KR101401013B1 - METHOD AND METHOD FOR PROCESSING PACKET - Google Patents

Abstract

A method and apparatus for processing data packets transmitted and received on a network device for transmitting and receiving data between a plurality of systems, the method comprising the steps of: receiving a data packet from a first system on a first layer defined by a physical layer; Determines whether some information of the received data packet is present in the packet forwarding table provided in the network device, performs security processing in cooperation with a security module operating in the second layer, The destination information of the data packet is extracted and converted into a data packet of the transmission type and transmitted to the destination, thereby enabling rapid packet forwarding while performing the network security function.

Description

TECHNICAL FIELD [0001] The present invention relates to a packet processing method and a network device,

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to a method for processing data packets transmitted and received on a network device that transmits and receives data between a plurality of systems or devices, And a packet processing method using the same.

 Packet forwarding is a sequence of operations that is performed by a switching or routing device that connects various networks, and uses the header information of the incoming packet to send packets to the final destination network. In the early days of using the Internet, only packet header information of Layer 2 and Layer 3 was used. In recent years, however, packet classification is performed referring to the header of Layer 4 and quality of streaming of audio and video streaming, Security, firewall, IPS (Intrusion Prevention System), switching, and so on. That is, the amount of data processed during packet forwarding is increased.

On the other hand, although the high-speed Internet infrastructure has been established in recent years, the Internet transmission speed experienced by users is not as fast as the established infrastructure. As one of the causes, as the amount of mobile data and the amount of data of internet contents increased due to the increase of smart devices, the number of packets transmitted through the Internet network increases, and the performance of data transmission is limited due to occupying the network bandwidth. Also, as the amount of processing data increases during packet forwarding used in the packet forwarding step, time and resources required for packet forwarding increase. In other words, in the case of packet forwarding in network security equipment, various operations related to security such as determination of permission / denial of packet, pattern inspection and encryption are required, and when using existing packet forwarding technology, The performance of packet forwarding is inferior due to the equipment.

That is, there is a need for a packet forwarding technique that operates quickly even on packet transmission systems equipped with network security equipment.

In order to solve the above-described problems, the present invention provides a network device equipped with a packet accelerator so that a packet forwarding technique that has been processed on an existing network layer can be performed on a lower layer.

The present invention provides a network device equipped with a packet accelerator capable of performing all newly required packet processing operations in cooperation with various security modules and routing modules processed in a network security device and simplifying processing time.

A method for processing data packets transmitted and received on a network device for transmitting and receiving data between a plurality of systems according to an embodiment of the present invention includes transmitting data packets to and from a plurality of systems on a first layer defined as a physical layer Receiving a data packet from a first of the plurality of systems; Determining whether some information of the received data packet exists in a packet forwarding table provided in the network device; Performing security processing in cooperation with a security module operating in a second layer higher than the first layer with respect to the received data packet when some information of the received data packet exists in the packet forwarding table ; Extracting destination information of the received data packet from the packet forwarding table and converting the received data packet into a data packet of a transmission type; And transmitting the security-processed data packet of the transmission type to the second one of the plurality of systems.

A network device for processing data packets transmitted and received in order to transmit and receive data between a plurality of systems according to an embodiment of the present invention includes a first layer on which data is transmitted and received, An interface for receiving a data packet from a first one of the plurality of network devices, and determining whether a part of the received data packet is present in a packet forwarding table provided in the network device, And if the data packet is present in the table, performs security processing in cooperation with a security module operating in a second layer higher than the first layer with respect to the received data packet, Extracts the received data packet To a data packet of a transmission type, and the interface unit transmits the securely processed data packet of the transmission type to the second one of the plurality of systems.

 According to the present invention, packet forwarding is possible even on a device equipped with a network security device.

According to the present invention, packet forwarding, which reflects the change information by interlocking with the security module and the routing module, is also possible.

FIG. 1 is a view illustrating a flow of a data packet passing through a physical layer with respect to a packet processing method according to an embodiment of the present invention.
2 is a data flow diagram of an operation for processing a new packet not stored in the packet forwarding table on the packet processing method according to an embodiment of the present invention.
3 shows an example of data stored on a packet transfer table according to an embodiment of the present invention.
4 is a data flow diagram of an operation for processing packets stored in a packet forwarding table on a packet processing method according to an embodiment of the present invention.
5 is a flowchart of a packet processing method according to an embodiment of the present invention.

DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS Hereinafter, preferred embodiments of the present invention will be described in detail with reference to the accompanying drawings. However, the detailed description of known functions and configurations incorporated herein will be omitted when it may unnecessarily obscure the subject matter of the present invention.

FIG. 1 is a view illustrating a flow of a data packet passing through a physical layer with respect to a packet processing method according to an embodiment of the present invention. Referring to FIG. 1, a data packet is transmitted and received from a client device 200 to a server 300 according to an embodiment of the present invention. Meanwhile, the necessary packet processing is performed on the data packet via the physical interface 40, the physical layer 10 and the upper layer 20 of the physical layer 10 along the first path 5.

On the other hand, the first path 5 may be a flow of data packets that a data packet has to go through to perform security processing and routing processing on a device equipped with network security equipment. The physical layer 10 is a physical layer that is the lowest layer among 7 Open System Interconnection (OSI) layers, for example, a network communication model established by the International Organization for Standardization (ISO). The OSI 7 layer is a model set up for mutual communication between the client apparatus 200 and the server 300, which are two different systems illustrated in FIG. 1, and the client apparatus 200, the server 300, Lt; RTI ID = 0.0 > NIC < / RTI > The second layer 20 of the present invention may be an upper layer than the physical layer 10 and the second layer may be composed of a data link layer and a network layer among OSI layers . In the second layer, a data frame can be used to specify a path for transmitting the data frame to another system on the network. The second layer can be formed as a bridge or a router, or an arbitrary Device. In addition, a security module such as an FW (Firewall) 110, an Intrusion Prevention System (IPS) 120 and a Network Address Translation (NAT) 130 may operate on the second layer to perform a security function. Also, in the present invention, a routing module 140 for operating in the second layer 20 and setting a path of a data packet may be provided. Meanwhile, the upper layer 30 of the second layer 20 may include a transparent layer, an application layer, or the like, and a description thereof will be omitted.

The FW module 110 determines whether or not to permit the communication request from the client device 200 to the server 300, and passes or blocks the data for the communication request message according to the determination result. At this time, the FW module 110 passes or blocks the packet using the address information such as the domain name or the IP address of the source and destination of the packet to be received.

The IPS module 120 performs intrusion detection on header information and data of a data packet, and stores log information on intrusion detection if necessary.

The NAT module 130 can maintain the public IP address by converting the source / destination address of the data packet according to a predetermined rule, for example, an address translation table, or can disconnect or communicate between the internal network and the external network only for a specific route have. The NAT module 130 may be included in the routing module 140 or the firewall module 110 and may operate.

The routing module 140 may change the MAC address or the like based on the final packet delivery path for packets secured by the security module such as the FW module 110, the IPS module 120 and the NAT module 130 .

As illustrated in FIG. 1, in the conventional network equipment, the data packet is processed according to the first path 5, so that the required time and amount of processed data have to be increased. However, according to the present invention, as the data packet is processed according to the second path 6, the data throughput is reduced as compared with the first path 5, so that the packet is processed only in the first layer 10, The time required for processing the entire packet can be reduced.

Specifically, when a packet is transmitted from the client device 200 to the server 300, a data packet may be received by the packet acceleration module 100 of the first layer 10 via the interface 40. The packet acceleration module 100 on the first layer 10 may perform all necessary packet processing on the first layer 10 for received data packets according to an embodiment of the present invention. Specifically, in the case of the security processing that can be performed only by the security modules 110, 120, and 130 and the routing module 140 operating in the second layer 20, the packets are processed without going through the second layer 20 The packet processing speed can be increased. To this end, the packet acceleration module 100 includes a packet forwarding table (not shown). The packet forwarding table stores the network connection information for the packets that have been transmitted / received, and the packet forwarding module 100 If the data packet is stored on the packet forwarding table, the necessary processing can be performed according to the stored path. For example, the network connection information stored in the packet forwarding table may include destination information and source information of the received data packet. The destination information of the received data packet may be, for example, the IP address of the server 300, and the source address of the received data packet may be the IP address of the client device 200, for example. In addition, the packet forwarding table may further include information in which the received data packet is converted by the routing module 140 and the NAT module 130, such as address information. The data packet in which address information is converted and security processing is performed by the routing module 140, the NAT module 130 and the other security modules 110 and 120 may be a data packet of the transmission type of the present invention. That is, according to the present invention, on the packet forwarding table, for at least one data packet, a set of information including the address information of the received data packet and the address information for the data packet of the corresponding transmission type is stored And the packet acceleration module 100 according to the present invention can directly perform necessary processing without transmitting a packet to the second layer 20 by referring to the packet forwarding table. Also, the packet acceleration module 100 may interwork with the security modules 110, 120, and 130 operating in the second layer 20 to perform necessary security processing on the received data packet. Specifically, the packet acceleration module 100 may call a function for security processing to the security modules 110, 120 and 130 and apply a security function to the received data packet. That is, in this case, the security modules 110, 120, and 130 do not directly perform the security processing, but interlock with the packet acceleration module 100 to help secure the received data packet.

On the other hand, when the data packet received by the packet acceleration module 100 is not present in the packet forwarding table, it is impossible to perform necessary processing with reference to the packet forwarding table. In this case, the received data packet may not have been received through the network device of the present invention, so that no information is present in the packet forwarding table. In addition, there may be a case where the packet transmission path, that is, the network connection information, is changed, or the security policy in the security module is changed and the session for the corresponding packet is deleted on the packet forwarding table . That is, when a part of the information of the received data packet is not present in the packet forwarding table, the packet is not processed by the packet acceleration module 100, and the packet is processed according to the first path 5 which is the normal path have. That is, the received data packet may be transmitted to the security modules 110, 120, 130, and 140 operating in the second layer 20 and may be processed by the security modules. The data packet in which the corresponding process is performed may be the data packet of the transmission type described above, and the data packet of the transmission type may be transmitted to the first layer 10 of the lower level and may be transmitted to the destination 300. In this case, the packet acceleration module 100 stores the address information of the received data packet and the address information of the data packet of the transmission type in the packet forwarding table for the new packet, ).

Meanwhile, the packet acceleration module 100 according to the present invention can be notified of security information and the like changed from the security module 110, 120, 130 and the routing module 140 in cooperation with the packet module. For example, when there is a change in the security policy on the FW module 110, when the IPS module 120 is changed from the detection mode, or when the network address translation policy in the NAT module 130 is changed, The stored information becomes invalid, and if the packet is processed on the packet acceleration module 100 that does not reflect the information, it may be erroneous data transmission. Accordingly, the security modules 110, 120, and 130 operating in the second layer 20 periodically or non-periodically notify the packet acceleration module 100 of the security policy information, and the packet acceleration module 100 transmits the security policy information And update the packet forwarding table based on the information. The update of the packet forwarding table may mean the deletion of a set of specific data packet information that has changed in accordance with the changed security policy. In addition, the routing module 140 operating on the second layer may notify the packet acceleration module 100 if there is a change in the routing information, and the packet acceleration module 100 may notify the packet acceleration module 100 based on the received routing information The packet forwarding table can be updated. Here again, the update of the packet forwarding table may mean the deletion of a set of specific data packet information changed in accordance with the changed routing information. If an update of the packet forwarding table occurs, the corresponding data packet needs to be processed again at least once according to the first path 5, so that if new network information for the data packet is generated, Information is stored in the packet forwarding table.

The client device 200 and the server 300 illustrated in FIG. 1 may be one of a plurality of systems in which data is transmitted and received according to an embodiment of the present invention. In FIG. 1, a plurality of systems 200 and 300 transmit and receive data The network device may be any network device attached to the client device 200 and the server 300 and may be a network driver having a packet acceleration module 100 operating on the first layer 10 in Figure 1, Such as a router, that further includes at least one of the acceleration module 100 and the security module 110, 120, 130, Further, the network device of the present invention can be configured as an independent device such as the client device 200 and the server 300. [

The network device of the present invention may be configured with an interface unit 40 for transmitting and receiving the packet of FIG. 1 and a packet acceleration module 100. The interface unit 40 can receive data packets from the first system 200 among the plurality of systems on a first layer defined as a physical layer in which data is transmitted and received between the systems 200 and 300. The packet acceleration module 100 determines whether some information of the received data packet exists in a packet forwarding table provided in the network device. If some information of the received data packet exists in the packet forwarding table, 2 < / RTI > path (6). In this case, security processing is performed in cooperation with the security modules 110, 120, and 130 operating in the second layer 20 higher than the first layer 10 with respect to the received data packet, The destination information of the data packet can be extracted and converted into a data packet of the transmission type. In addition, the interface unit 40 can transmit the security-processed data packet of the transmission type to the second system 300 of the plurality of systems. The network device according to the present invention may further include at least one of the security modules 110, 120 and 130 and the routing module 140 in addition to the packet acceleration module 100 as described above. Examples vary. The present invention has been briefly described above with reference to Fig. Hereinafter, the present invention will be described in more detail with reference to the drawings of FIG. 2 and the following figures.

2 is a data flow diagram of a new packet that is not stored in the packet forwarding table on the packet processing method according to an exemplary embodiment of the present invention. In Fig. 2, a description will be given of a case where a new data packet is processed according to the first path 5 in Fig. 1 and the information is stored in the packet forwarding table.

In step 1, a data packet requesting communication from the client device 200 to the server 300 is received via the interface of the network device of the present invention.

In step 2, the packet acceleration module 100 operating in the first layer receives packet 1 and, after confirming that packet 1 is not present in the packet forwarding table, , 130, 140). Data packet 1 received from client device 200 may include, for example, the information in Table 1 below.

MAC_C MAC_A TCP 10.10.10.1 20.20.20.1 53355 80 DATA

Referring to Table 1, the data packet 1 received from the client device 200 includes a source MAC (MAC_C), a destination MAC (MAC_A), a protocol (TCP), a source IP (10.10.10.1) 20.20.20.1), a source port number 53355, a destination port number 80, and data.

In step 3, the packet acceleration module 100 receives some information of the packet 1, such as source MAC (MAC_C), destination MAC (MAC_A), protocol (TCP), source IP (10.10.10.1) When the IP 20.20.201, the source port number 53355 and the destination port number 80 are not stored in the packet forwarding table, the packet is recognized as a new packet and the other modules 110, 120, 130, and 140, respectively.

In step 4, the FW module 110 determines whether or not to permit the firewall for the received packet 1, and passes the packet. For example, if the source address and the destination address are 10.10. The FW module 110 forwards the packet 1 to the IPS 120, which is another security module (step 5)

In step 6, the IPS module 120 detects or blocks the intrusion of packet 1 and forwards it to the NAT module 130 if there is no such entry (step 7).

In step 8, the NAT module 130 may change the source address for packet 1 according to the network address translation policy. Packet 1 can be converted to packet 2, for example, from the source address 10. 10. 10. 1 to 20. 20. 2. 2 (see Table 2).

MAC_C MAC_A TCP 20.20.20.2 20.20.20.1 53355 80 DATA

That is, according to the present invention, a new data packet that does not exist in the packet forwarding table is transmitted to the security modules 11, 120, and 130 of the second layer, and security processing is performed directly by them. In this case, the amount of processing data and time may be small, as in the prior art.

The secured packet 2 in step 9 may be forwarded to the routing module 140.

In step 10, the routing module 140 can convert the MAC address of the source and destination into the data type of the transmission type according to the present invention, as shown in Table 3 below.

MAC_B MAC_S TCP 20.20.20.2 20.20.20.1 53355 80 DATA

In step 11, the converted packet 3 is transmitted to the packet acceleration module 100 of the first layer 100 as shown in Table 3, and the packet acceleration module 100 transmits the network connection information of the data packet of the transmission type Extracted and stored in the packet forwarding table. The packet forwarding table is configured with a set of information on a packet storing information of the packet 1 before being transmitted to the modules 110, 120, 130, and 140 of the second layer, And the stored information may be illustrated in FIG.

Referring to FIG. 3, the packet forwarding table 500 includes a protocol 501, a source IP, a destination IP, a source port, and destination port information as information 501 of the received data packet, The information 502 of the data packet can store the MAC address, the protocol, the converted source IP, the destination IP, the source port and the destination port information at the time of transmission. That is, the packet forwarding table 500 stores network connection information between the first system 200 and the second system 300 for at least one data packet transmitted and received on the network device of the present invention, The connection information includes source and destination information of a received data packet, and may include source and destination information of a data packet of a transmission type. Also, according to the embodiment, the storage information of the packet transfer table illustrated in FIG. 3 can be changed and added.

Accordingly, when the packet is received, the packet acceleration module 100 determines whether the partial information 501 of the received data packet and the data packet information 502 of the transmission type are matched with the partial information of the received data packet It is possible to determine whether to perform packet processing on the fast path according to the second path 6 of FIG. 1 or to newly store the packet on the first path 6 after processing the packet. Meanwhile, step. The processing sequence between the modules 110, 120, 130, 140 for the delivery and processing of packets to any of the modules 11, 120, 130, 140 of the second tier, illustrated as steps 3 through 11, And the present invention is not limited by the number of the modules 110, 120, 130, 140 and the operation contents thereof.

4 is a data flow diagram of an operation for processing packets stored in a packet forwarding table on a packet processing method according to an embodiment of the present invention. That is, in FIG. 4, an operation of processing a packet in a fast second path 6 in the case where some information of a received data packet exists on the packet forwarding table will be described.

In step 1, the packet 1 is transmitted from the client device 200, and the packet acceleration module 200 confirms that the corresponding packet 1 exists in the packet forwarding table in step 2. The packet acceleration module 100 calls the necessary security functions for the security modules 110, 120, and 130 without transferring the packet to the modules of the second layer (step 2. 3. 4.). The order of calling security functions to the security modules 110, 120, and 130 may be changed, and the scope of the present invention is not limited by the number of the security modules 110, 120, and 130 and their names. Some of the security modules 110, 120, and 130 may not be present according to the embodiments, or may be configured to be integrated with other modules.

In step 6, the packet acceleration module 100 performs necessary security processing in cooperation with the security modules 110, 120, and 130, and performs routing for the packet using the data packet information of the transmission type stored in the packet forwarding table . At the time of routing processing, the MAC address or the like, which is the destination information of the received data packet stored on the packet forwarding table, can be extracted and converted into a data packet of the transmission type.

On the other hand, when the packet acceleration module 100 processes the data by the second path 6 without processing the data packet by the existing first path 5, the data packet is hooked from the existing path 5 hooking. Accordingly, in the present invention, step 2 and thereafter and step. 6, it is possible to hook the data packet at the reception and transmission time of the packet in the network driver and the packet transmission / reception interrupt period of FIG.

As a result, the packet acceleration module according to the present invention can perform all the processing on the packet on the first layer, thereby shortening the processing time of the packet.

In step 7, Packet 3. That is, it transmits the security-processed transmission-type data packet to the server 300 among the plurality of systems.

On the other hand, the client device 200 and the server 300 may illustrate System 1 and System 2 of the plurality of systems of the present invention, and in the present invention, the system may be any device or network address And may be any network object that may have information.

5 is a flowchart of a packet processing method according to an embodiment of the present invention.

In step S11, a network device for processing data packets transmitted and received between a plurality of systems according to the present invention includes a first layer defined as a physical layer through which data is transmitted and received between the systems, Lt; RTI ID = 0.0 > 1 < / RTI >

In step S12, the packet acceleration module of the present invention operating on the first layer determines whether some information of the received data packet exists in the packet forwarding table provided in the network device. That is, it is determined whether a part of the network connection information of the received data packet exists on the packet forwarding table.

If some information of the received data packet is present in the packet forwarding table in step S13, the packet acceleration module transmits the received data packet to the security module operating in the second layer higher than the first layer The security function is called from the security module and the security function is applied to the received data packet.

In step S14, in addition to the security processing, the packet acceleration module may convert the received data packet into a data packet of the transmission type using the information stored in the packet forwarding table.

In step S15, the data packet of the transmission type packetized on the first layer by the packet acceleration module is transmitted to the destination server.

On the other hand, if the partial information of the data packet received in step S12 is not present in the packet forwarding table, the received data packet is transmitted to the modules in the second layer 110, 120, 130, 140, And the security processing of the packet is performed by the route.

In step S16, the data packet transferred to the modules in the second layer is processed according to the existing path. That is, the received data packet is directly secured by the security module operating in the second layer, and the received data packet is routed by the routing module operating in the second layer, do.

In step S17, the transmission type data packet is transmitted to the first layer acceleration module in which the packet acceleration module operates, and the network connection information for the transmission type data packet is newly stored on the packet forwarding table.

The packet processing method and the like of the present invention have been described above. Although not shown in FIG. 5, the packet acceleration module according to the present invention can update the packet forwarding table by being notified of changes in security information and routing information in association with the security module and the routing module.

The network device according to the embodiment of the present invention has been described above. The present invention can be applied not only to a network apparatus constituting the network system of the present invention but also to each of a plurality of devices. When all the operations in the network apparatus and the plurality of devices include the concept of the present invention, The present invention can also be applied to a network device and an electronic code recording an operation executed in a plurality of devices and a recording medium storing electronic codes thereof.

Also, the packet processing method according to an embodiment of the present invention can be recorded on a computer-readable recording medium with an electronic recording code and executed on a computer or any other network device, and the scope of the present invention includes a computer- . ≪ / RTI >

The preferred embodiments of the present invention have been described above. It is to be understood, however, that the invention is not limited to the disclosed embodiments, but, on the contrary, is intended to cover various modifications and alternative arrangements included within the spirit and scope of the appended claims. Of course.

Claims (11)

A method for processing data packets transmitted and received on a network device for transmitting and receiving data between a plurality of systems,
Receiving a data packet from a first one of the plurality of systems on a first layer defined as a physical layer through which data is transmitted and received;
Determining whether some information of the received data packet exists in a packet forwarding table provided in the network device;
Performing security processing in cooperation with a security module operating in a second layer higher than the first layer with respect to the received data packet when some information of the received data packet exists in the packet forwarding table ;
Extracting destination information of the received data packet from the packet forwarding table and converting the received data packet into a data packet of a transmission type; And
And transmitting the security-processed data packet of the transmission type to a second one of the plurality of systems,
Wherein performing the security processing comprises: calling a function for security processing from the security module and applying a security function to the received data packet.
delete The method according to claim 1,
Wherein the security module is included in the network device or separately from the network device. The method according to claim 1,
Wherein the packet forwarding table stores network connection information between the first system and the second system for at least one data packet transmitted and received on the network device and transmits the source and destination information of the received data packet And the source and destination information of the data packet of the transmission type. The method according to claim 1,
And if the partial information of the received data packet is not present in the packet forwarding table, transmitting the received data packet to the security module of the second layer. 6. The method of claim 5,
The received data packet being directly secured by a security module operating in the second layer;
Routing the received data packet by a routing module operating in the second layer and converting it into a data packet of the transmission type;
Wherein the transmission type data packet stores network connection information for a data packet of the transmission type on the packet forwarding table. The method according to claim 6,
Receiving routing information for a data packet stored on the packet forwarding table from a routing module operating in the second layer;
And updating the packet forwarding table based on the received routing information. The method according to claim 1,
Receiving security policy information for a data packet transmitted and received from a security module operating in the second layer;
And updating the packet forwarding table based on the received security policy information. A network apparatus for processing data packets transmitted and received to transmit and receive data between a plurality of systems,
An interface for receiving a data packet from a first one of the plurality of systems on a first layer defined as a physical layer through which data is transmitted and received between the systems,
Determining whether some information of the received data packet is present in a packet forwarding table provided in the network device, and if a part of the received data packet is present in the packet forwarding table, A security module that operates in cooperation with a security module operating in a second layer higher than the first layer, performs security processing, extracts destination information of the received data packet from the packet forwarding table, A packet acceleration module for converting the packet into a data packet; And
And a security module for assisting in performing security processing of the received data packet in association with the packet acceleration module and for periodically or non-periodically notifying the packet accelerator of security policy information on the transmitted and received data packet As a network device,
The packet acceleration module performs security processing by calling a function for security processing from the security module and applying a security function to the received data packet,
And the interface unit transmits the security-processed data packet of the transmission type to the second one of the plurality of systems. 10. The method of claim 9,
Wherein the security module directly performs security processing on the received data packet on the second layer if some information of the received data packet is not present in the packet forwarding table. 10. The method of claim 9,
Routing the received data packet on the second layer if the partial information of the received data packet is not present in the packet forwarding table and routing information on the data packet stored on the packet forwarding table to the packet forwarding module And a routing module for periodically or non-periodically notifying the network device of the presence or absence of a failure.

Images