JP3689083B2 - Network system and node device - Google Patents

Description

[0001]
BACKGROUND OF THE INVENTION
The present invention relates to a network system in a network using IP (Internet Protocol). as well as Node equipment In place Related.
[0002]
[Prior art]
The use of the Internet, which is a network using IP (Internet Protocol), is rapidly spreading. There are ISP (Internet Service Provider) and IX (Internet Exchange) as elements constituting the Internet.
[0003]
The ISP is a provider that provides Internet connection services and application services such as Web and mail to customers (customers) such as individuals and companies.
[0004]
IX is a business operator who has prepared a connection point for ISPs to mutually connect their own network and another ISP's network.
[0005]
An ISP is realized by connecting a plurality of devices called routers and terminals (Web server, mail server, etc.) that provide services. All devices including a router and a terminal connected to the router have an IP address as an identifier for specifying the device, and each IP address is used when data is transferred from each device to another device.
[0006]
The router device searches the routing table using the IP address added by the customer to determine the next transfer destination (Next Hop) of the data (packet). In this way, each router device performs packet forwarding (forwarding) to reach the final destination. Between router devices, routing information is exchanged by a routing protocol such as RIP, OSPF, BGP, etc., and a routing table is created and updated.
[0007]
Since the number of the aforementioned IP addresses is limited, there is a problem that the IP addresses that can be used as unique identifiers are exhausted as the number of devices connected to the Internet increases.
[0008]
To deal with this problem, ISPs and IX use private addresses that are used only within a limited range, such as within a company or ISP, in order to avoid wasting addresses (global addresses) that can be used as unique identifiers on the Internet. There is a case. However, if routing information of private addresses is transmitted to the Internet, address duplication may occur, and there is a risk of inconvenience in Internet routing information, so routing on the border router device that contacts the external network Protocol filtering must be used so that private addresses are not transmitted to the outside for each address.
[0009]
Another problem with the current Internet is security. There is a possibility that a malicious third party may intrude through the security holes of ISPs and routers and hosts in enterprises, and perform attacks such as stopping or restarting services and systems.
[0010]
Such an attack is based on the IP address of the router or host to be attacked. In a conventional Internet network configuration, it is possible to know the IP address of a router through which data passes with a command such as traceroute. In other words, if this command is used, a malicious third party can also know the IP address of the router or host in the ISP or IX, and there is a danger of being attacked.
[0011]
Also known is a router device and a frame transfer method that can connect networks such as Ethernet and can perform transfer processing at a frame level defined in a MAC (Media Access Control) layer. (For example, refer to Patent Document 1).
[0012]
Furthermore, in this type of IP network system, when a packet is generated, the Hop by Hop routing process is not performed, a shortcut VC is instantly created, the compatibility with existing ATM devices is improved, and the IP subnet is wasted. There is a known one (see, for example, Patent Document 2).
[0013]
Furthermore, in this type of IP network system, there is also known one that integrates security processing (see, for example, Patent Document 3).
[0014]
[Patent Document 1]
Japanese Patent No. 3272280
[0015]
[Patent Document 2]
Japanese Patent Laid-Open No. 11-68789
[0016]
[Patent Document 3]
JP2000-4255
[0017]
[Problems to be solved by the invention]
As described above, in the conventional ISP or IX network, when the global address is used for the network in the organization, the number of addresses provided to the customer is reduced accordingly.
[0018]
On the other hand, when securing a larger number of addresses to be provided to customers using private addresses in the organization, the routing router of the network composed of internal private addresses is not transmitted to the outside of the organization. It was necessary to set a route filter for each address by the device.
[0019]
In either case, the network configuration in the ISP or IX and the IP address assigned to the node are known to the outside, and there is a risk of being attacked by targeting a security hole from the outside.
[0020]
An object of the present invention is to secure a global address provided to a customer as much as possible and to improve security. as well as Node equipment Place It is to provide.
[0021]
[Means for Solving the Problems]
In order to solve the above problems, a network system according to the present invention is a network system in which first and second virtual routers are provided in a router device installed at a boundary between networks connected to each other.
The first virtual router and the second virtual router are:
The packet of the common address system received by the one border router device is encapsulated into a packet of the address system unique to the system, and the encapsulated packet is transferred from the one border router device to the other by the unique address system. The function to transfer to the border router device,
A function of decapsulating the packet encapsulated and transferred by the unique address system into a packet of the common address system and transferring the decapsulated packet to the outside of the system by the common address system;
It is characterized by having.
[0025]
In order to solve the above problems, a network system according to the present invention includes a first virtual router that operates in a common address system in a router device installed at a boundary between networks connected to each other and in an external node device. And a network system provided with a second virtual router that operates in an internal address system unique to the system,
The first virtual router and the second virtual router are:
A function of encapsulating the packet of the common address system in the packet of the unique address system, and forwarding the encapsulated packet to the other border router device or the node device in the unique address system;
And a function of decapsulating the packet encapsulated and transferred by the unique address system into a packet of the common address system and transferring the unencapsulated packet by the common address system.
[0026]
According to the present invention, packets are transferred in the system using a system-specific address system and transferred outside the system using a common address system, so that addresses of the common address system used can be saved.
[0027]
Also, according to the present invention, the packet is transferred inside the system by encapsulating the packet, and the packet is unencapsulated and transferred outside the system, so that the address of the unique address system is not transmitted outside the system. It is not necessary to set a route filter based on the routing protocol, and unauthorized intrusion by a malicious third party can be prevented in advance.
[0028]
DETAILED DESCRIPTION OF THE INVENTION
Hereinafter, embodiments of the present invention will be described with reference to the drawings.
[0029]
(First embodiment)
FIG. 1 shows an example of a configuration for realizing IX in the network system of the present invention.
[0030]
The network 102a is a network constituting one ISP, and there are devices such as the router 140a, and the network 102a constitutes one autonomous system (AS).
[0031]
Similarly, the network 102n is a network constituting one ISP, and there are devices such as the router 140n, and constitutes an AS managed independently from the network 102a.
[0032]
The network 101 is a network provided as an IX that connects ISPs, and connects the network 102a and the network 102n.
[0033]
In the network 101, there are an edge router 110a, a core router 120, and an edge router 110n.
[0034]
The edge router 110a is a router device located at the boundary between the IX 101 and the ISP 102a, and performs packet transfer from the router 140a to the core router 120 in the network 102a and packet transfer from the core router 120 to the router 140a. The edge router 110a has a virtual router 111a and a virtual router 113a inside, and each operates logically independently.
[0035]
The virtual router 111a is logically connected to the router 140a via the interface 112a and to the virtual router 111n via the interface 115a, and has a global address that enables communication with the router 140a and the virtual router 111n (all At least one of the interfaces accommodating a unique address that follows a common address system in the Internet.
[0036]
Further, the virtual router 111a obtains next router information for transferring a packet to a router or a host in the network 102a by exchanging information with the router 140a by IGP such as OSPF, for example, and obtains the result as a routing table. Store in 130a.
[0037]
Further, the virtual router 111a communicates with the virtual router 111n according to an inter-AS routing protocol such as BGP, for example, to transfer a packet to a host or router in the network 102n, That is, in this case, the virtual router 111n is obtained and the result is stored in the routing table 130a.
[0038]
As a result, the virtual router 111a searches the routing table 130a from the destination of the packet transferred from the router 140a or the virtual router 111n. If the next transfer destination is the router 140a, the virtual router 111a outputs the packet to the interface 112a. Is transferred to the interface 115a.
[0039]
The interface 112a adds a data link header to the packet output from the virtual router 111a, outputs the data link frame to the router 140a, deletes the data link header of the packet transferred from the router 140a, and transfers it to the virtual router 111a. I do. As the data link layer, Ethernet (R), ATM (Asynchronous Transfer Mode), POS (Packet over SONET), or the like can be considered.
[0040]
Here, in the case of a multi-access interface such as Ethernet (R) (connected to a plurality of routers with one interface), a global address is always added to the interface 112a, and a point-point interface such as POS (with one interface). In the case of (connected to one router), a global address may or may not be added.
[0041]
The interface 115a regards the network in the IX 101 as a virtual tunnel 150, and adds and deletes capsule information used when exchanging packets with the virtual router 111n via the network (tunnel interface). It is.
[0042]
In this logical interface, a plurality of exits of the tunnel 150 are prepared, and when connecting to a plurality of routers, a global address is always added, and when one exit of the tunnel 150 is connected to one router, The global address may or may not be added.
[0043]
For packets that are output from the virtual router 111a and transferred to the virtual router 111n, the tunnel correspondence table 130a is searched from the global address added to the interface accommodated in the virtual router 111n that is the next transfer destination. As a result, an address added to the interface accommodated in the virtual router 113n is obtained, capsule information is created from the obtained address, and then an encapsulated packet with tunnel information added to the head of the packet is created. The packet is transferred to 113a.
[0044]
On the other hand, the encapsulated packet transferred from the virtual router 113a is transferred to the virtual router 111a after the capsule information is deleted.
[0045]
The virtual router 113a is connected to the core router 120 via the interface 114a, and at least one virtual router 113a is added to any of the interfaces accommodating a unique address in the IX 101 that enables communication with the core router 120. Yes.
[0046]
The virtual router 113a obtains the next router information for transferring a packet to the router or host in the IX 101 by exchanging information with the core router 120 using an intra-AS routing protocol such as OSPF, and obtains the result. Store in the routing table 131a.
[0047]
The virtual router 113a outputs, to the interface 115a, a packet addressed to an address added to its own interface, which has been determined to be a packet encapsulated with a protocol ID or the like.
[0048]
In this manner, the virtual router 113a searches the routing table 131a from the destination of the packet input from the interface 115a, and outputs the packet to the interface 114a when the next transfer destination is the core router 120. The encapsulated packet input from the interface 114a is output to the interface 115a.
[0049]
The interface 114a performs the same processing as 112a, and the connection destination is the core router 120.
[0050]
Here, in the case of a multi-access interface such as Ethernet (R), the interface 112a always adds a unique address in the IX 101, and in the case of a point-point interface such as a POS, a unique address in the IX 101 is used. May or may not be added.
[0051]
The edge router 110n is a router device located at the boundary between the IX 101 and the ISP 102n, and performs packet transfer from the router 140n to the core router 120 and packet transfer from the core router 120 to the router 140n.
[0052]
As with the edge router 110a, the edge router 110n has a virtual router 111n and a virtual router 113n inside, and each operates logically independently.
[0053]
The virtual router 111n is logically connected to the router 140n via the interface 112n and logically connected to the virtual router 111a via the interface 115n, and accommodates a global address that enables communication with the router 140n and the virtual router 111a. At least one is added to any of the interfaces to be used.
[0054]
Similarly to the virtual router 111a, the virtual router 111n exchanges information with the router 140n using an intra-AS routing protocol (IGP) such as OSPF, and uses an inter-AS routing protocol such as BGP with the virtual router 111a. Information is exchanged and routing information is stored in the routing table 130n.
[0055]
Further, based on the routing table 130n, the virtual router 111n outputs a packet to the interface 112n when the next transfer destination is the router 140n from the destination of the packet transferred from the router 140n or the virtual router 113n, When the transfer destination is the virtual router 111a, it is output to the interface 115n.
[0056]
The interface 112n performs the same processing as the interface 112a, and the connection destination is the router 140b.
[0057]
Here, in the case of a multi-access interface such as Ethernet (R), a global address is always added to the interface 112n, and in the case of a point-point interface such as POS, a global address is added or not added. There is.
[0058]
The interface 115n is a logical interface that adds and deletes capsule information used when exchanging packets with the virtual router 111a via the tunnel 150, like the interface 115a, that is, a tunnel interface.
[0059]
In this logical interface, a plurality of tunnels 150 are prepared. When connecting to a plurality of routers, a global address is always added. When connecting one tunnel 150 and a single router, a global address is added. May or may not be added.
[0060]
For a packet input from the virtual router 111n and output to the virtual router 111a, based on the information in the tunnel correspondence table 132n, the tunnel information is added to the head of the packet and the packet is output to the virtual router 113n. On the other hand, the packet input from the virtual router 113n is output to the virtual router 111n after the capsule information is deleted.
[0061]
The virtual router 113n is connected to the core router 120 via the interface 114n, and at least one virtual router 113n is added to any of the interfaces accommodating a unique address in the IX 101 that enables communication with the core router 120. Yes.
[0062]
The virtual router 113a obtains the next router information for transferring a packet to the router or host in the IX 101 by exchanging information with the core router 120 using an intra-AS routing protocol such as OSPF, for example. Store in the routing table 131n.
[0063]
Further, the virtual router 113n outputs to the interface 115n what is found to be an encapsulated packet with a protocol ID or the like among the packets addressed to the address attached to its own interface.
[0064]
As described above, the virtual router 113n searches the routing table 131n from the destination of the packet transferred from the interface 115n, and when the next transfer destination is the core router 120, outputs the packet to the interface 114n. The encapsulated packet transferred from the interface 114n is output to the interface 115n.
[0065]
The interface 114n performs the same processing as 112a, and the connection destination is the core router 120.
[0066]
Here, in the case of a multi-access interface such as Ethernet (R), an interface 112n always adds a unique address in IX101, and in the case of a point-point interface such as POS, a unique address in IX101. May or may not be added.
[0067]
The core router 120 is a router device located in the IX 101, and performs packet transfer from the virtual router 113a to the virtual router 113n and packet transfer from the virtual router 113n to the router 113a.
[0068]
The core router 120 is connected to the virtual router 113a via the interface 121a, and is connected to the virtual router 113n via the interface 121n. In order to enable communication with other routers in the IX 101, at least one unique address in the IX 101 is added to each interface.
[0069]
Further, the core router 120 obtains the next router information for transferring a packet to the router or host in the IX 101 by exchanging information with the virtual router 113a or the virtual router 113n using an intra-AS routing protocol such as OSPF. The result is stored in the routing table 122.
[0070]
As a result, the core router 120 searches the routing table 122 from the destination of the packet transferred from the interface 121a, and when the next transfer destination is the virtual router 113n, outputs the packet to the interface 121n. Similarly, the routing table 122 is searched from the destination of the packet transferred from the interface 121n, and when the next transfer destination is the virtual router 113a, the packet is output to the interface 121a.
[0071]
The interface 121a and the interface 121n perform the same processing as the interface 112a, and the connection destinations are the virtual router 113a and the virtual router 113n, respectively.
[0072]
Here, in the interface 121a and the interface 121n, a unique address is always added in the IX 101 in the case of a multi-access interface such as Ethernet (R), and unique in the IX 101 in the case of a point-point interface such as a POS. May or may not be added.
[0073]
The tunnel 150 is a virtual link that makes it appear that the virtual router 111a and the virtual router 111n are logically directly connected. As for the packet transferred from the virtual router 111a to the virtual router 111n, the packet of the global address system is encapsulated into the packet of the address system in the IX 101 by the interface 115a, transferred to the virtual router 113n through the network in the IX 101, The encapsulated packet is decapsulated again to the original packet and reaches the virtual router 111n. The same applies to packet transfer from the virtual router 111n to the virtual router 111a.
[0074]
As described above, the virtual router 111a and the virtual router 111n can communicate with each other via the tunnel 150 without being aware of the network in the IX.
[0075]
FIG. 2 shows the routing table 130a in detail. This table is a route table in the global address space such as the addresses of the networks and hosts of the ISPs 102a and 102n and the addresses of the virtual router 111n.
[0076]
In this table, the final destination address, or the network address including the destination address, the address of the next router to be transferred to reach the destination address, and the set of output interfaces to be used for actual transfer are set as one set. Is remembered as
[0077]
When transferring a packet, the destination address column of the routing table 130a is searched using the destination address of the packet as a search key.
[0078]
When a matching column is found by the search, the next corresponding router address and output interface are obtained, and the packet is passed to the output interface.
[0079]
If no matching field is found by the search, an error message is created and sent back to the transfer source.
[0080]
As an example, the next transfer destination for the destination address G140n added to the router 140n is the address G115n of the interface 115n of the virtual router 111n, and the output destination interface is stored as the interface 115a.
[0081]
FIG. 3 shows the routing table 131a in detail. This table is a route table of a network configured by a unique address system inside the IX. Like the routing table 130a, the final destination address or the network address including the destination address, and transferred to reach the destination address. The next router address and the set of output interfaces used for actual forwarding are stored as one set. When transferring a packet, the destination address column of the routing table 130a is searched using the destination address of the packet as a search key.
[0082]
When a matching field is found by the search, the next corresponding router address and output interface are obtained, and the packet is passed to the output interface.
[0083]
If no matching field is found by the search, an error message is created and sent back to the transfer source.
[0084]
As an example, the next transfer destination for the destination address p114n added to the virtual router 131n is the address p121a of the interface 121a of the core router 120, and the output destination interface is stored as the interface 114a.
[0085]
FIG. 4 shows the tunnel correspondence table 132a in detail. This tunnel correspondence table is a table that is referred to when encapsulating a global address packet into an IX101 internal address system packet.
[0086]
When encapsulating a packet, the tunnel exit address field is searched using the address of the next transfer destination router of the packet transferred from the virtual router 111a as a key.
[0087]
When a matching field is found by the search, capsule information with the corresponding encapsulated address as the destination address is created, added to the packet, and transferred to the virtual router 131a.
[0088]
When no matching column is found by the search, an error is sent back to the virtual router 111a.
[0089]
As an example, the address p114n of the interface 114n of the virtual router 113n is stored as an encapsulated address corresponding to the address G115n of the interface 115n of the virtual router 111n serving as the tunnel exit address.
[0090]
The correspondence information between the tunnel exit address and the encapsulated address can be set in advance, and the correspondence information can be exchanged between the edge router 110a and the edge router 110n using a protocol for exchanging tunnel information. It is done.
[0091]
Reference numeral 501 in FIG. 5 indicates a packet when transmitted from the router 140a to the router 140n. The address G140n of the router 140n is set as the destination address of the packet header, and the address G140a of the router 140a is set as the source address. Both the address G140a and the address 140n are global addresses.
[0092]
601 in FIG. 6 is an example of tunnel information added to the packet 501 by the interface 115a. An address added to any interface accommodated in the virtual router 113n is added as a destination address. An address added to any of the interfaces accommodated in the virtual router 113a is added as a transmission source address. A protocol ID indicating that the packet to which the tunnel information is added is an encapsulated packet is also set.
[0093]
In this example, the address p114n of the interface 114n of the virtual router 113n is set as the destination address, and the address p114a of the interface 114a of the virtual router 113a is set as the transmission source address.
[0094]
Reference numeral 701 in FIG. 7 denotes a packet obtained by encapsulating the packet 501 with tunnel information 601.
[0095]
Here, an operation example when the packet 501 transferred from the router 140a of the ISP 102a is transferred to the router 140n of the ISP 102n in the IX 101 using the network system will be described using the flowchart of FIG.
[0096]
When the packet 501 of the global address is transferred from the router 140a and reaches the virtual router 111a, the virtual router 111a searches the routing table 130a based on the destination address G140n of the packet 501, and outputs the address and output of the next transfer destination router. An interface is obtained (S101).
[0097]
In this case, the next transfer destination address after the destination address G140n is G115n, and the output interface is found to be the interface 115a that forms the tunnel 150, and the packet 501 is output to the interface 115a (S102).
[0098]
If the output interface is not the interface 115a forming the tunnel 150, the packet 501 is transferred from the output interface (S103).
[0099]
The interface 115a searches the tunnel exit address field of the tunnel correspondence table 132a of FIG. 3 based on the address G115n of the next transfer destination router of the packet 501 input from the virtual router 111a.
[0100]
As a result of this search, it is found that the encapsulated address is the interface address p114n of the virtual router 113n, and tunnel information 601 is created based on this information. In this tunnel information, the destination address is set to p114n, and the source address is set to the address of any interface accommodated in the virtual router 113a, that is, in this example, the address p114a of the interface 114a. An ID indicating that the packet is encapsulated in the protocol ID is set.
[0101]
Further, the packet 501 is encapsulated with the created tunnel information to create a packet 701 and output it to the virtual router 113a (S104).
[0102]
That is, in the above-described processing, the interface 115a generates a packet 701 having an address system that can be used in the IX 101 from the packet 501 and forwards the packet based on the tunnel information 601 in the IX. That is, the ISP 102a or the like can be prevented from recognizing the network configuration inside the IX.
[0103]
The virtual router 113a searches the destination address column of the routing table 131a based on the destination address p114n of the packet 701 input from the interface 115a. As a result of this search, it is found that the address of the next transfer destination router corresponding to the destination address p114n is p121a and the output interface is 114a, and the packet 701 is output to the interface 114a (S105).
[0104]
Similarly, the core router 120 searches the routing table 122 to check and transfer the next transfer router of the packet 701.
[0105]
In this way, the packet 701 is transferred through the network inside the IX 101 and reaches the virtual router 113n (S106).
[0106]
The virtual router 113n receives the packet 701 whose destination address is the address of the interface accommodated by itself, and checks whether this is an encapsulated packet from its protocol ID (S107).
[0107]
If it is an encapsulated packet, it is output to the interface 115n (S109).
[0108]
If the packet is not an encapsulated packet, it is a packet processed by the upper layer of the virtual router 113n, that is, TCP, UDP, etc. by communication closed in the network in IX, and therefore processed by an appropriate upper layer in the virtual router 113n. (S108).
[0109]
The interface 115n removes the tunnel information portion 601 of the packet 701, returns to the state of the packet 501, and outputs it to the virtual router 111n (S110).
[0110]
The virtual router 111n refers to the routing table 130n based on the destination address G140n of the packet 501, and transfers the packet 501 to the next transfer destination router 140n, in this case, the final destination (S111).
[0111]
The packet 501 processed as described above is transferred from the router 140a of the ISP 102a to the router 140n of the ISP 102n.
[0112]
As described above, in this embodiment, a global address is added to the interface accommodated in the virtual router 111a and the interface accommodated in the virtual router 111n in the IX 101, but the internal interface of the IX 101 is assigned to the other router interfaces. Since the network is configured by adding a unique address, the global address to be used can be saved. This saving of the global address to be used is very effective particularly in the case of a system in which the scale of the network in IX is increased and the number of routers located in the internal network is increased.
[0113]
Further, in this embodiment, by using a technique for transferring the inside of IX by encapsulating the packet and decapsulating the packet outside the IX, the edge router does not transmit the address inside the IX to the outside of the IX. Therefore, there is no need to set a route filter by a routing protocol.
[0114]
Furthermore, in this embodiment, since it is possible to hide the network configuration inside IX and the IP address being used from the ISP outside IX, it is possible to prevent unauthorized intrusion by a malicious third party. It becomes possible.
[0115]
(Second Embodiment)
FIG. 9 shows an example of a configuration for realizing the ISP in the network system of the present invention.
[0116]
The network 901 is a network constituting one ISP, and is connected to the Internet 902 and provides an Internet connection service to the customer 903. The ISP 901 includes an edge router 910a, an edge router 910b, an edge router 910n, a core router 920, an application server 960, a monitoring device 961, and the like.
[0117]
The edge router 910 a is a router device located at the boundary between the ISP 901 and the customer 903, and performs packet transfer from the customer 903 to the core router 920 and packet transfer from the core router 920 to the customer 903.
[0118]
Similarly to the edge router in the first embodiment, the edge router 910a has a virtual router 911a and a virtual router 913a inside, and each operates logically independently.
[0119]
The virtual router 911a is logically connected to the customer 903 via the interface 912a and to the virtual router 911b and virtual router 911n via the interface 915a, and communicates with the customer 903, virtual router 911b, and virtual router 911n. Is added to at least one of the interfaces that accommodates the global address that enables this.
[0120]
The virtual router 911a enables communication by lending the customer 903 a global address held by the ISP 901. Which address is lent through which interface is stored in the routing table 930a.
[0121]
Furthermore, the virtual router 911a forwards the packet to the host or router in the Internet 902 obtained by the virtual router 911n by exchanging information with the virtual router 911n using an intra-AS routing protocol such as I-BGP. The information of the next router necessary for this purpose, that is, in this case, the virtual router 911n is obtained, and the result is stored in the routing table 930a.
[0122]
Similarly, the virtual router 911a transfers packets to the host or router in the ISP 901 obtained by the virtual router 911b by exchanging information with the virtual router 911b using an intra-AS routing protocol such as OSPF. The information of the next necessary router, that is, in this case, the virtual router 911n is obtained, and the result is stored in the routing table 930a.
[0123]
As a result, the virtual router 911a searches the routing table 930a from the destination of the packet transferred from the customer 903, the virtual router 911b, the virtual router 911n, and the like, and when the next transfer destination is the customer 903, the packet is sent to the interface 912a. Is output to the interface 915a when the next transfer destination is the virtual router 911b or the virtual router 911n.
[0124]
The interface 912a adds a data link header to the packet output from the virtual router 911a, outputs the data link frame to the customer 903, deletes the data link header of the packet transferred from the customer 903, and transfers the packet to the virtual router 911a. I do. As the data link layer, Ethernet (R), ATM, POS, or the like can be considered.
[0125]
Here, in the case of a multi-access interface such as Ethernet (R), a global address is always added to the interface 912a, and in the case of a point-point interface such as POS, a global address is added or not added. There is.
[0126]
The interface 915a is a logical interface for adding and deleting capsule information used when exchanging packets with the virtual router 911b and the virtual router 911n through the network in the ISP 901 as a virtual tunnel 950. That is, a tunnel interface.
[0127]
In this logical interface, a plurality of exits of the tunnel 950 are prepared. When connecting to a plurality of routers, a global address is always added, and when one exit of the tunnel 950 is connected to a single router, A global address may or may not be added.
[0128]
For a packet output to the virtual router 911n input from the virtual router 911a, the tunnel correspondence table 930a is searched from the global address added to the interface accommodated in the virtual router 911n as the next transfer destination. An address added to the interface accommodated in 913n is obtained, capsule information is created from the obtained address, an encapsulated packet with tunnel information added to the head of the packet is created, and the packet is output to the virtual router 913a.
[0129]
Similarly, for the packet output to the virtual router 911b input from the virtual router 911a, the tunnel correspondence table 930a is searched from the global address added to the interface accommodated in the virtual router 911b as the next transfer destination, An address added to the interface accommodated in the virtual router 913b is obtained, capsule information is created from the obtained address, an encapsulated packet with tunnel information added to the head of the packet is created, and a virtual router 913a packet is output.
[0130]
On the other hand, the encapsulated packet input from the virtual router 913a is output to the virtual router 911a after the capsule information is deleted.
[0131]
The virtual router 913a is connected to the core router 920 via the interface 914a, and at least one virtual router 913a is added to any interface that accommodates a unique address in the ISP 901 that enables communication with the core router 920. Yes.
[0132]
The virtual router 913a obtains the next router information for transferring a packet to the router or host in the ISP 901 by exchanging information with the core router 920 using an intra-AS routing protocol such as OSPF, and the result is obtained. Store in the routing table 931a.
[0133]
Also, the virtual router 913a outputs, to the interface 915a, a packet addressed to an address attached to its own interface, which has been determined to be a packet encapsulated with a protocol ID or the like.
[0134]
In this way, the virtual router 913a searches the routing table 931a from the destination of the packet input from the interface 915a, and outputs the packet to the interface 914a when the next transfer destination is the core router 920. The encapsulated packet input from the interface 914a is output to the interface 915a.
[0135]
The interface 914a performs the same processing as that of 912a, and the connection destination is the core router 920. Here, in the case of a multi-access interface such as Ethernet (R), the interface 912a always adds a unique address in the ISP 901, and in the case of a point-point interface such as POS, a unique address in the ISP 901 is added. May or may not be added.
[0136]
The edge router 910 b is a router device connected to the application server 960 existing in the ISP 901, and performs packet transfer from the application server 960 to the core router 920 and packet transfer from the core router 920 to the application server 960.
[0137]
Similarly to the edge router 910a, the edge router 910b has a virtual router 911n and a virtual router 913n inside, and each operates logically independently.
[0138]
In this example, the edge router 910 b is a router device connected to the monitoring device 961 existing in the ISP 901, and performs packet transfer from the monitoring device 961 to each monitoring target and packet transfer from each monitoring target to the monitoring device 961. .
[0139]
The virtual router 911b is logically connected to the application server 960 via the interface 912b and to the virtual router 911a and virtual router 911b via the interface 915n, and between the application server 960, virtual router 911a, and virtual router 911n. At least one is added to any interface that accommodates a global address that enables communication.
[0140]
The virtual router 911b exchanges information with the virtual router 911a and the virtual router 911n using an intra-AS routing protocol such as OSPF, and stores the routing information in the routing table 930b.
[0141]
Furthermore, based on the routing table 930b, the virtual router 911b outputs a packet to the interface 912b when the next transfer destination is the application server 960 from the destination of the packet transferred from the application server 960 or the virtual router 913n, When the next transfer destination is the virtual router 911a or the virtual router 911n, it is output to the interface 915b.
[0142]
The interface 912b performs the same processing as the interface 912a, and the connection destination is the application server 960. Here, in the case of a multi-access interface such as Ethernet (R), a global address is always added to the interface 912b, and in the case of a point-point interface such as POS, a case where a global address is added or not added. There is.
[0143]
Similar to the interface 915a, the interface 915b is a logical interface that adds and deletes capsule information used when exchanging packets with the virtual router 911a and the virtual router 911n via the tunnel 950, that is, a tunnel interface. In this logical interface, a plurality of exits of the tunnel 950 are prepared. When connecting to a plurality of routers, a global address is always added, and when one exit of the tunnel 950 is connected to a single router, A global address may or may not be added.
[0144]
For packets output from the virtual router 911b to the virtual router 911a and the virtual router 911n, tunnel information is added to the head of the packet based on the information in the tunnel correspondence table 932b and the packet is output to the virtual router 913b. .
[0145]
On the other hand, the packet input from the virtual router 913b is output to the virtual router 911b after the capsule information is deleted.
[0146]
The virtual router 913b is connected to the core router 920 via the interface 914b, and is connected to the monitoring device 961 via the interface 916b. At least one is added to any interface that accommodates a unique address in the ISP 901 that enables communication with the core router 920 and the monitoring device 961.
[0147]
Further, the virtual router 913b obtains the next router information for transferring the packet to the router or host in the ISP 901 by exchanging information with the core router 920 using an intra-AS routing protocol such as OSPF. Is stored in the routing table 931b.
[0148]
Further, the virtual router 913b outputs, to the interface 915b, the packet addressed to the address attached to its own interface, which is determined to be a packet encapsulated by the protocol ID or the like.
[0149]
As described above, the virtual router 913b searches the routing table 931b from the destination of the packet input from the interface 915b, and when the next transfer destination is the core router 920, outputs the packet to the interface 914b and the next transfer destination. Is the monitoring device 961, the packet is output to the interface 916b. Also, the encapsulated packet input from the interface 914b is output to the interface 915b.
[0150]
The interface 914b and the interface 916b perform the same processing as the interface 912a, and the connection destination is the core router 920 and the monitoring device 961.
[0151]
Here, in the interface 914b and the interface 916b, a unique address is always added in the ISP 901 in the case of a multi-access interface such as Ethernet (R), and unique in the ISP 901 in the case of a point-point interface such as a POS. May or may not be added.
[0152]
Further, the edge router 910b has a NAT (Network Address Translation) mechanism 935. As an example, when the monitoring device 961 tries to connect to the application server 960, a global address is added to the application server 960, a unique address in the ISP is added to the monitoring device 961, and different address systems are used. Therefore, it is a mechanism that solves the problem that normal communication is not possible.
[0153]
The NAT mechanism 935 has a function of address conversion so that communication from the application server 960 to the monitoring device 961 appears to be communication addressed to a specific communication port of the virtual router 911b, and communication from the monitoring device 961 to the application server 960 is a virtual router. It consists of three functions: a function for address conversion so as to appear as a communication addressed to a specific communication port of 913b, and a function for corresponding address conversion in the virtual router 911b and the virtual router 913b. With these functions, the monitoring device 961 and the application server 960 having different address systems in the ISP 901 can communicate with each other.
[0154]
The edge router 910n is a router device located at the boundary between the ISP 901 and the Internet 902. The edge router 910n is connected to the boundary router device on the Internet 902 side and the 940, and forwards packets from the router 940 to the core router 920 and to the router 940 from the core router 920. Packet transfer.
[0155]
Similarly to the edge router 910a, the edge router 910n has a virtual router 911n and a virtual router 913n inside, and each operates logically independently.
[0156]
The virtual router 911n is logically connected to the router 940 via the interface 912n and to the virtual router 911a and the virtual router 911b via the interface 915n, and enables communication with the router 940 and the virtual router 911a. At least one is added to any interface that accommodates the global address.
[0157]
The virtual router 911n exchanges information with the router 940 using an AS routing protocol such as BGP, and exchanges information with the virtual router 911a and the virtual router 911b using an intra-AS routing protocol such as OSPF. The routing information is stored in the routing table 930n.
[0158]
Further, based on the routing table 930n, the virtual router 911n outputs the packet to the interface 912n when the next transfer destination is the router 940 from the destination of the packet transferred from the router 940 or the virtual router 913n. When the transfer destination is the virtual router 911a or the virtual router 911b, the data is output to the interface 915n.
[0159]
The interface 912n performs the same processing as the interface 912a, and the connection destination is the router 940. Here, in the case of a multi-access interface such as Ethernet (R), a global address is always added to the interface 912n, and in the case of a point-point interface such as POS, a case where a global address is added or not added. There is.
[0160]
Similarly to the interface 915a, the interface 915n is a logical interface that adds and deletes capsule information used when packets are exchanged with the virtual router 911a via the tunnel 950, that is, a tunnel interface.
[0161]
In this logical interface, a plurality of exits of the tunnel 950 are prepared. When connecting to a plurality of routers, a global address is always added, and when one exit of the tunnel 950 is connected to one router, The global address may or may not be added.
[0162]
For packets that are input from the virtual router 911n and output to the virtual router 911a and the virtual router 911b, based on the information in the tunnel correspondence table 932n, tunnel information is added to the head of the packet and the packet is output to the virtual router 913n. .
[0163]
On the other hand, the packet input from the virtual router 913n is output to the virtual router 911n after the capsule information is deleted.
[0164]
The virtual router 913n is connected to the core router 920 via the interface 914n, and at least one virtual router 913n is added to any interface that accommodates a unique address in the ISP 901 that enables communication with the core router 920. Yes.
[0165]
The virtual router 913a obtains the next router information for transferring a packet to the router or host in the ISP 901 by exchanging information with the core router 920 using an intra-AS routing protocol such as OSPF, and the result is obtained. Store in the routing table 931n.
[0166]
Also, the virtual router 913n outputs to the interface 915n what is found to be an encapsulated packet with a protocol ID or the like among the packets addressed to its own interface.
[0167]
As described above, the virtual router 913n searches the routing table 931n from the destination of the packet transferred from the interface 915n, and when the next transfer destination is the core router 920, outputs the packet to the interface 914n. The encapsulated packet transferred from the interface 914n is output to the interface 915n.
[0168]
The interface 914n performs the same processing as the interface 912a, and the connection destination is the core router 920. Here, the interface 914n always adds a unique address in the ISP 901 in the case of a multi-access interface such as Ethernet (R), and the unique address in the ISP 901 in the case of a point-point interface such as a POS. May or may not be added.
[0169]
The core router 920 is a router device located in the ISP 901, and forwards packets from the virtual router 913a to the virtual router 913b and the virtual router 913n, forwards packets from the virtual router 913b to the virtual router 913a and virtual router 913n, and from the virtual router 913n. Packet transfer to the virtual router 913a and the virtual router 913b is performed.
[0170]
The core router 920 is connected to the virtual router 913a via the interface 921a, is connected to the virtual router 913b via the interface 921b, and is connected to the virtual router 913n via the interface 921n. In order to enable communication with other routers in the ISP 901, at least one unique address in the ISP 901 is added to each interface.
[0171]
The core router 920 is a next router for transferring a packet to a router or a host in the ISP 901 by exchanging information with the virtual router 913a, the virtual router 913b, or the virtual router 913n using an intra-AS routing protocol such as OSPF. Information is obtained and the result is stored in the routing table 922.
[0172]
As a result, the core router 920 searches the routing table 922 from the destination of the packet transferred from the interface 921a, and when the next transfer destination is the virtual router 913n, outputs the packet to the interface 921n.
[0173]
Similarly, the routing table 922 is searched from the destination of the packet transferred from the interface 921b or the interface 921n, and the packet is output to the interface according to the next transfer destination.
[0174]
The interface 921a, the interface 921b, and the interface 921n perform the same processing as the interface 912a, and the connection destinations are the virtual router 913a, the virtual router 913b, and the virtual router 913n, respectively. Here, in the interface 921a, the interface 921b, and the interface 121n, a unique address is always added in the ISP 901 in the case of a multi-access interface such as Ethernet (R), and the ISP 901 in the case of a point-point interface such as a POS. A unique address may or may not be added.
[0175]
The tunnel 950 is a virtual link that appears as if the virtual router 911a and the virtual router 911n are logically directly connected.
[0176]
As for the packet transferred from the virtual router 911a to the virtual router 911n, the packet of the global address system is encapsulated into the packet of the address system in the ISP 901 by the interface 915a, transferred to the virtual router 913n through the network in the ISP 901, and sent from the interface 915n. The encapsulated packet is decapsulated again to the original packet and reaches the virtual router 911n.
[0177]
The same applies to packet transfer from the virtual router 911n to the virtual router 911a.
[0178]
As described above, the virtual router 911a and the virtual router 911n can communicate with each other via the tunnel 950 without being aware of the network in the ISP 901.
[0179]
Similarly, between the virtual router 911a and the virtual router 911b and between the virtual router 911n and the virtual router 911b, it seems that they are directly connected to each other through the tunnel 950.
[0180]
The application server 960 is installed in the ISP 901 and is used as a mail server or Web server provided to the customer 903. Therefore, at least one is added to any of the interfaces that accommodate the global addresses so that the ISP 901 can be connected from the outside.
[0181]
The monitoring device 961 is a device for monitoring the state of the device in the ISP 901, and at least one unique address in the ISP 901 is added to any of the accommodated interfaces.
[0182]
FIG. 10 shows the routing table 930a in detail. Similar to the routing table of FIG. 2 described in the first embodiment, this table is a route table in the global address space, and reaches the final destination address or network address including the destination address. Thus, the address of the next router to be transferred and the set of output interfaces to be used for actual transfer are stored as one set. When transferring a packet, the destination address column of the routing table 930a is searched using the destination address of the packet as a search key.
[0183]
When a matching field is found by the search, the next corresponding router address and output interface are obtained, and the packet is passed to the output interface.
[0184]
If no matching field is found by the search, an error message is created and sent back to the transfer source.
[0185]
As an example, the next transfer destination for the destination address G940 added to the router 940n is the address G915n of the interface 915n of the virtual router 911n, and the output destination interface is stored as the interface 915a.
[0186]
FIG. 11 shows the routing table 931a in detail. Similar to the routing table of FIG. 3 described in the first embodiment, this table is a network routing table configured with an ISP's unique address system. Like the routing table 930a, this table is the final destination address or destination. The address of the network including the address, the address of the next router to be transferred to reach the address, and the set of output interfaces to be used for actual transfer are stored as one set. When transferring a packet, the destination address column of the routing table 930a is searched using the destination address of the packet as a search key.
[0187]
When a matching field is found by the search, the next corresponding router address and output interface are obtained, and the packet is passed to the output interface.
[0188]
If no matching field is found by the search, an error message is created and sent back to the transfer source.
[0189]
As an example, the next transfer destination for the destination address p914n added to the virtual router 931n is the address p921a of the interface 921a of the core router 920, and the output destination interface is stored as the interface 914a.
[0190]
FIG. 12 shows the tunnel correspondence table 932a in detail. The tunnel correspondence table is a table referred to when encapsulating a global address packet into an address system packet inside the ISP 901 as in the tunnel correspondence table of FIG. 4 described in the first embodiment.
[0191]
When encapsulating a packet, the tunnel exit address field is searched using the address of the next transfer destination router of the packet input from the virtual router 911a as a key.
[0192]
When a matching field is found by the search, capsule information with the corresponding encapsulated address as the destination address is created, added to the packet, and output to the virtual router 931a.
[0193]
When a matching column is not found by the search, an error is sent back to the virtual router 911a.
[0194]
As an example, the address p914n of the interface 914n of the virtual router 913n is stored as an encapsulated address corresponding to the address G915n of the interface 915n of the virtual router 911n serving as the tunnel exit address.
[0195]
The correspondence information between the tunnel exit address and the encapsulated address can be set in advance, or the mutual information can be exchanged between edge routers using a protocol for exchanging tunnel information.
[0196]
Reference numeral 1301 in FIG. 13 indicates a packet when transmitted from the customer 903 to the application server 960. The address G960 of the application server 960 is set as the destination address of the packet header, and the address G903 of the customer 903 is set as the transmission source address. Both address G960 and address G903 are global addresses.
[0197]
1401 in FIG. 14 is an example of tunnel information added to the packet 1301 by the interface 915a. An address added to one of the interfaces accommodated in the virtual router 913b is added as a destination address. An address added to any interface accommodated in the virtual router 913a is added as a transmission source address. A protocol ID indicating that the packet to which the tunnel information is added is an encapsulated packet is also set.
[0198]
In this example, the address p914b of the interface 914b of the virtual router 913b is set as the destination address, and the address p914a of the interface 914a of the virtual router 913a is set as the transmission source address.
[0199]
15 indicates a packet in which the packet 1301 is encapsulated with tunnel information 1401.
[0200]
Here, an operation example when the customer 903 connects to the application server 960 in the ISP 901 using the network system will be described using the flowchart of FIG.
[0201]
When the packet 1301 of the global address is transferred from the customer 903 and reaches the virtual router 911a, the virtual router 911a searches the routing table 930a based on the destination address G960 of the packet 1301, and the address and output interface of the next transfer destination router Is obtained (S201).
[0202]
In this case, it is found that the next transfer destination address of the destination address G960 is G915b and the output interface is the interface 915a forming the tunnel 950, and the packet 1301 is output to the interface 915a (S202).
[0203]
If the output interface is not the interface 915a forming the tunnel 950, the packet 1301 is transferred from the output interface (S203).
[0204]
The interface 915a searches the tunnel exit address column of the tunnel correspondence table 932a based on the address G915b of the next transfer destination router of the packet 1301 input from the virtual router 911a. As a result of the search, it is found that the encapsulated address is the interface address p914b of the virtual router 913b, and tunnel information 1401 is created based on this information. In the tunnel information, the destination address is set to p914b, and the source address is set to the address of any interface accommodated in the virtual router 913a, that is, in this example, the address p914a of the interface 914a. An ID indicating that the packet is encapsulated in the protocol ID is set. The packet 1301 is encapsulated with the created tunnel information to create a packet 1501 and output it to the virtual router 913a (S204).
[0205]
That is, in the interface 915a, a packet 1501 having an address system that can be used in the ISP 901 is generated from the packet 1301, and is transferred based on the tunnel information 1401 in the ISP. Can prevent the network configuration inside the ISP from being recognized.
[0206]
The virtual router 913a searches the destination address column of the routing table 931a based on the destination address p914b of the packet 1501 input from the interface 915a. As a result of this search, it is found that the address of the next transfer destination router corresponding to the destination address p914b is p921a and the output interface is 914a, and the packet 1501 is output to the interface 914a (S205).
[0207]
Similarly, the core router 920 searches the routing table 922 and checks the next transfer router of the packet 1501 and transfers it.
[0208]
In this way, the packet 1501 is transferred through the network inside the ISP 901 and reaches the virtual router 913b (S206).
[0209]
The virtual router 913b receives the packet 1501 whose destination address is the address of the interface accommodated by itself, and checks whether this is an encapsulated packet from its protocol ID (S207).
[0210]
If the packet is encapsulated, it is output to the interface 915b (S209).
[0211]
If it is not an encapsulated packet, it is a packet processed by the upper layer of the virtual router 913b, that is, TCP, UDP, etc. by communication closed in the network within the ISP, and therefore processed by an appropriate upper layer in the virtual router 913b. (S208).
[0212]
The interface 915b removes the tunnel information portion 1401 of the packet 1501, returns to the state of the packet 1301, and outputs it to the virtual router 911b (S210).
[0213]
The virtual router 911b refers to the routing table 930b based on the destination address G960 of the packet 1301, and transfers the packet 1301 to the next transfer destination application server 960, that is, in this case, the final destination (S211).
[0214]
In this way, the packet 1301 is transferred from the customer 903 to the application server 960.
[0215]
On the other hand, the packet flow from the application server 960 to the customer 903 is opposite to the above-described operation, and is encapsulated by the interface 915b and decapsulated by the interface 915a and transferred.
[0216]
As described above, in this embodiment, global addresses are added to the interfaces accommodated in the virtual router 911a, the virtual router 911b, and the virtual router 911n in the ISP 901 and the interface accommodated in the application server 960. Since the network is constructed by adding an address unique to the ISP to the router interface, the global address used by the ISP can be saved and the number of global addresses assigned to the customer can be increased. Such global address saving is particularly effective in a system in which the scale of the network in the ISP is large and the number of routers located in the internal network is increased.
[0217]
In this embodiment, the internal address of the ISP is transferred to the outside of the ISP at the edge router by using a technique for transferring the inside of the ISP by encapsulating the packet and decapsulating the packet outside the ISP. Therefore, there is no need to set a route filter by a routing protocol.
[0218]
Furthermore, in this embodiment, in order to provide a service such as a mail server or a Web server, the network configuration inside the ISP other than the device that allows connection from outside the ISP, and the IP address used are hidden from the network outside the ISP and customers. And the possibility of an attack from a malicious third party can be kept low.
[0219]
(Third embodiment)
As a third embodiment, in the network system of the present invention, there are three independently operated virtual routers in the IX described in the first embodiment and the ISP edge router described in the second embodiment. A configuration example in the case of having it will be described.
[0220]
FIG. 17 shows a configuration example for realizing ISP connection.
[0221]
The network 1702a is a network constituting one ISP, and there are devices such as the edge router 1710a, the edge router 1710b, and the core router 1720b, and the network 1702a constitutes one AS.
[0222]
The network 1702n is a network constituting one ISP, and devices such as an edge router 1710n and a core router exist, and the network 1702n constitutes one AS.
[0223]
The network 1701 is a network provided as an IX that connects the ISP 1702a and the ISP 1702n, and includes a core router 1720a, a virtual router 1716a, and a virtual router 1713n.
[0224]
The edge router 1710b has the same configuration as the edge router described in the first embodiment and the second embodiment, and performs the same operation.
[0225]
At least one global address is added to any of the interfaces accommodated by the virtual router 1711b, and an address unique within at least one ISP 1702a is added to any of the interfaces accommodated by the virtual router 1713b. The virtual router has a routing table of each address system, and obtains the address and output interface of the next transfer destination router based on the destination address and performs packet transfer.
[0226]
The interface 1715b exists between the virtual router 1711b and the virtual router 1713b, refers to the tunnel correspondence table using the destination address of the packet input from the virtual router 1711b as a key, creates tunnel information, and adds the packet capsule. And output to the virtual router 1713b. Further, the encapsulated packet input from the virtual router 1713b is decapsulated and output to the virtual router 1711b.
[0227]
As described above, the packet is transferred inside the ISP 1702a using an address system unique to the ISP 1702a different from the outside.
[0228]
In the third embodiment, the edge router 1710a has a virtual router 1711a, a virtual router 1713a, and a virtual router 1716a inside, and these operate logically independently.
[0229]
At least one global address is added to any of the interfaces accommodated by the virtual router 1711a, and an address unique within at least one ISP 1702a is added to any of the interfaces accommodated by the virtual router 1713a.
[0230]
Similarly, in the virtual router 1716a, at least one IX 1701 unique address is added to any of the accommodated interfaces. The virtual router has a routing table of each address system, and obtains the address and output interface of the next transfer destination router based on the destination address and performs packet transfer.
[0231]
The interface 1715a exists between the virtual router 1711a and the virtual router 1713a, refers to the tunnel correspondence table using the destination address of the packet input from the virtual router 1711a as a key, creates tunnel information, and adds the packet capsule. And output to the virtual router 1713a. Also, the encapsulated packet input from the virtual router 1713a is decapsulated and output to the virtual router 1711a.
[0232]
In this way, packets are transferred in the ISP 1702a using an ISP 1702a unique address system different from the global address.
[0233]
Similarly, the interface 1717a exists between the virtual router 1711a and the virtual router 1716a. By referring to the tunnel correspondence table using the destination address of the packet input from the virtual router 1711a as a key, the tunnel information is created and added to the packet. Is output to the virtual router 1716a. Further, the encapsulated packet input from the virtual router 1716a is decapsulated and output to the virtual router 1711a. In this way, packets are transferred within the IX 1701 using an address system unique to the IX 1701 different from the global address.
[0234]
The edge router 1710n has the same configuration as the edge router described in the first embodiment or the second embodiment, and performs the same operation.
[0235]
At least one global address is added to any of the interfaces accommodated by the virtual router 1711n, and an address unique within at least one IX 1701 is added to any of the interfaces accommodated by the virtual router 1713n. The virtual router has a routing table of each address system, and obtains the address and output interface of the next transfer destination router based on the destination address and performs packet transfer.
[0236]
The interface 1715n exists between the virtual router 1711n and the virtual router 1713n, refers to the tunnel correspondence table with the destination address of the packet input from the virtual router 1711n as a key, creates and adds tunnel information, and encapsulates the packet. And output to the virtual router 1713n. Also, the encapsulated packet input from the virtual router 1713n is decapsulated and output to the virtual router 1711n.
[0237]
As described above, packet transfer is performed inside the IX 1701 using an address system unique to the IX 1701 different from the outside.
[0238]
Reference numeral 1801 in FIG. 18 indicates a packet transmitted from the host 1703a to the host 1703n. The address G1703n of the host 1703n is set as the destination address of the packet header, and the address G1703a of the host 1703a is set as the source address. Both the address G1703a and the address G1703n are global addresses.
[0239]
1901 in FIG. 19 is a packet that is encapsulated with tunnel information added to transfer the packet 1801 to the network in the ISP 1702a in the interface 1715b.
[0240]
20 in FIG. 20 is an example of tunnel information added to the packet 1801 by the interface 1717a. An address added to one of the interfaces accommodated in the virtual router 1713n is added as a destination address. An address added to any interface accommodated in the virtual router 1716a is added as a transmission source address. A protocol ID indicating that the packet to which the tunnel information is added is an encapsulated packet is also set.
[0241]
In this example, the address p1713n added to the interface of the virtual router 1713n is set as the destination address, and the address p1714a added to the interface of the virtual router 1716a is set as the source address.
[0242]
Reference numeral 2101 in FIG. 21 indicates a packet obtained by encapsulating the packet 1801 with tunnel information 2001.
[0243]
Here, an example of the operation of the edge router 1710a will be described with respect to packet transfer from the host 1703a to the host 1703n in this embodiment with reference to the flowchart of FIG.
[0244]
In this embodiment, as in the first and second embodiments, the packet 1801 transferred from the host 1703a is encapsulated in the address system inside the ISP 1702a at the interface 1715b of the edge router 1710b of the ISP 1702a. The packet 1901 is transferred to the virtual router 1713a of the edge router 1710a.
[0245]
The virtual router 1713a checks whether or not this is an encapsulated packet from the protocol ID of the received packet 1901. (S301).
[0246]
If it is an encapsulated packet, it is output to the interface 915b.
[0247]
If it is not an encapsulated packet, it is a packet processed by the upper layer of the virtual router 1713a, that is, TCP, UDP, etc. by communication closed by the network in the ISP 1702a, and therefore processed by an appropriate upper layer in the virtual router 1713a. (S302).
[0248]
The interface 1715a removes the tunnel information portion of the packet 1901, returns to the state of the packet 1801, and outputs it to the virtual router 1711a (S303).
[0249]
The virtual router 1711a checks whether the received packet 1801 is a packet addressed to the virtual router 1711a. (S304).
[0250]
If it is a packet addressed to itself, it is a packet processed by the upper layer of the virtual router 1711a, that is, TCP, UDP, etc. in communication in the global address space, so that it is processed by an appropriate upper layer in the virtual router 1713a. Entrust (S305).
[0251]
If the packet is not addressed to itself, the virtual router 1711a searches the routing table of the virtual router 1711a using the destination address of the packet 1801 as a key, and investigates the address and output interface of the next transfer destination router (S306).
[0252]
In this case, the address of the next transfer destination router is the address G1711n of the virtual router 1711n, the output interface is 1717a (S307), and the virtual router 1711a outputs the packet 1801 to the interface 1717a.
[0253]
If the output interface is different, the packet 1801 is transferred from the interface (S308).
[0254]
The interface 1717a searches the tunnel correspondence table of itself based on the address G1711n of the next transfer destination router of the packet 1801 input from the virtual router 1711a. As a result of the search, it is understood that the encapsulated address is the address p1713n added to the interface of the virtual router 1713n, and tunnel information 2001 is created based on this information. In the tunnel information, the destination address is set to p1713b, and the transmission source address is set to the address of any interface accommodated in the virtual router 1716a. An ID indicating that the packet is encapsulated in the protocol ID is set. The packet 1801 is encapsulated with the created tunnel information to create a packet 2101 and output it to the virtual router 1716a (S309).
[0255]
That is, in the interface 1717a, a packet 2101 having an address system that can be used in the IX 1701 is generated from the packet 1801 and transferred in the IX based on the tunnel information 2001. Therefore, upstream of the virtual router 1711a, that is, the customer 1703 or It is possible to prevent the router in the ISP 1702a from recognizing the network configuration inside the IX 1701.
[0256]
The virtual router 1716a searches its own routing table using the destination address of the packet 2101 as a key, and checks the address and output interface of the next transfer destination router. In this case, the next transfer destination router is the core router 1720a, and the packet 2101 is transferred (S310).
[0257]
As described above, in this embodiment, it is possible to eliminate the use of global addresses in the network in IX by introducing three virtual routers in the edge router of the ISP connection unit. The use of a global address can be saved even more than in the second embodiment.
[0258]
(Fourth embodiment)
In the network system of the present invention, the fourth embodiment is a case where a Multi Protocol Label Switching (MPLS) network is used in the internal network of IX described in the first embodiment.
[0259]
In the first embodiment, the tunnel 150 in FIG. 1 is realized by encapsulating a global address system packet transmitted from the outside of the IX 101 into a packet to which an address system header in the IX 101 is added. In the embodiment, a tunnel 150 is realized by constructing an internal network of the IX 101 with an MPLS network and setting an LSP (Label Switched Path).
[0260]
For the packet transferred to the virtual router 111n output from the virtual router 111a in the interface 115a, label information corresponding to the virtual router 111n to be the next transfer destination is created, and encapsulation is performed by adding label information to the head of the packet Create a packet and output the packet to the virtual router 113a. On the other hand, the encapsulated packet transferred from the virtual router 113a is output to the virtual router 111a after the label information is deleted.
[0261]
There is also a method in which the virtual router 113a double-encapsulates and forwards the packet with a label for forwarding to the virtual router 113n specialized for the network inside the IX101. Also, in this case, in the core router 120 in front of the virtual router 113n serving as the exit, a label specialized for the network inside the IX101 is removed from the double-encapsulated label and transferred to the virtual router 113n. In the virtual router 113n, there is a method of removing a label specialized for the network inside the IX101 from the double encapsulated label.
[0262]
An effect similar to that of the first embodiment is realized by adding an MPLS label to a packet having a global address system transmitted from the outside of the IX 101 and transferring the label within the network inside the IX 101.
[0263]
(Fifth embodiment)
The fifth embodiment is a case where an MPLS network is used in the internal network of the ISP described in the second embodiment in the network system of the present invention.
[0264]
In the second embodiment, the tunnel 950 of FIG. 9 is realized by encapsulating the IS into a packet with the address system header in 901 added to the packet of the global address system transmitted from outside the ISP 901. In this embodiment, the tunnel 950 is realized by constructing an internal network of the ISP 901 with an MPLS network and setting an LSP.
[0265]
In the interface 915a, for a packet transferred to the virtual router 911n output from the virtual router 911a, label information corresponding to the virtual router 911n to be the next transfer destination is created, and the label information is added at the head of the packet Create a packet and output the packet to the virtual router 913a. On the other hand, the encapsulated packet transferred from the virtual router 913a is output to the virtual router 911a after the label information is deleted.
[0266]
In addition, there is a method in which the virtual router 913a encapsulates and transfers the packet in duplicate with a label for transferring to the virtual router 913n specialized for the network inside the ISP 901. Also, in this case, in the core router 920 before the virtual router 913n serving as the exit, a label specialized for the network inside the ISP 901 is removed from the double-encapsulated label and transferred to the virtual router 913n. In the virtual router 913n, there is a method of removing a label specialized for the network inside the ISP 901 from the double encapsulated label.
[0267]
An effect similar to that of the second embodiment is realized by adding an MPLS label to a packet having a global address system transmitted from the outside of the ISP 901 and transferring the label within the network inside the ISP 901.
[0268]
(Sixth embodiment)
The sixth embodiment is a case where an MPLS network is used in the ISP connection unit described in the third embodiment in the network system of the present invention.
[0269]
In the third embodiment, the ISP connection unit 1701 realizes a tunnel by encapsulating a packet with a global address system transmitted from the ISP 1702a or ISP 1702n into a packet to which a header of the address system of the ISP connection unit is added. In this embodiment, a tunnel is realized by constructing an internal network of the ISP connection unit 1701 with an MPLS network and setting an LSP.
[0270]
For the packet transferred to the virtual router 1711n output from the virtual router 1711a in the interface 1717a, label information corresponding to the virtual router 1711n as the next transfer destination is created, and encapsulation is performed by adding label information to the head of the packet Create a packet and output the packet to the virtual router 1716a. On the other hand, the encapsulated packet transferred from the virtual router 1716a is output to the virtual router 1711a after the label information is deleted.
[0271]
Further, there is a method in which the virtual router 1716a double-encapsulates and transfers the packet with a label for transferring to the virtual router 1713n specialized for the network inside the IX connection unit 1701. Also, in this case, in the core router 1720a before the virtual router 1713n serving as the exit, the label specialized for the network inside the ISP connection unit 1701 is removed from the double encapsulated label and transferred to the virtual router 1713n. There is a method of removing a label specialized for the network inside the ISP connection unit 1701 from the double encapsulated label in the virtual router 1713n.
[0272]
The same effect as that of the third embodiment is realized by adding an MPLS label to a packet having a global address system transmitted from the outside of the ISP connection unit 1701 and transferring the label inside the network of the ISP connection unit 1701. .
[0273]
Furthermore, the configuration of the router device according to the present invention can be configured by one or a plurality of computers or functions of a part of these computers.
[0274]
Further, the method or program in which the flows of FIGS. 8, 16, and 22 are implemented may be configured as software executed by a computer or the like.
[0275]
【The invention's effect】
As described above, according to the present invention, an ISP or IX introduces a network having an IP address space that is independent from the outside in the organization, so that a complicated routing protocol filter in the border router device is not set. Reduce the number of global addresses used in the organization, secure as many global addresses as possible to be provided to customers, and improve security by preventing external notification of the network configuration in the organization and the IP addresses used. Get network system as well as Node equipment Place It can be provided.
[Brief description of the drawings]
FIG. 1 is a diagram illustrating a configuration example for realizing IX in a network system according to a first embodiment of this invention.
FIG. 2 is a diagram showing in detail a routing table in the embodiment.
FIG. 3 is a diagram showing in detail a routing table in the embodiment.
FIG. 4 is a diagram showing in detail a tunnel correspondence table in the embodiment.
FIG. 5 is a view showing an example of a packet in the embodiment.
FIG. 6 is a view showing an example of tunnel information in the embodiment.
FIG. 7 is a view showing an encapsulated packet in the embodiment.
FIG. 8 is a flowchart showing an example of an operation for transferring the packet to the router 140 according to the embodiment;
FIG. 9 is a diagram showing a configuration example for realizing ISP in the network system according to the second embodiment of this invention;
FIG. 10 is a diagram showing in detail a routing table in the embodiment.
FIG. 11 is a diagram showing in detail a routing table in the embodiment;
FIG. 12 is a view showing in detail a tunnel correspondence table in the embodiment;
FIG. 13 is a view showing a packet in the embodiment.
FIG. 14 is a diagram showing an example of tunnel information in the embodiment.
FIG. 15 is a view showing an encapsulated packet in the embodiment;
FIG. 16 is an exemplary flowchart illustrating an operation example in the network system according to the embodiment;
FIG. 17 is a diagram showing a configuration example for realizing ISP connection in a network system according to a third embodiment of the present invention;
FIG. 18 is a view showing a packet in the embodiment;
FIG. 19 is a view showing an encapsulated packet in the embodiment;
FIG. 20 is a diagram showing an example of tunnel information in the embodiment.
FIG. 21 is a view showing an encapsulated packet in the embodiment;
FIG. 22 is a flowchart showing an operation example of the edge router in the embodiment;
[Explanation of symbols]
DESCRIPTION OF SYMBOLS 101 ... Network (IX), 102a, 102n ... Network (ISP), 140a, 140n ... Router, 110a, 110n ... Edge router, 111a, 111n ... Virtual router, 112a, 112n ... Interface, 113a, 113n ... Virtual router, 114a , 114n ... interface, 115a, 115n ... interface, 120 ... core router, 121a, 121n ... interface, 122 ... routing table, 130a, 130n ... routing table, 131a, 131n ... routing table, 132a, 132n ... tunnel correspondence table, 150 ... Tunnel, 501 ... packet, 601 ... tunnel information, 701 ... encapsulated packet.

Claims (5)

A network system in which first and second virtual routers are provided in a router device installed at a boundary between networks connected to each other,
The first virtual router and the second virtual router are:
The packet of the common address system received by the one border router device is encapsulated into a packet of the address system unique to the system, and the encapsulated packet is transferred from the one border router device to the other by the unique address system. The function to transfer to the border router device,
A function of decapsulating the packet encapsulated and transferred by the unique address system into a packet of the common address system and transferring the decapsulated packet to the outside of the system by the common address system. A network system characterized by The first virtual router that operates with a common address system in the router device installed inside the router device installed at the boundary between the networks connected to each other and the internal node device that enables communication with the external node device, and the system internal unique A network system provided with a second virtual router that operates in the address system of
The first virtual router and the second virtual router are:
A function of encapsulating the packet of the common address system in the packet of the unique address system, and forwarding the encapsulated packet to the other border router device or the node device in the unique address system;
A network having a function of decapsulating a packet encapsulated and transferred by the unique address system into a packet of the common address system, and transferring the unencapsulated packet by the common address system. system. A node device that is installed at the boundary between networks connected to each other, and that links a first virtual router that operates with a common address system and a router device that includes a second virtual router that operates with an internal address system unique to the system. In
A first virtual router that operates with a common address system and a second virtual router that operates with an internal address system unique to the system, and these first and second virtual routers send packets of the common address system to the original Having a function of encapsulating the packet into a packet of the address system, and transferring the encapsulated packet to the other border router device or the node device with the unique address system,
A logical interface that connects virtual routers in the border router device or the node device is provided. The logical interface encapsulates and transfers packets encapsulated in the unique address system to packets in the common address system. A node device having a function of encapsulating and transferring the unencapsulated packet by the common address system. In addition to the first and second virtual routers, a third virtual router that operates in the common address system, and a network system that is connected to the third virtual router and is outside the network system. A fourth virtual router that operates with a common address system,
The third virtual router and the fourth virtual router are:
The packet of the common address system received by one border router device is encapsulated into a packet of a common address system between network systems outside the network system, and the encapsulated packet is encapsulated in the common address system And the function of transferring from one border router device to another border router device,
Packets encapsulated and transferred with a common address system between network systems outside the network system are decapsulated into packets with the common address system, and the unencapsulated packets are transmitted with the common address system. network system according to claim 1 or 2 characterized in that it has a function of transferring to the outside of the system. The network system according to any one of claims 1, 2 and 4 , wherein the network part constructed with the unique address system is constructed with a Multi Protocol Label Switching network.

Images