 2016-07-26 2018-02-01 富士通株式会社 ネットワーク制御装置、及び、アクセス制御方法
JP2018121320A (ja) * 2017-01-23 2018-08-02 アラクサラネットワークス株式会社 ネットワークシステム、及びネットワークコントローラならびにネットワーク制御方法
JP2020141359A (ja) * 2019-03-01 2020-09-03 日本電気株式会社 通信遮断方法、通信システム、装置とプログラム

Also Published As

Publication number Publication date
JPWO2025041280A1 (fr) 2025-02-27

Similar Documents

Publication Publication Date Title
US20230163999A1 (en) Method and apparatus for providing a point-to-point connection over a network
US7085827B2 (en) Integrated service management system for remote customer support
Hu et al. A survey on software-defined network and openflow: From concept to implementation
US7636364B2 (en) Redundant router network
US20020156828A1 (en) Integrated service management system
CN106487556B (zh) 业务功能sf的部署方法及装置
JP2015537261A (ja) 仮想マシン・マイグレーションを決定するための方法および装置
CN108512678B (zh) 一种基于overlay技术的实物设备接入虚拟网络的方法及系统
US11558246B2 (en) Implementing service function chains
CN104468254A (zh) 网络流量统计上报处理方法、装置、控制器及交换机
CN106797319B (zh) 网络服务感知路由器及其应用
TW201735579A (zh) 設定裝置、通信系統、通信裝置之設定更新方法及程式
CN111371608A (zh) 一种部署sfc业务链的方法、装置和介质
US9838218B2 (en) Method for providing overlay network interworking with underlay network and system performing same
CN110391987B (zh) 从运营商边缘设备集合中选择指定转发器的方法、设备及计算机可读介质
EP1479192B1 (fr) Procede et dispositif de gestion de la configuration d'un reseau
KR20180058594A (ko) Sdn/tap 어플리케이션
CN112671811B (zh) 一种网络接入方法和设备
KR101747032B1 (ko) 소프트웨어 정의 네트워킹 환경에서의 모듈형 제어 장치 및 그 동작 방법
CN116599840B (zh) 网络设备双上联管理配置方法、装置及存储介质
JP2022085642A (ja) 保守管理装置、保守管理システム及び保守管理方法
WO2020158533A1 (fr) Dispositif de commande et procédé de commande
JP2018019160A (ja) ネットワーク制御装置、及び、アクセス制御方法
KR102092091B1 (ko) 소프트웨어 정의 네트워크에서 고가용성 및 고신뢰성을 제공하는 방법, 장치 및 컴퓨터 프로그램
KR20180087614A (ko) Sdn 테스트베드 자동화 시스템 구조

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 23949741

Country of ref document: EP

Kind code of ref document: A1

ENP Entry into the national phase

Ref document number: 2025541229

Country of ref document: JP

Kind code of ref document: A

WWE Wipo information: entry into national phase

Ref document number: 2025541229

Country of ref document: JP

NENP Non-entry into the national phase

Ref country code: DE