WO2006064561A1

WO2006064561A1 - Virtual private network system

Info

Publication number: WO2006064561A1
Application number: PCT/JP2004/018794
Authority: WO
Inventors: Daiyuu Nobori
Original assignee: Softether Corporation; Mitsubishi Materials Corporation
Priority date: 2004-12-16
Filing date: 2004-12-16
Publication date: 2006-06-22

Abstract

A virtual private network system comprises a client terminal having a virtual LAN card and a TCP/IP stack mounted thereon. The virtual LAN card generates virtual MAC frames, in which the MAC address of the virtual LAN card of a transmission destination and its own MAC address as the transmission source are added to data to be transmitted, and converts and capsulates the virtual MAC frames into stream data. The TCP/IP stack generates an IP packet destined to the IP address of the virtual HUB by dividing the stream data, and sends the IP packet to an information communication net. The virtual private network system further comprises a server device provided with a mapping table of connection port numbers for switching controls and the MAC address of the virtual LAN card connected. The server device a virtual HUB mounted therein, which restores the stream data, when it receives the IP packet, and which transmits, with reference to the MAC address of the transmission destination and source, the stream data in the IP packet to the connection port corresponding to the MAC address.

Description

Specification

Virtual private network system

Technical field

The present invention relates to a virtual private network system that forms a virtual private network on a network.

Background art

[0002] Conventionally, a LAN (Local Area Network) is constructed by mutually connecting computers distributed in a facility (company, school, hospital, etc.) and a database for sharing the data of each computer. Used for data sharing and transmission / reception.

In recent years, with the spread of the Internet, network connections between LANs across multiple facilities have come to be established.

However, when connecting networks in public information communication networks including the Internet and public network, it is conceivable to use a dedicated network for network connection between LANs due to security issues.

[0003] However, since dedicated lines are expensive, when using a public information communication network to connect networks between LANs, external LANs such as in-house LANs and campus LANs are used for security purposes. Various connection restrictions are provided when connecting to other networks.

In other words, each computer connected to the LAN has a private IP address as a terminal, and for connecting to an external network (Internet), a NAT (Network Address) set on a server with a router function is used. Translation), firewall, and HTTP (HyperText Transfer Protocol) proxy.

[0004] Under the environment described above, TCPZIP (Transmission Control

Use various applications that use (Protocol / Internet Protocol), send / receive emails, connect to IRC (Internet Relay Chat) servers, and connect to the home computer via FTP (File Transfer Protocol) from the company and campus LAN If you want to connect or use the Windows (registered trademark) remote desktop function, apply to the network administrator for permission to do so, and make exceptions to the firewall on the server. It is necessary to use a tunneling technology (VPN; Virtual Private Network) using IPsec or the like to have the port set (see, for example, Patent Document 1).

Patent Document 1: Japanese Patent Laid-Open No. 2000-224219

Disclosure of the invention

Problems to be solved by the invention

However, in the tunneling technology shown in Patent Document 1, an environment in which IP packets cannot be directly transmitted and received between the VPN client and the VPN server (for example, in-house LAN supports HTTPS protocol) In an environment where it is not possible to connect to the Internet without going through a proxy server, it is not possible to establish a logical connection between the VPN client and the VPN server. Can not.

[0006] TCP over TCP is a technique for realizing VPN by using the TCP / IP protocol as a transmission means for encapsulating virtual network packets that may use the TCP / IP protocol. Refers to that. However, if the conventional tunneling technology uses TCP / IP for data transmission, this IP packet can be streamed when transferring IP packets in Layer 2 over TCP or Layer 3 over TCP. The protocol for realizing VPN communication is executed by TCP-based connection.

[0007] For this reason, in the conventional tunneling technology using TCP / IP, for the reasons described below, a long delay and frequent connection failures are expected to be inefficient.

When TCP tries to transmit data, the TCP / IP packet storing the data to be transmitted is given a sequence number in the order of transmission from the sender, and the bandwidth by the route the IP packet is sent to If the arrival order changes due to differences or delays, the receiving side rearranges the data in the order of the sequence number and compensates for the data. Do what you want.

[0008] This time-out time is increased every time a TCP / IP packet does not reach and times out. Here, in TCP over TCP, in the case of upper layer and lower layer, for example, PPP over SSH, the lower layer to be encapsulated is SSH (Secure Shell), and the upper layer to be encapsulated is PPP (Point to Point), In addition to TCP communication (SSH), TCP communication (HTTP or POP3 which is PPP) is passed.

[0009] Therefore, in TCP over TCP, when an IP packet loss occurs, both the carrier (SSH) TCP and the application layer (HTTP, POP3, etc.) TCP retransmit the IP packet. I will try.

Here, the upper layer and the lower layer have timers with different timeout periods, and each tries to adjust the timeout period independently. Therefore, these adjustments do not work well in TCP over TCP. Transmission performance will be degraded.

[0010] For this reason, it is also proposed to perform tunneling that does not reduce packet arrival compensation, that is, uses UDP (User Datagram Protocol) that does not have a timeout function, and does not degrade transmission performance. Has been.

However, in the tunneling technology using UDP, SSL (Secure

Socket Layer) cannot be used, so session management and IP packet encryption. Digital signatures must be implemented by other methods than SSL.

[0011] Furthermore, in tunneling technology using UDP, most VPN protocols tunnel Layer 3 (IP layer, etc.), so IP routing is required to connect LANN networks over the Internet. Necessary.

[0012] The present invention has been made in view of such circumstances, and via a LAN with many restrictions on communication between external networks, between the Internet and a computer in another LAN.

The purpose is to provide a virtual private network (VPN) system that connects the lines and operates at a practical data transfer rate.

Means for solving the problem

[0013] In the virtual private network system, the present invention generates a virtual MAC frame in which the MAC address of a destination virtual LAN card and its own MAC address as a transmission source are added to the data to be transmitted. Convert the virtual LAN card to be converted into stream data and encapsulate it, and divide the stream data and assign the Virtual Hub IP address. Generate a destination IP packet and send it to the information communication network. A client terminal equipped with a TCP / IP stack, a connection port number for switching control, and a connected virtual

A correspondence table with the MAC address of the LAN card is provided. When the IP packet is received, the stream data is restored, the MAC address of the transmission destination and the transmission source is referred to, and the connection port corresponding to the transmission destination MAC address is restored. And a server device mounted with a virtual hub that transmits stream data in IP packets.

[0014] The present invention is characterized in that, in the virtual private network system, when the virtual LAN card generates a virtual MAC frame, at least a sign 喑 or a digital signature or both are performed. Item 1 Virtual private network system.

[0015] The present invention is characterized in that, in the virtual private network system, when the virtual HUB generates a MAC frame, at least encryption and / or electronic signature processing is performed.

[0016] The present invention is characterized in that, in the virtual private network system, a plurality of TCP / IP connections are provided for one session established between the virtual LAN card card and the virtual HUB. .

[0017] In the virtual private network system, the present invention detects a state variable indicating a quality state of each TCP / IP connection in a plurality of TCP / IP connections in the virtual LAN card card / session, and obtains the best quality state. The MAC frame is output to the TCP / IP connection.

[0018] The present invention provides the virtual private network system, wherein the virtual hub includes a transmission queue that serially shifts input MAC frames in the order of input and outputs from the oldest input order. The number of MAC frames accumulated in the transmission queue is detected, and according to the number of MAC frames, input MAC frames are discarded at a predetermined rate, and the amount of MAC frames input to the transmission queue is controlled. Features.

[0019] The present invention provides the virtual private network system in which the virtual hub holds a communication amount for each transmission source as a state variable, and MAC frames from a transmission source exceeding a preset set amount are transmitted at a predetermined rate. It is characterized by discarding at. [0020] In the virtual private network system, the present invention releases the encapsulation of the IP packet input from the Virtual Hub, extracts a virtual MAC frame, and sets the destination IP address of the virtual MAC frame after the release. The virtual MAC frame data is rearranged in the order of the sequence number of the TCP header and sent to the terminal having the destination IP address in order, while the data input from the terminal is set in a predetermined data unit. A virtual LAN frame having a NAT function unit that divides and configures a virtual MAC frame by adding a destination IP address, converts the MAC frame into force, and sends it to the virtual hub is provided. To do.

The invention's effect

[0021] As described above, according to the VPN system of the present invention, an existing network is connected to a computer in the Internet or another LAN via a LAN with many restrictions on communication between external networks. Unlike a VPN system, it does not require a special VPN device, and it is possible to connect lines as a VPN using computers in each home and office, and the established VPN operates at a practical data transfer rate. If you can provide a virtual private network (VPN) system, you can get the effect.

Brief Description of Drawings

FIG. 1 is a conceptual diagram illustrating a configuration example of a general communication system for explaining communication between application programs.

FIG. 2 is a conceptual diagram illustrating the data flow when data communication between computers is performed using the TCP / IP protocol.

FIG. 3 is a conceptual diagram illustrating the flow of processing for specifying a communication destination in a TCP / IP connection.

FIG. 4 is a conceptual diagram showing the relationship between a TCP / IP server program and a TCP / IP client program.

FIG. 5 is a conceptual diagram showing a configuration example of a communication system VPN system according to an embodiment of the present invention.

FIG. 6 is a conceptual diagram illustrating the configuration of a virtual LAN configured on a network in the VPN system of the present invention. FIG. 7 is a conceptual diagram for explaining a method of exchanging MAC frames by the physical switching HUB158.

FIG. 8 is a conceptual diagram for explaining a method of virtual MAC frame exchange by the VPN system of the present invention.

FIG. 9 is a conceptual diagram simply showing the server / client relationship between the virtual hub 31 and the virtual LAN cards 11, 21,.

FIG. 10 is a conceptual diagram showing sequence processing when data is transmitted / received between a virtual LAN card and a virtual HUB for explaining the SE protocol sequence in the VPN system of the present invention.

FIG. 11 is a conceptual diagram of virtual LAN strength for explaining the processing of the encapsulation unit in the virtual LAN card.

FIG. 12 is a conceptual diagram showing a configuration example of a Virtual HUB for explaining processing of a Virtual HUB encapsulation unit in the VPN system of the present invention.

13 is a block diagram showing a configuration example of a capsule capsule unit in FIG.

FIG. 14 is a conceptual diagram illustrating the MAC frame combining process of the combining unit 60 in FIG. 13. FIG. 15 is a conceptual diagram illustrating the extension data adding process of the extension processing unit 61 in FIG.

FIG. 16 is a conceptual diagram for explaining the security information attaching process of the security information adding unit 62 in FIG.

FIG. 17 is a block diagram showing a configuration example of capsule capsule release units 19 and 48 in FIG. 12.

FIG. 18 is a conceptual diagram showing the operation of the switching process of the virtual MAC frame switching processing unit 49.

19] It is a conceptual diagram showing the configuration of the VPN system of the present invention using IP networks with different line speeds.

FIG. 20 is a conceptual diagram showing a connection relationship between a LAN card 181 and a LAN card 182 connected via a low-speed communication line (10 Mbps), a switching HUB 158, and a high-speed communication line (100 Mbps). FIG. 21 is a conceptual diagram showing a configuration example of a Virtual HUB provided with a congestion control unit 300.

FIG. 22 is a conceptual diagram showing a configuration example of a VPN system according to the present invention.

FIG. 23 is a conceptual diagram showing a configuration example of a VPN system of the present invention having a bridge connection.

FIG. 24 is a conceptual diagram of a configuration for establishing transmission / reception by establishing a plurality of TCP / IP connections for one SE session in the VPN system of the present invention.

FIG. 25 is a conceptual diagram of the configuration of a computer on which NAT is implemented to explain the operation of NAT.

FIG. 26 is a conceptual diagram showing a system configuration of remote access using a virtual LAN card and NAT.

FIG. 27 is a conceptual diagram showing a system configuration for explaining the configuration and operation of a user NAT program in the embodiment of the present invention.

Explanation of symbols

11, 21, 521… Virtual LAN card (virtual LAN card program)

15, 25, 35—TCP / IP stack (TCP / IP protocol stack)

14, 16, 24, 26, 526 ... Network interface device

18, 53, 54, 55, 508 ... Power Psenoley

19, 48, 504… Strengthening the psenolay

22 Application program

31 ■ Virtual Hub (Virtual Hub program)

36… Switching HUB

49… Virtual MAC frame switching processor

50, 51, 52 ... Send queue

60 ... Connection

61… Expansion processing part

62… Security information addition part

66… Digital signature

67 ... Encryption part 71.

72 ... 'Extended processing removal section

73 ... 'Security information removal part

119- • -IP network

181, 182, 183 ... Power Psenoley B

300 --- Congestion controller

301- ·-Proxy server

310- ·-Connection selection part

481, 482, 483… force psenoley angle corner removal B

490- · -Connection joint

500- User-mode NAT program

501- · Data coupling part

502 •• TCP header analyzer

503IP header analysis part

509 ··· Receive data queue

510 ··· Transmission data queue

525, 530, 570 --- TCP / IP stack (TCP / IP protocol

BEST MODE FOR CARRYING OUT THE INVENTION

[0024] The present invention is a virtual private network system that installs (implements) a network device as an application program in a terminal (personal computer or the like) or a server, configures a virtual device, and performs VPN communication.

The devices to be virtualized correspond to LAN cards and HUBs that support Ethernet (registered trademark) and IEEE 802.3 standard protocols, which are virtual LAN cards and virtual hubs, respectively.

The present invention configures an Ethernet (registered trademark) or IEEE802.3 standard virtual network on a physical information communication network including the Internet, and performs VPN communication using this network. Do.

[0025] Further, in the following description of the configuration of the present invention, a temporary implementation for configuring a VPN is described. It is also possible to mount the LAN power card and Virtual Hub on a computer as hardware by using an integrated circuit such as Force ASIC, which is described as a program to be installed and used.

When implemented with this hardware, the virtual LAN card program is a virtual LAN card, and the virtual hub program has a configuration that physically exists as a virtual hub. Here, “IEEE802.3” is a kind of layer 2 frame exchange method generally known as Ethernet (registered trademark) and its extended standard.

[0026] In addition, in the VPN system of the present invention, a LAN LAN card and a switching HUB that are actually configured corresponding to a Virtual HUB and a Virtual LAN card that configure a virtual LAN on the network are connected to a physical LAN. Describe as a card and switching hub.

Further, “NAT” in the following description of the embodiment of the present invention means “NAPT (Network Address Port Translation)” and is equivalent to IP masquerading. The term “plurality” refers to one or more items.

In the description of the present invention, the TCP / IP stack and the TCP / IP protocol stack are used in the same meaning, and the protocol stack is an arbitrary protocol stack of layer 3 (L3) or higher (regardless of TCP / IP). NetBEUI, IPX / SPX, AppleTalk (registered trademark)).

First, prior to describing the present invention, the conventional communication sequence as a premise will be described, and then the configuration of the virtual network of the present invention will be described to clearly identify which configuration is the present invention. Want to.

When different data are exchanged between sender A and sender B between different terminals (computers), that is, when some data is exchanged between application programs that are trying to communicate, usually, as shown in Fig. 1. Processing is performed.

First, communication is realized by exchanging data based on the data exchange method of the application program that is to communicate. [0028] Here, an application program installed in each computer to communicate with performs communication processing by a predetermined compatible method (protocol). Each application program runs on a computer that is remote from each other, and data communication between them, for example, the application program 100 running on the sender's computer A is received by the recipient's computer B. It tries to communicate with the application program 101 that operates above.

At this time, the data 107 to be transmitted is passed to the communication control program 102 that performs the application program 100 power communication control.

When the communication control program 102 cannot send the data 107 to be transmitted directly to the physical line 106, for example, when the amount of data that can be transmitted in the transmission protocol is exceeded, the communication control program 102 It is divided into relatively small chunks of data called packets that can be sent and received above.

[0030] In the case of FIG. 1, the communication control program 102 divides the data 107 into packets 109 of a predetermined amount of data (number of bits), converts the format into a format that can be processed by the communication hardware 104, and performs physical processing. Output to computer B via line 106.

Then, the communication hardware 104 receives the packet from the packet communication program 102 and sends it out to the connected physical line 106 as an electronic signal.

Here, the physical line 106 may be a single copper wire or a frame exchange installed between the communication hardware 104 and 111.

[0031] However, in reality, routers and packet switches and various other hardware are inserted, and they are combined to deliver a packet to another specified node at a remote location. Or a set of networks including routing processing. In general, there are local area networks (LAN) and the Internet. When the communication hardware 111 (receiver side) receives a packet as an electrical signal via (via) the physical line 106, the communication hardware 111 converts it into a packet 110 as logical data, and the communication control program. Is output to 103.

[0032] Then, the communication control program 103 combines the input packet 110 by the reverse method that the communication program 102 divides, and uses the received data 108 as an application. Output to Chillon Program 101.

At this time, the data 108 is converted into a configuration corresponding to the data 107 that the application program 100 on the sender side wishes to transmit.

Then, the application program 101 is input as data 108 equivalent to the data 107 output from the application program 100.

As a result, the data transmitted by the application program 100 reaches the power 107 and the application program 101.

When the application program 101 transmits data to the application program 100, the reverse process described above is performed.

[0034] The above method is generally applicable to communication between applications using any communication protocol.

On the other hand, currently widely spread on the Internet, the TCP / IP protocol used as the basis of communication in the present invention is also used to communicate between applications (or computers) at remote locations as shown in FIG. The method is often used.

[0035] First, as a general theory, when an application program attempts to communicate using the TCP / IP protocol, it can transmit and receive data using this protocol. Must be in the stream data format (except for urgent packets in the TCP / IP protocol; the same shall apply hereinafter).

Here, as is well known, TCP / IP is a reliable bi-directional stream data.

[0036] In addition, the stream data transfer service is a connection between two application programs (computers) (two sets of IP address and port number of one node and IP address and port number of one node). If a program that wants to send data sends data in multiple steps, the program that tries to receive the data can be received without changing the content and order of the data. And in fact, the data is going to be received even if it is going to be transmitted or may be divided in the transmission process. A program is a data transfer service that does not need to depend on data delimiters. Stream data refers to data transferred by the transfer service.

[0037] In the TCP / IP protocol, stream data to be transmitted / received starts at a certain point in time, but the transmission side program does not declare the end, or the reception side program stops receiving, or the computer The network will not be terminated until either time when the network is disconnected.

Then, the application program 100 (transmission side program) transmits stream data 115 of a predetermined length at a time to the application program 101 (reception side program).

[0038] For example, the application program 101 has the following character string data

ABCDEFGHIJKLMN

Try to send.

The function may be divided as follows on the sending side by the TCP / IP stack program 117, which is one of the function programs that communicate with the TCP / IP protocol included in the OS.

ABC DEFG IJK LM N

[0039] The TCP / IP stack program 118 of the computer that has received all of the packets thus divided automatically combines the contents of the original character string.

ABCDEFGHIJKLMN

To the application program 101.

[0040] Next, taking FIG. 2 as an example, an application program 115, which operates on the computers A and B connected by the IP network 119 and attempts to communicate using the TCP / IP protocol, An example will be described in which an arbitrary stream data is transmitted / received between 116.

First, when the application program 100 tries to communicate using the TCP / IP protocol, data to be transmitted is prepared as stream data 115 and output to the TCP / IP stack program 117. [0041] The TCP / IP stack program 117 cannot send the received stream data 115 to the IP network 119 as it is because the amount of data is large. Therefore, the stream data 115 can be sent to the IP network 119. The packet is divided into a plurality of types of packets called IP packets 120 having a predetermined amount of data, and a TCP header and an IP header are added (according to the RFC specification of TCP / IP).

Then, the TCP / IP stack program 117 outputs the plurality of dividedly generated IP packets 120 to the driver 121 of the physical network interface.

The physical network interface driver 121 is a program for controlling a physical network interface device (noware) 123 such as a LAN card or a modem.

Normally, the IP network 119 has a function to directly transmit the IP packet 102 when viewed as physical wiring.

For this reason, the driver 121 converts the IP packet 120 into a packet of a different format for each physical layer called a frame, that is, a packet that can be easily handled as an electric signal (hereinafter referred to as a frame 122).

Here, the driver 121 converts the IP packet 120 into a frame 122 for transmission to the IP network 119, and converts the frame 122 into the physical network interface device 12.

Output to 3.

The network interface device 123 converts the input frame 122 into an electrical signal and sends it to the existing physical IP network 119.

Actually, the process of converting the IP packet 120 into the frame 122 may be performed by the TCP / IP stack program 117 without being performed by the driver 121, or may be performed by the physical network interface device 123. .

This is because the process of converting the IP packet 120 into the frame 122 is considered as one function because it is performed at a glance when viewed from the external force.

In the above IP network 119, if the destination of frame 123 is reachable, IP packet 120 (frame 122) is propagated to the computer having the destination IP address described in the IP header of each IP packet 120. arrive. When this frame 122 reaches the destination computer B (the final destination application program 101 of the IP packet 120 is activated), the network interface device 124 is converted from the IP network 119 into an electrical signal. Frame 122 is received and output to driver 126 as frame 125.

Next, when the frame 125 is input, the driver 126 extracts the IP packet 127 from the frame 125 force, and outputs it to the TCP / IP stack program 118 by processing reverse to that on the transmission side. As shown, the TCP / IP stack program 118 refers to the IP header and TCP header in the input IP packet 127 by the method defined in the RFC specification of the TCP / IP protocol, and Referring to the destination information such as the port number, the destination application program 101 is determined, and the application program 101 is converted into stream data 116 having the same data format as stream data 115 (that is, restoration). To do.

[0046] Here, the TCP / IP stack program 118 performs the reverse process of dividing the stream data 115 into a plurality of IP packets 120 performed by the TCP / IP stack program 117. The connection is made based on the information indicating the transmission order of the TCP header, and the stream data 116 (that is, the stream data 115) is restored.

Then, the TCP / IP stack program 118 outputs the restored stream data 116 to the application program 101.

By performing the above-described processing, the stream data 115 (stream data 116) can be transmitted and received between the application programs 100 and 101 using the TCP / IP protocol.

In the above-described example, the application program 100 transmits the single stream data to the application program 101 between the two computers A and B as an example.

However, when the TCP / IP protocol is actually used, a plurality of application programs are operated on one computer, and a plurality of application programs are also operated on the IP network 119 in the same manner. Logically if there are multiple computers Each of these application programs independently forms a logical stream data flow, and communication between the application programs can communicate with each other without interfering with the contents of the data. it can.

[0049] As described above, the TCP / IP protocol provides a plurality of stream data transfer services that do not interfere with each other's contents, and actually uses one physical communication line or network interface device. It has a multiplexing function that can be done via.

A logical set of stream data transfer services in this case, that is, a data transmission / reception path (communication line) between the application program 100 and the application program 101 is called a “TCP / IP connection”.

In the example of FIG. 2, the application program 100 only transmits stream data to the application program 101 by communication using the TCP / IP protocol. However, in the TCP / IP connection, the reverse direction is used. This transmission process can also be performed in parallel with the forward transmission process. That is, the TCP / IP connection is a bidirectional connection.

Full duplex communication can be performed.

[0050] In the example shown in Fig. 2 above, only one application program is running on one computer, but in the TCP / IP protocol, multiple application programs run on each of the two computers. In addition, a TCP / IP connection can be created between each application program between the two computers, and stream data can be transmitted and received in both directions using this TCP / IP connection.

In the case of the above transmission / reception, each application program that is a party of communication is a 16-bit numerical value to distinguish the application program that is currently connected and the communication destination application program in the TCP / IP connection from the other communication destination application programs. The other party is identified by the identification information. This is the port number in the identification information STCP header.

[0051] A plurality of applications are running between the two computers described above, and a communication destination specifying process between the applications will be described with reference to FIG. Figure 3 is a conceptual diagram illustrating the flow of processing for identifying the communication destination in a TCP / IP connection. It is.

Two application programs 131 and 132 are running on the computer B to identify the communication destination by the TCP / IP connection, and the application program 131 is an application program using the port number X on the computer A. One application program 132 communicates with the application program using port number Y on computer A by establishing a separate TCP / IP connection.

[0052] The application program 131 generates stream data 138 to be transmitted to the port number X of the computer A, outputs the stream data 138 to the TCP / IP protocol stack 135, and transmits the stream data 138 to the port number X of the computer A. Instruct to send.

At almost the same time, the application program 132 generates stream data to be transmitted to the port number Y of the computer A, outputs it to the TCP / IP protocol stack 135, and transmits the stream data 139 to the port Y of the computer A. Instruct.

The TCP / IP protocol stack 135 divides each stream data 138 and 139 input from both application programs 131 and 132 into sizes that can be transmitted, and generates IP packets 133 and 134.

[0053] The TCP / IP protocol stack 135 then adds the port number of the destination computer A, the sequence number indicating the transmission order, the IP address of the destination computer A, etc. Generate multiple IP packets (IP packets 133, 134) with IP headers including

Then, the TCP / IP protocol stack 135 outputs the generated IP packets to the network interface driver 137 in the order in which the processing is completed or in an arbitrary order. As a result, the network interface device 137f is controlled to the network interface device, and the IP packet is transmitted to the network and the IP network via the network interface device.

[0054] Upon receiving the IP packet of the network interface device of the destination computer A, the TCP / IP protocol stack 135 implemented in the computer A uses the destination application based on the port number included in the IP packet. For each program, Is reconstructed and output to the corresponding application program.

Conversely, when a UP packet is sent from computer A to each application program running on computer B, TCP is sent via the network interface device and network interface driver in the opposite direction. / IP comes into the protocol stack.

[0055] The TCP / IP protocol stack refers to the IP header and TCP header of each IP packet, and extracts the IP address, the destination IP address, the source port number, and the destination port number of the transmission source computer A.

Then, if the destination IP address and destination port number are correct, the TCP / IP protocol stack uses the data obtained by removing the IP header and TCP header for each set of connections based on the sequence number in the TCP header. Connect together.

In the case of FIG. 3, the TCP / IP protocol stack sends the reconfigured stream data to the corresponding port number, that is, to the first application program 131 if the data arrives from port X of computer A. If the data arrives from port Y of computer A, it is output to the second application program 132, respectively.

[0056] The TCP / IP packet header includes a source IP address, a source port number, a destination IP address, a destination port number, a sequence number, a harmed | Part of the data and other information (see RFC for other information).

A TCP / IP connection is a logical connection that provides a two-way stream data transfer that is recognized by a program on the node that is trying to communicate or is doing so. It is distinguished from other connections by a set of four pieces of information: IP address, source port number, destination IP address, and destination port number.

[0057] The above sequence number is a regular number added by the sender when the stream data, which was originally a series of data flows, is divided into packets, and the received communication such as the TCP / IP protocol stack is received. It is used by the control program to reconstruct the divided packet power stream data.

If there are two application programs in the above, Only the case where a maximum of one TCP / IP connection has been created and communication has been described between application programs.

However, in the actual TCP / IP protocol, communication can also be performed by forming multiple (two or more) TCP connections between two application programs.

The above processing is an outline of the TCP / IP connection after the connection is completed, and processing not described elsewhere is performed. However, since it is not directly related to the present invention, the description thereof is omitted (details). (Specified in specifications such as RFC).

[0058] The flow of data when communicating using two application program capabilities between two computers using TCP / IP has been explained in Fig. 2, but data communication using the TCP / IP protocol is possible. The condition is that a TCP / IP connection has already been established in some way between the two programs.

In other words, in the TCP / IP protocol, between two application programs

In order to establish a TCP / IP connection and enable both parties to communicate via this TCP / IP connection, as shown in Fig. 4, in general, one of the computers running on one of the computers The application program becomes a “TCP / IP server” and there is another component.

Figure 4 is a conceptual diagram showing the relationship between the TCP / IP server program and the TCP / IP client program.

In this case, as shown in FIG. 4 (a), the TCP / IP server program 140 is waiting for one or more TCP / IP ports (port number X).

On the other hand, the TCP / IP client program 141 is connected to the connected computer, the IP address of the computer on which the TCP / IP server program 140 is running, and the port number that the program is waiting on (TCP / IP port port number). And send a connection request signal (synchronization request signal) to the computer running the TCP / IP server program 140.

[0060] Next, as shown in FIG. 4 (b), the TCP / IP server program 140 has a connection request. If it is determined that the connection with the TCP / IP client program 141 is permitted, a connection acceptance response signal is returned to the TCP / IP client program 141 of the transmission source.

Thereafter, the TCP / IP client program 141 returns a confirmation signal (acknowledge signal) indicating that the connection acceptance response signal has been received to the TCP / IP server program 140.

[0061] Next, as shown in FIG. 4 (c), the TCP / IP server program 140, when receiving the confirmation signal, establishes a new TCP / IP connection between the two application programs. Configure.

This is a procedural power TCP / IP handshake that establishes a new TCP / IP connection between two TCP / IP clients by performing the series of processing shown in FIG. 4 described above.

Fig. 4 is a conceptual diagram that briefly shows the processing described above, which is an application program.

[0062] That is, when performing some data communication using the TCP / IP protocol, one of the two application programs to communicate is a TCP / IP server program in advance, and one or more TCP / IP Powerful that you need to wait for the port.

This port is called a standby port, and this port number is called a standby port number. Normally, one application program can prepare multiple standby ports.

[0063] Further, when there is a connection request from two or more TCP / IP client programs, the TCP / IP server program can permit all the connections.

Then, after permitting the connection, the TCP / IP server program forms a TCP / IP connection with multiple TCP / IP client programs by itself (independently). Stream data can be sent to and received from IP client programs separately from other TCP client programs.

SoftEther (registered trademark), hereinafter referred to as the VPN system of the present invention. Using the VPN system of the present invention, a virtual private network (hereinafter referred to as VPN) can be constructed by connecting two or more computers over an IP network such as the Internet.

Although the above VPN system does not actually have a hardware (physical) network interface, the operation of a network interface (hereinafter referred to as a LAN card) that supports IEEE802.3 is logically emulated. A virtual network interface device (hereinafter referred to as a virtual LAN card) called a program (or a hardware system composed of ASICs with similar functions) and a hardware network interface that does not actually have Is a virtual IEEE802.3 MAC frame exchange program that emulates the operation of a packet switching device (hereinafter referred to as a switching HUB) that has a connection port from multiple network interfaces that support IEEE802.3. (Hereinafter referred to as Virtual HUB) program (or similar It constituted by two configured hardware system) in ASIC or the like having a capability.

FIG. 5 is a conceptual diagram showing a configuration example of a communication-system VPN system according to an embodiment of the present invention.

In this figure, virtual LAN card programs 11 and 21 are installed on two computers, VPN client computers 10 and 20, respectively, and virtual HUB program 31 is installed on one computer.

These three computers are connected to an existing IP network 119 (such as the Internet) that can communicate with each other using the IP protocol.

The configuration of the embodiment of the present invention of FIG. 5 is that the virtual hub program 31 is installed, the computer operating as the virtual hub is the VPN server computer 30, and each of the virtual LAN card programs 11 and 21 is installed. The computers operating as the virtual LAN card are the VPN client computer 10 and the VPN client computer 20.

In the configuration shown in FIG. 5, each of the virtual LAN card programs 11 and 21 operating on both the VPN client computer 10 and the VPN client computer 20 is a TCP / IP client program (the virtual LAN card is a hardware (If a TCP / IP client terminal) Is working as.

[0067] The Virtual Hub program 31 running on the VPN server computer 30 is running as a TCP / IP server program (or TCP / IP server device if the Virtual Hub is hardware).

The Virtual Hub program 31 prepares a predetermined TCP port as a standby port as a TCP / IP server program.

As described above, the Virtual Hub program 31 is configured so that the virtual LAN card programs 11 and 21 operating on both the VPN client computers 10 and 20 are connected to the TCP port on which the TCP / IP server program is listening. On the other hand, after completing the handshake using the TCP / IP protocol, a connection is formed, and authentication work and the like are completed for both the VPN client computers 10 and 20.

[0068] The above-described connection is formed between each virtual LAN card program 11, 21 (hereinafter referred to as virtual LAN card 11, 21) and virtual HUB program 31 (hereinafter referred to as virtual HUB 31). When the work such as the authentication work is completed, the virtual LAN cards 11 and 21 are referred to as a state where the VPN connection in the VPN system of the present invention is completed with respect to the virtual HUB 31.

In addition, when two or more virtual LAN cards have been connected to the same Virtual Hub 31, communication between these virtual LAN cards is performed when a MAC frame that conforms to the IEEE802.3 specifications is used. This can be done arbitrarily via HUB31.

Therefore, in the VPN system according to the embodiment of the present invention shown in FIG. 5, between the virtual LAN card 11 of the VPN client computer 10 and the virtual LAN card 21 of the VPN client computer 20, the VPN server computer 30 It is possible to send and receive arbitrary MAC frames (corresponding to frames 122 and 125 in Fig. 2) via (via) the virtual HUB program running on.

In this connection state, when the application program 12 operating on the VPN client computer 10 tries to perform network communication, the application program 12 outputs data to be transmitted to the existing protocol stack.

[0070] Then, the protocol stack 13 provided as a part of 〇S already describes the above data. As described above, the MAC frame is converted into a plurality of MAC frames having a predetermined amount of data, and the MAC frame is output to the LAN card set in advance in the application program 12, that is, the virtual LAN card 11.

Here, when the virtual LAN card 11 receives the MAC frame, the virtual LAN card 11 performs processing necessary for the VPN of the present invention, such as adding an encryption and an SE header, which will be described later, and performing encapsulation. Is output to protocol stack 13.

Next, the protocol stack 13 adds a predetermined TCP / IP header to the input packet and converts the packet into an IP packet, and sends it to the IP network 119 via the interface device 14.

[0071] When the IP packet is delivered (arrived) to the VPN server computer 30 by predetermined routing or the like provided in the IP network, the protocol stack 33 receives the IP packet via the interface device 34. To do.

When the protocol stack 33 detects that the destination of the IP packet is the Virtual HUB 31 by referring to the TCP / IP header, the protocol stack 33 outputs the IP packet to the Virtual HUB 31.

As a result, the Virtual Hub 31 can receive the IP packet in the VPN system of the present invention, and performs the reverse process to the encapsulation process performed by the virtual LAN card 11 in the VPN client computer 10. The MAC frame generated by the protocol stack 13 of the VPN client computer 10 is extracted.

[0072] Next, the Virtual HUB 31 performs processing necessary for the VPN of the present invention such as adding the encryption and SE header to be described later to the extracted MAC frame and encapsulating it, and after the change Packet is output to protocol stack 33.

Then, the protocol stack 33 adds a TCP / IP header, which is the virtual LAN card 21 of the destination SVPN client computer 20, to the input packet, generates an IP packet, and sends the IP packet to the interface device. It is sent to IP network 11 9 via 34.

[0073] When the IP packet is delivered (arrived) to the VPN client computer 20 by predetermined routing or the like provided in the IP network, the protocol stack 23 sends the IP packet via the interface device 24. Receive. Next, when receiving the IP packet, the protocol stack 23 refers to the TCP / IP header and outputs the IP packet to the virtual LAN card 21 when the destination is the TCP / IP virtual LAN 21.

When the virtual LAN card 21 receives the IP packet, the virtual LAN card 21 performs processing opposite to the encapsulation processing performed by the virtual hub 31 of the VPN server computer 30 and the protocol stack 13 of the VPN client computer 10 The generated MAC frames are extracted and sequentially output to the protocol stack 23.

[0074] Next, the protocol stack 23 refers to the TCP / IP header for each input MAC frame, performs predetermined processing such as rearrangement of MAC frame data in the order of output from the protocol stack 13, The data transmitted by the application program 12 is reconfigured and output to the destination application program 22.

Data power transmitted by the application program 12 that operates on the VPN client computer 10 between the application programs 12 and 22 that perform network communication by performing the above-described series of processing. Application that operates on the VPN client computer 20 It will be passed to program 22 and data communication between both sides will be performed.

[0075] <Comparison of normal LAN and LAN virtually constituted by VPN system of the present invention>

Next, a comparison is made between a LAN (see Fig. 6 (a)) that employs normal IEEE802.3 as the physical layer and a VPN (Fig. 6 (b)) configured by SoftEther.

Fig. 6 (a) shows the concept of the normal LAN configuration, and Fig. 6 (b) shows the concept of the virtual LAN configuration virtually formed on the network in the VPN system of the present invention. I'm going. In an actual VPN configuration, the device 36 does not need to be a single layer 2 frame switching device, but an IP network (a large-scale network such as the Internet) that is a collection of multiple layer 2 and layer 3 switching devices. But it may be good).

In a normal LAN that uses IEEE802.3, as shown in Fig. 5 (a), network interface devices (physical LAN cards) that support IEEE802.3 and are installed in multiple computers, respectively. , 182, 183, and IEEE802.3 MAC frame exchange device 158 (physical switching hub) installed in the center and force S, cable, optical fiber, or wireless It is connected by a communication line of any physical layer.

[0076] The MAC address of the LAN card 181 of one of the computers connected to the switching HUB158 (MAC frame switching device) is the MAC address of the LAN card 182 of another computer connected to the same switching HUB158. If the LAN card 182 with this MAC address is used as the destination to transmit data, the IEEE802.3 specification states that each transmitted data is a maximum of 1,514 bytes called a MAC frame. (Variable) packets are divided by the protocol stack.

[0077] Then, when the switching HUB 158 receives a MAC frame at the connection port set for the LAN card 181, the MAC frame is connected to another LAN card of an appropriate destination described in the MAC header. Send to the connected port.

Here, if the appropriate LAN card 182 is connected as the destination and the connection port is unknown, the switching HUB 158 is connected to some device other than the connection port from which the MAC frame was transmitted. The same MAC frame is copied and transmitted to all connection ports.

That is, when the connection port of the destination LAN card is unknown, the switching HUB 158 copies and distributes the same packet to all connected parties other than the sender of the MAC frame (this operation is called flooding). Call).

[0078] As described above, the MAC frame distribution function of the switching HUB 158 allows the physical network interface device on each computer to send and receive arbitrary MAC frames between them.

In the configuration of the VPN system of the present invention, a virtual LAN card program (virtual LAN card) and a virtual switching HUB program (virtual HUB) exist as programs in the VPN as in the LAN described above. However, two or more virtual LAN cards connected to one Virtual Hub can send and receive arbitrary MAC frames to each other.

[0079] This configuration will be described with reference to FIG. 6 (b). Each virtual LAN card 12, 22, and 522 operating (provided) on each computer operates on one computer. Connected to Virtual Hub 31. In the configuration shown in FIG. 6 (b), a virtual LAN card 12 recognizes the destination MAC address of the virtual LAN card 22 on another computer connected to the same virtual HUB 31, and the virtual LAN card 22 On the other hand, when transmitting a MAC frame, the MAC frame undergoes a process called encapsulation by the process in the virtual LAN card 12, and is converted into stream data.

[0080] Then, the virtual LAN card 12 waits for the generated stream data for the physical IP address of the computer on which the virtual hub 31 to which the virtual LAN card 22 is connected and the virtual hub 31 to listen. Instructs the TCP / IP stack (protocol stack already described) to transmit to the TCP / IP port number that is being sent, and outputs stream data to the TCP / IP stack.

The TCP / IP stack 15 performs exactly the same processing as when a normal application program already described tries to send arbitrary stream data to other programs on the network using the TCP / IP protocol. The stream data generated by the virtual LAN card 12 is sent to the destination Virtual Hub 31. An existing IP network (such as the Internet) is used for this transmission.

[0081] Virtual HUB 31 performs processing opposite to encapsulation (referred to as decapsulation) for the content of stream data that is finally received from virtual LAN card 12 via TCP / IP stack 15 or the like. And take out the MAC frame that the virtual LAN card 12 tried to transmit. Next, Virtual Hub 31 refers to the destination MAC address of each MAC frame, and if it detects that virtual LAN card 22 of that destination MAC address is currently connected to itself, that virtual LAN card 22 operates. The destination computer is encapsulated in the same way as the virtual LAN card 12, and the MAC frame is converted to stream data via the IP network. Sent to a computer running card 22.

[0082] If an appropriate virtual LAN card that is currently connected and that corresponds to the destination MAC address of the MAC frame does not match, the Virtual Hub 31 sends the virtual LAN that is the sender of the MAC frame. The MAC frame is copied and distributed to all virtual LAN cards connected to cards other than card 12 (that is, flooded). As a result, each of the plurality of virtual LAN cards connected to the Virtual Hub 31 can transmit / receive an arbitrary MAC frame between the Virtual Hub cards via the Virtual Hub 31.

[0083] <Method of MAC frame exchange by Virtual HUB>

Next, we will explain how to exchange MAC frames using a Virtual Hub. To make the explanation of this exchange process easier to understand, we will first explain how to exchange MAC frames using a physical switching hub. explain.

Here, when a physical switching hub is operating in a physical LAN and multiple physical LAN cards are connected, how are MAC frames exchanged between the LAN cards? Figure 7 shows how this is done. FIG. 7 is a conceptual diagram illustrating a method of MAC frame exchange by the physical switching HUB158.

[0084] First, the physical LAN card 151 may overlap within a range in which MAC frames can be directly transmitted and received with the same IEEE 802.3 (this range is called a broadcast domain). The MAC address is added as a unique address.

This MAC address is usually an identification number assigned by each LAN card manufacturer and an industry group created by the manufacturer or engineer. This MAC address is 6 bytes (48 bits).

[0085] Then, the MAC frame sent from any physical LAN card 151 automatically has two MAC addresses: the MAC address of the LAN card 151 and the MAC address specified as the destination LAN card 152. Information card (destination MAC address, source MAC address), additional information necessary for control of other MAC frames, and a MAC frame of up to 1,514 bytes including data that you want to actually transmit. 158 is transmitted as an electrical signal.

When the physical switching HUB 158 receives a MAC frame as an electrical signal from the physical LAN card 151 at a predetermined connection port # 1, it is converted into digital data at a MAC frame receiving unit (usually an electronic circuit) 154.

Next, the MAC frame switching processing unit 155 reads two pieces of address information, that is, a destination MAC address and a source MAC address, from each input MAC frame. The switching hub 158 usually has a finite number of connection ports, and if any device is connected to each connection port, the MAC frame transmission queue (160) corresponding to the connection port to which the device is connected. , 161, 162) inside.

Actually, even if no device is connected to the connection port, there is a case where a transmission queue is always provided inside.

[0087] When an arbitrary MAC frame is input, the MAC frame switching processing unit

155 adds the input MAC frame to the MAC frame transmission queue corresponding to the connection port connected to the LAN card having the MAC address that is the destination of this MAC frame.

At this time, the MAC frame switching processing unit 155 refers to only the destination MAC address, and when it is detected in advance which connection port the LAN card 152 having the destination MAC address is connected to, The input MAC frame is added only to transmission queue 161 of connection port # 2.

[0088] For this reason, switching HUB 158 internally has a list of known MAC addresses and a correspondence table for storing which connection port each MAC address in this list corresponds to.

Therefore, the MAC frame switching processing unit 155 examines this table for all MAC frames that contain the MAC address information of the destination LAN card and determines which transmission port transmission queue the MAC address should be added to. It is detected every time.

Then, when the MAC frame switching processing unit 155 receives a new MAC frame at an arbitrary connection port, the MAC frame switching processing unit 155 refers to the transmission source MAC address extracted from the header of the received MAC frame, and determines the MAC address. Correspondence between MAC address and connection port number If the MAC address and connection port number do not exist in the table, a new MAC frame source MAC address and connection port number are registered in the correspondence table between MAC address and connection port number. If the address exists and the connection port number is different, the process of constantly updating the correspondence table between the MAC address and the connection port number is performed by overwriting the connection port number for that MAC address. I'm going.

That is, the MAC frame switching processing unit 155 sends a destination to each MAC frame. The MAC address and port number required for processing while adding the MAC frame to the transmission queue (160, 161, 162) corresponding to the port where the LAN card may be connected To create or update the correspondence table.

In addition, when one or more MAC frames exist in the MAC frame transmission queue prepared for each connection port, the MAC frame transmission unit 157 corresponding to the connection port receives The MAC frames are taken out in order from the head of the corresponding MAC frame transmission queue, and converted into electrical signals are sent out electrically from the connection port.

[0091] This electrical signal is sent by the MAC frame transmission unit 157 to the physical LAN card that is the destination.

152, that is, transmitted to the LAN card 152 having the MAC address designated as the destination MAC address of the MAC frame, and the data transmission processing of the MAC frame is completed.

As described above, once a MAC frame is passed, it is assigned to the transmission queue prepared for each connected device, and then the bucket is forwarded to the actual destination in the order of the head strength of the transmission queue. Generally called “Store and Forward”.

In store-and-forward, the store is to determine the transmission queue corresponding to the appropriate connection destination and add it to the transmission queue, and the forward is to extract the leading packet from the transmission queue and connect to the connection destination. It refers to the action of sending to.

FIG. 8 is a conceptual diagram for explaining a method of virtual MAC frame exchange by the VPN system of the present invention. This FIG. 8 is written in contrast to the method of MAC frame exchange by the physical switching HUB158 described in FIG.

As described above, the VPN system constituted by the virtual LAN system of the present invention has the virtual HUB 31 and a plurality of virtual LAN cards (12, 21,...) Connected around it.

This virtual LAN system has the same configuration as the LAN system using the physical switching HUB 158 described in FIG. 7 and a plurality of physical LAN cards (151, 152) connected to it. ing.

[0093] Therefore, in Fig. 7, “How to exchange MAC frames using a physical switching hub” As explained in the “Method”, a mechanism in which physical LAN cards (151 and 152) connected to a single switching HUB158 exchange arbitrary MAC frames with each other, centering on the physical switching HUB158. In the following, what kind of frame exchange processing is performed in the VPN system of the present invention will be described.

First, there is a computer C on which one virtual hub 31 is operating, and computers A and B on which two virtual LAN cards 11 and 21 are operating.

[0094] Here, each of the virtual LAN card 11 and the virtual LAN card 21 is logically IEEE802.3-compliant than the network interface device (physical LAN card) 16 and 26 with a physical connection connector. A program (or hardware) that emulates the operation of a LAN card.

These virtual LAN cards (11, 21) are recognized and controlled in the same manner as physical LAN cards by the protocol stack application program operating in a higher layer.

First, a MAC frame in a format compliant with IEEE 802.3 transmitted between the virtual LAN cards 11 and 21 via the virtual hub 31 is defined as a “virtual MAC frame”.

This is because the virtual MAC frame is transmitted and received between the virtual LAN card (11, 21) and the virtual hub (31), but the raw data of the virtual MAC frame is actually used as an electrical signal. This is because it is encapsulated by a header (described later) that contains some information that does not flow on the line.

Here, for example, the virtual LAN card 11 is set to a MAC address “001111111111”, and the virtual LAN card 21 is set to a MAC address “002222222222”.

Then, the virtual LAN card 11 uses itself as the source MAC address and the destination MAC address as the MAC address of the virtual LAN card 21, and transmits a virtual MAC frame including data to be transferred to the virtual LAN card 21. At this time, the virtual LAN card 11 performs processing such as encryption and electronic signature on one or more virtual MAC frames to be transmitted.

Next, the virtual LAN card 11 adds the SE header corresponding to the protocol in the VPN system of the present invention to the MAC frame on which the above processing has been performed. A stream that can be transmitted using the TCP / IP protocol after being converted into a data format that conforms to the communication protocol (referred to as SE protocol control) that defines the data transmission / reception method between the host and the Virtual Hub. Data (stream data 40 in SE protocol format) is generated and output to the TCP / IP stack 15.

At this time, the virtual LAN card 11 uses the IP address of the computer C on which the Virtual HUB 31 is operating and the Virtual HUB 31 operating on the computer C as the destination for transmission processing in the TCP / IP protocol. Specify as the port number of the TCP port that is listening on. The TCP / IP stack 15 uses the same processing procedure as when the stream data 40 in the SE protocol format is input from the application program that performs communication using the normal TCP / IP protocol. The TCP interface and the IP header are divided, and this is converted into an IP packet to form a plurality of IP packets 41 to the physical network interface device 16 provided in the computer C. Output via a device driver that supports.

Then, the IP packet is transmitted on the IP network 119 by processing according to the normal TCP / IP protocol, and is a physical network interface device 34 provided in the computer C on which the virtual hub 31 is operating. To be received.

As a result, the network interface device 34 outputs the received IP packet 44 (IP packet 41) to the TCP / IP stack 35 via the device driver corresponding to itself.

Here, the IP packet 44 input to the TCP / IP stack 35 corresponds to a plurality of IP packets 41 that the TCP / IP stack 15 converts into IP packets.

[0099] Then, the TCP / IP stack 35 combines the plurality of IP packets 44 according to the sequence number included in the TCP header to restore the stream data 45.

In other words, the TCP / IP stack 35 uses the IP packet generated by dividing the TCP / IP stack 15 in the same way as when the data addressed to the application program that communicates according to the normal TCP / IP protocol arrives. 41 is combined, and the stream data 45 corresponding to the stream data 40 generated by the virtual LAN card 11 is restored.

TCP / IP stack 35 specifies stream data 45 restored by combining IP packets 44. Output to Virtual Hub 31 that listens on the specified port number.

[0100] When the Virtual HUB 31 receives the stream data 45 in the SE protocol format, the Virtual HUB 31 performs a process reverse to the encapsulation performed by the virtual LAN card 11, that is, a decapsulation process.

As a result, Virtual HUB 31 extracts the virtual MAC frame in the virtual LAN system by processing such as decapsulation.

The extracted virtual MAC frame is a virtual MAC frame transmitted by the virtual LAN card 11, and is output from the virtual hub 31 to the virtual MAC frame switching processing unit 49. Then, the virtual MAC frame switching processing unit 49 The configuration is the same as the physical switching hub 158 described in FIG. 7, and virtual MAC frame exchange is performed by the same processing as the MAC frame exchange method performed by the switching hub 158 (details will be described later).

[0101] In addition to the transmission queue 50 corresponding to the virtual LAN card 11, the Virtual HUB 31 operates on a plurality of computers (for example, computer B) and performs a plurality of virtual LAN cards (for example, 2 1,. ···) is established, and there is one transmission queue (51, 52, ...;) corresponding to each connection port for each virtual LAN card.

The virtual MAC frame switching processing unit 49 refers to the virtual MAC frame input from the decapsulation unit 48 that performs decapsulation and extracts the source MAC address and the destination MAC address.

[0102] Then, Virtual HUB 31 shows a correspondence table between the virtual MAC address and the virtual LAN force connected to the connection port, with the MAC address and connection port number in the physical switching HUB158 shown in Fig. 7. Perform the same processing as the operation for the correspondence table (details will be described later), look at the destination MAC address of the input virtual MAC frame, and check the destination MAC address and the virtual LAN card connected to the connection port. From the correspondence table, a transmission queue for the destination virtual LAN card, for example, the transmission queue 51 is selected.

[0103] Then, the Virtual HUB 31 adds a virtual MAC frame to the end of the selected transmission queue 51 (at the end of the queue). In the case of Virtual HUB31 as well as physical switching HUB158, if the destination MAC address is a broadcast address or if the destination virtual LAN card cannot be determined, except for the transmission queue corresponding to the source virtual LAN card, Performs flooding processing for all other transmission queues.

[0104] The virtual hub 31 is provided with encapsulation units 53, 54, and 55 for performing encapsulation.

Each of these power psenolays 54 and 55 takes out the virtual MAC frame in order from the top in the state where one or more virtual MAC frames exist in the transmission queues 50, 51 and 52, respectively. As with card 11, a communication protocol (SE that controls the communication method between the virtual LAN card and the virtual hub, such as encrypting and digitally signing each MAC frame and adding an SE protocol header) It is converted (encapsulated) into a data format according to the protocol.

[0105] Each of the encapsulation units 53, 54, and 55 generates stream data (stream data in the SE protocol format) 47 that can be transmitted by the TCP / IP protocol, and converts this into the TCP / IP stack 35. Output to.

At this time, the destination at the time of transmission processing in the TCP / IP protocol corresponds to the IP address of computer B on which the destination virtual LAN card 21 is operating and the virtual LAN card 21 operating on that computer C. Specify the TCP port number.

[0106] Next, the TCP / IP stack 35 uses the same procedure as when stream data is input from an application program that performs communication using the normal TCP / IP protocol. , And a TCP header and an IP header are added to the divided packet, and the IP packet is made into a plurality of IP packets 46, and this network is connected to the physical network interface device 34 provided in the computer C. Output via a device driver compatible with interface device 34.

[0107] Then, the IP packet 46 is sent to the IP network by normal TCP / IP protocol transmission control.

Through 119, the physical network interface device 26 on the computer B on which the destination virtual LAN card 21 is operating is reached.

As a result, the physical network interface device 26 inputs the IP packet 46 and outputs the IP packet 43 (corresponding to the IP packet 46) to the TCP / IP stack 25. Next, the TCP / IP stack 25 combines the IP packet 43 and outputs it to the virtual LAN card 21 as stream data 42 by processing corresponding to the normal TCP / IP protocol.

Here, the stream data 42 corresponds to the stream data 47 generated by the virtual HUB 31.

Then, the virtual LAN card 21 receives the stream data 42 from the TCP / IP stack 25, cancels the encapsulation by the reverse process of the encapsulation process by the virtual hub 31, and finally the virtual LAN card 11 transmits it. Extract multiple MAC frames.

Through the transmission / reception process described above, the virtual LAN card 21 can receive the virtual MAC frame transmitted by the virtual LAN card 11 and having the destination MAC address “002222222222”.

[0109] Further, transmission from the virtual LAN card 21 to the virtual LAN card 11, that is, transmission of a virtual MAC frame in the reverse direction described above, or any virtual LAN operating and running on another computer 500 other than this example If there are virtual MAC frames sent to the card that are connected to the same Virtual HUB 31, any virtual MAC frame sent to or received from that virtual LAN card is the same as the process described here. Can be done. As described above, transmission / reception of a virtual MAC frame between a plurality of virtual LAN cards centered on a virtual hub by the VPN system of the present invention is performed between a plurality of physical LAN cards centered on a physical switching hub. This is possible in the same way as sending and receiving MAC frames.

[0110] <Server / client relationship between Virtual Hub and Virtual LAN Force>

In the VPN system of the present invention, as described with reference to FIG. 8, the data encapsulating the virtual MAC frame transmitted / received between the virtual LAN cards 11, 21 and the virtual hub 31 uses the TCP / IP protocol as stream data. Sent and received.

When a TCP / IP connection is established between two computers by using the processing according to the TCP / IP protocol described above and a bidirectional stream data transfer service is used, one is a server and the other is a client. A relationship needs to be configured.

A program that becomes a TCP / IP server puts a specific port number on standby,

Program power as a TCP / IP client Specify the computer's IP address and port number, and call the TCP / IP stack (protocol stack).

[0111] As a result, the TCP / IP client program tries to handshake the port number on which the TCP / IP server program is running, and if successful, the TCP / IP client program and the TCP / IP server program A TCP / IP connection is defined that is defined by four sets of information: “server-side IP address, server-side port number, client-side IP address, client-side port number”, and is distinguished from other connections. It is.

When a connection is established and communication is started in the TCP / IP protocol, a program that is a TCP / IP server program is required.

In the configuration of the VPN system of the present invention, as shown in FIG. 9, for example, a plurality of virtual LAN cards 11, 21, 501,... It is appropriate that Virtual Hub 31 is the center of the VPN system, that is, a TCP / IP server program, and virtual LAN cards 11, 21,... Are TCP / IP client programs.

Therefore, a TCP / IP connection is established with the Virtual Hub 31 as the server and the Virtual LAN card as the client.

FIG. 9 is a conceptual diagram briefly showing the server / client relationship between the virtual hub 31 and the virtual LAN cards 11, 21,...

[0113] First, in the initial state, for example, the virtual LAN card 11 is not connected to any Virtual HUB. Therefore, in order to use it, the virtual LAN card can be used on another computer or the same computer by user operation. However, it is necessary to connect to a Virtual HUB that is operating in good quality.

There are two stages in the process of connecting the virtual LAN card 11 to the Virtual Hub 31.

The first stage is a handshake process for connecting the Virtual LAN card 11 as a TCP / IP client to the TCP / IP port where the Virtual Hub 31 is waiting as a TCP / IP server. is there.

This is necessary for normal TCP / IP protocol communication and is not unique to the present invention.

[0114] Next, as the second step, after the connection is established at the TCP / IP protocol layer (the node shake is successful), the virtual HUB 31 and the virtual hub 31 are connected to the virtual hub 31 using the established TCP / IP connection. SE protocol-specific handshake processing is performed between LAN cards 11 using the SE protocol.

This SE protocol-specific handshake processing includes authentication processing for the virtual LAN 11 to check the validity of the Virtual Hub 31, authentication processing for the Virtual Hub 31 to check the validity of the Virtual LAN 11, This includes the process of checking the version information of Virtual Hub 31 and Virtual Network Adapter 11 between each other.

Data required for SE protocol-specific handshake processing is mutually exchanged by the TCP / IP connection function established between all virtual LAN cards (11, 21, 521) and the virtual hub 31. Is called.

[0115] At the stage where all the processes in the handshake process are successful, it is detected that the communication between the Virtual Hub 31 and the Virtual LAN card 11 or 21, 521,. Virtual LAN Force 11 remembers that the client is authenticated by an access control database (such as a user name and password pair) that is determined by the Virtual Hub administrator in advance.

[0116] When this legitimacy is confirmed, the Virtual Hub 31 communicates with each of the plurality of virtual LAN cards (11, 21, 521, ···) in a reliable manner. (Client side and server side force S, which means that the current session is remembered. Physically does not occupy one line) Therefore, after each reliable logical connection is established, the logical communication session with each virtual LAN card 11 is managed in units.

The above logical connection refers to the state in which the Virtual Hub is currently connected and can transmit / receive virtual MAC frames to / from each LAN card at any time. In the VPN system of the present invention, a logical storage of the relationship between Called Yon.

[0117] The session in the VPN system of the present invention is logical (meaning that the client side and the server side remember that the session is currently established. Physically, one The virtual MAC frame is transmitted and received in full duplex between the virtual LAN card 11 that is the client and the virtual hub 31 that is the server in the session. You can do it.

However, the virtual MAC frame actually transmitted / received is transmitted / received by transmitting / receiving the stream data after performing the capsule processing such as encryption in the handshake processing and the attachment of the electronic signature. Flows within a logical TCP / IP connection.

[0118] For this reason, normally, each logical session has a one-to-one correspondence with one logical TCP / IP connection. Can support more than two TCP / IP connections).

Once a session is established, it can be disconnected from either the virtual LAN card 11 side or the Virtual Hub 31 side.

Also, due to the occurrence of an abnormal situation such as the communication status of the IP network in the middle becoming unstable, the physical line being disconnected, one computer shutting down, or one program shutting down Session may be disconnected.

Next, the SE protocol sequence in the VPN system of the present invention described above will be described with reference to FIG.

FIG. 10 is a conceptual diagram showing sequence processing when data is transmitted and received between the virtual LAN card and the virtual HUB for explaining the SE protocol sequence in the VPN system of the present invention.

First, in the initial state, the virtual LAN card 11 requests to connect to a specific virtual HUB 31 by a communication processing operation 200 from the user (connection request 201).

[0120] Then, the virtual LAN card 11 tries to establish a TCP / IP connection to the destination Virtual HUB 31 according to the connection request 200 from the user.

At this time, the virtual LAN card 11 determines the IP address of the Virtual Hub 31 and the standby port number. A connection request 201 including the specified instruction is output to the TCP / IP stack 15.

As a result, the TCP / IP stack 15 attempts a handshake to establish a TCP / IP connection with the connection-destination Virtual HUB 31 according to the TCP / IP protocol.

Here, the handshake process is actually a force performed by a plurality of times of IP packet transmission / reception, which is omitted here and expressed as handshake establishment 202.

[0121] After the handshake on the TCP / IP protocol is established, the stage in which bi-directional transfer of arbitrary stream data is possible between the virtual LAN card program and the virtual HUB program is shown in Fig. 10. It is expressed as “TCP / IP connection establishment”.

At the TCP / IP connection establishment stage, any type of IP network (Ethernet (registered trademark), ATM, frame relay, telephone line, etc.) is connected between Virtual Hub 31 and Virtual Network Adapter 11 during this period. Even if it exists, if one computer power tries to send any stream data, it means that the stream data reaches the other computer.

[0122] After the TCP / IP connection is established between the virtual LAN card 11 and the virtual HUB 31, the virtual LAN card 11 performs a handshake process according to the SE protocol with the virtual HUB 31. (SE protocol handshake request 203).

In practice, information necessary for authentication and other additional information is exchanged between the virtual LAN card 11 and the Virtual Hub 31.

Specifically, for the handshake process, the Virtual Hub 31 transmits the following information (SE protocol handshake response 205) to the virtual LAN card 11.

• Information required to start SSL communication when performing SSL communication between Virtual Hub 31 and Virtual LAN Card 11

• Virtual Hub 31 version information (if necessary)

• Challenge value (if required) when using challenge / response password authentication

• When using other authentication methods, authentication data corresponding to each authentication method, etc. (if necessary)

• Other extended information (if necessary) [0123] Further, the information (SE protocol handshake request 203) transmitted from the virtual LAN card 11 to the Virtual HUB 31 for handshake processing includes the following.

• Information required to start SSL communication when performing SSL communication between Virtual Hub and Virtual LAN

• Virtual LAN card program version information (if necessary)

• User identification code, such as the name of the user trying to connect (if necessary)

Response value when using challenge / response password authentication

• If other authentication methods are used, authentication data corresponding to each authentication method, etc. (if necessary)

• Other extended information (if required)

[0124] As described above, when the SE protocol handshake request 203 is input from the virtual LAN card 11, the TCP / IP stack 15 sends the IP packet 204 including the SE protocol handshake request 203 to the virtual HUB 31. Send.

Then, the TCP / IP stack 35 outputs the input SE protocol handshake request 203 to the virtual HUB 31.

[0125] Virtual Hub 31 confirms the validity of virtual LAN card 11 by referring to the input SE protocol handshake request 203, and outputs SE protocol handshake response 205 to TCP / IP stack 35. To do.

The TCP / IP stack 35 transmits an IP packet 206 including this SE protocol handshake response 205 to the virtual LAN card 11.

Then, the virtual LAN card 11 inputs the SE protocol handshake response 205 via the TCP / IP stack 15 and confirms the validity of the virtual HUB 31.

[0126] In the above-described processing, after the handshake processing is successful, as a final step, the hand that includes information indicating that the virtual hub 31 has completed the handshake processing and accepted the connection to the virtual LAN card 11. Send a shake success notification signal (final signal in the SE protocol handshake response).

This handshake success notification signal includes the following information.

• The session established between the virtual LAN card and Virtual HUB upon completion of the handshake Session ID to uniquely identify

• Other extended information (if necessary)

[0127] After this handshake process is successful, the SE session is established between the virtual LAN card 11 and the virtual HUB 31, and VPN communication is possible.

When the VPN communication is possible, the virtual MAC frame 208 transmitted from the virtual LAN card 11 to the other virtual LAN card via the virtual hub 31 is encapsulated by the virtual LAN card 11, As described above, it is converted into stream data. The rules for converting to stream data are stipulated in a common protocol defined in advance by Virtual Hub 31 and Virtual LAN Card 11.

In the example of FIG. 10, the virtual LAN card 11 outputs stream data 209 to the TCP / IP stack 15.

As a result, the TCP / IP stack 15 at this time makes the TCP / IP connection associated with the SE session established with the Virtual Hub 31 by converting the input stream data 209 into an IP packet. Is used to transmit through the IP network and send to the computer running Virtual Hub 31.

The TCP / IP stack 35 operating on this computer receives this IP packet 210.

Next, the TCP / IP stack 35 restores the stream data 211 from the input IP packet, and outputs this stream data 211 to the virtual HUB 31.

Then, the virtual HUB 31 extracts the virtual MAC frame 212 from the input stream data 211 by performing processing reverse to the encapsulation performed by the virtual LAN 11, that is, decapsulation.

As a result, the virtual MAC frame that the virtual LAN card 11 tried to transmit has arrived at the Virtual Hub 31.

Virtual HUB 31 can specify a session to which another virtual LAN card corresponding to the destination MAC address described in the virtual MAC frame is connected after performing predetermined switching processing and store-and-forward processing.

[0130] Then, for the session, the virtual LAN card 11 has a virtual MAC frame 20 8 is encapsulated, and the stream data 214 encapsulated in the virtual MAC frame 213 is processed by the TCP / IP stack 35 using the same process as that transmitted to the Virtual Hub 31 via the TCP / IP connection as stream data. Packet 215 is passed to other virtual LAN card via TCP / IP connection.

As a result of these series of work, VPN that can send and receive IEEE802.3 MAC frames via Virtual Hub can be constructed and operated between remote locations in a manner that spans existing IP networks such as the Internet. It becomes like this.

[0131] <Processing of encapsulation unit in virtual LAN card>

Next, on both the virtual LAN card and the Virtual Hub, according to the SE protocol rule established in advance, multiple MAC frames are encapsulated into stream data, and stream data is unencapsulated to create multiple MAC frames. It is possible to share a functional unit that performs almost the same process of extraction.

First, the processing of the encapsulation unit in the virtual LAN card 11 in the VPN system of the present invention will be described with reference to FIG. FIG. 11 is a conceptual diagram of the virtual LAN card for explaining the processing of the encapsulation unit in the virtual LAN card.

[0132] As can be seen from FIG. 11, the encapsulating unit 18 converts the virtual MAC frame 303 input from the protocol stack 302 of the upper layer into stream data, and forms the stream data 40 as the lower data. Output to TCP / IP protocol stack 13.

Further, the capsule release unit 19 performs a process opposite to the capsule unit 18 and extracts a plurality of virtual MAC frames 304 from the stream data 42.

Therefore, it can be seen that the encapsulation unit 18 and the decapsulation unit 19 have a central role in the IEEE 802.3 virtualization processing by the VPN system of the present invention.

[0133] Here, as described above, when the virtual LAN card 11 tries to transmit / receive arbitrary data to / from another virtual LAN card, the virtual LAN card 11 uses a program to perform communication. It can be used like a physical LAN card for the following reasons.

In other words, the operating system (OS) has an interface (device driver) that is no different from a virtual LAN card operating one physical LAN card. is doing.

At this time, when any communication application program 300 attempts to communicate via the VPN of the present invention, the communication application program 300 instructs the protocol stack 302 of the protocol to be used to transmit data. .

The protocol stack 302 of the protocol you want to use is that the physical layer LAN card receives data from applications such as TCP / IP protocol stack, NetBEUI protocol stack, IPX / SPX protocol stack, etc. Any existing protocol stack can be used as long as it has the ability to be converted into a MAC frame.

Then, the arbitrary protocol stack 302 is selected by the communication application program 300 and outputs a plurality of virtual MAC frames 303 to the virtual LAN card 11. As a result, when a plurality of virtual MAC frames 303 are input to the virtual LAN card 11, the force processor 18 encapsulates the plurality of virtual MAC frames and converts them into stream data 40. Data 40 is output to TCP / IP protocol stack 13.

The TCP / IP protocol stack 13 converts the input stream data 40 into IP packets 41, and passes through the existing physical network interface device 14 to the computer running the Virtual Hub on the IP network. Send to

On the other hand, when the IP packet 43 is input from the computer on which the Virtual Hub is operating on the IP network to the computer on which the virtual LAN card 11 is operating, the network interface device 14 is input. IP packet 43 is output to TCP / IP stack 13. The TCP / IP stack 13 restores it as stream data 42 since the IP packet 43 is converted into stream data (encapsulated) by the Virtual Hub and converted into IP data. Output to LAN card 11.

[0137] Next, in the virtual LAN card 11, the decapsulation unit 19 performs decapsulation processing on the input stream data 42, and extracts a plurality of virtual MAC frames 304. And, the decapsulation unit 19 extracts the extracted virtual MAC frames 304, The protocol number is referred to from the header part of the MAC frame, and passed to any protocol stack 302 currently available in the form of a plurality of virtual MAC frames.

Through the above-described processing, an arbitrary communication application program 300 can finally receive data by other computer power or VPN.

Next, the configuration of the Virtual Hub encapsulation unit in the VPN system of the present invention will be described with reference to FIG. FIG. 12 is a conceptual diagram showing a configuration example of a Virtual HUB for explaining the processing of the encapsulation unit of the Virtual HUB in the VPN system of the present invention.

When a virtual hub (for example, virtual hub 31) inputs IP packets from multiple virtual LAN cards connected via multiple SE sessions, the virtual MAC frame encapsulated from these IP packets is extracted and the header is extracted. Seeing the destination MAC address, the destination session of the MAC frame is determined, and transmission to the destination session is actually performed, that is, switching processing logically equivalent to the IEEE802.3 switching HUB is performed.

[0139] First, from a virtual LAN card mounted on a remote computer, an IP packet obtained by converting stream data containing multiple encapsulated virtual MAC frames into IP packets is input via the network interface device 34. The

Then, the TCP / IP protocol stack 35 combines the input IP packet 44 to restore the stream data 45, and outputs this stream data 45 to the decapsulation unit 48.

[0140] Then, the decapsulation unit 48 performs predetermined processing to decapsulate the input stream data 45, extracts a plurality of virtual MAC frames 307, and outputs them to the MAC frame switching processing unit 49 To do.

The MAC frame switching processing unit 49 uses the above-described “virtual MAC frame exchanging method by the VPN system of the present invention” to map the correspondence between the virtual MAC address and the SE session (corresponding to the connection port of Virtual Hub). , The switching process is performed according to the correspondence table, and the virtual MAC frame 306 sorted for each destination session is added to the transmission queue (50, 51, 52, ■) for each session. To do.

[0141] Next, in the transmission queue (50, 51, 52, ■■) prepared for each SE session, 0 or 1 The above virtual MAC frames are accumulated.

Here, when one or more virtual MAC frames are accumulated, the session encapsulation units (53, 54, 55,...) Corresponding to the transmission queue each correspond to the corresponding transmission queue. From the head of (50, 51, 52,...), For example, the head force of the transmission queue 51 is taken out and a plurality of virtual MAC frames 308 are taken out and encapsulated.

Then, the encapsulation unit 54 converts the plurality of virtual MAC frames into stream data 47 and outputs the stream data 47 to the TCP / IP protocol stack 35.

As a result, the TCP / IP protocol stack 35 converts the stream data 47 into an IP packet, generates a plurality of IP packets 46, and transmits the IP packets 46 to the IP network via the network interface device 34.

The IP packet is sent to the virtual LAN card ahead of the destination session.

[0143] <Standardization of Encapsulation / Decapsulation Rules>

The virtual LAN force and virtual hub's power pusher unit described above

In the VPN system of the present invention, which may be shared by the HUB, these are implemented by a common program (algorithm).

In the implementation of the VPN system in the present invention, for optimization,

'Convention for encapsulating multiple virtual MAC frames in a Virtual HUB to stream data

'Convention to unencapsulate stream data in virtual LAN and extract multiple virtual MAC frames

The two processes must be compatible.

[0144] Also,

'Convention for encapsulating multiple virtual MAC frames in a virtual LAN card and converting them to stream data

'Convention to unencapsulate stream data in Virtual Hub and extract multiple virtual MAC frames

The two processes must be compatible. [0145] Meanwhile,

There is no problem even if these two processes are not compatible.

[0146] Also,

'Convention to unencapsulate stream data in virtual LAN card and extract multiple virtual MAC frames

Even if these two processes are not compatible, there is no problem in VPN communication, but it is appropriate to apply the same rules to save programming effort.

[0147] <Processing of encapsulation unit>

Next, the processing contents of the force psenolays 18, 53, 54, 55 shown in FIGS. 11 and 12 will be described with reference to FIG. FIG. 13 is a block diagram illustrating a configuration example of the capsule unit. The capsule section 18 (53-55) has a coupling section 60, an expansion processing section 61, and a security information adding section 62.

When a plurality of virtual MAC frames 59 are input, the combining unit 60 performs a process of connecting and combining them in an appropriate order according to a predetermined number of frames when the plurality of virtual MAC frames arrives. Stream 63 is generated.

[0148] Then, the extension processing unit 61 performs 0 or 1 or more extension processing on the input stream 63, generates stream data 64, and outputs the stream data 64 to the security information adding unit 62. Here, the expansion processing can include processing for improving communication efficiency such as data compression.

Next, in order to protect the communication secret, the security information adding unit 62 performs security processing such as encryption and digital signature on the stream data 64 to generate data 65 with the security information added. To do. Then, the security information adding unit 62 passes the data 65 as stream data 47 to the TCP / IP stack 35 in the next stage and transmits it to the program of the destination computer. The security information adding unit 62 can be omitted.

[0149] <Processing content of combined part>

Next, the configuration of the coupling unit 60 in the encapsulation units 18 and 5355 shown in FIG. 13 will be described in detail with reference to FIG. FIG. 14 is a conceptual diagram illustrating the MAC frame combining process of the combining unit.

As shown in FIG. 14, the combining unit 60 combines the input virtual MAC frames with the second virtual MAC frame after the first virtual MAC frame and the third virtual frame after the second MAC frame. Like MAC frames, they are arranged in a straight line in the order of input or in an appropriate order, but not in the order of input, that is, they are connected in series.

[0150] Then, the length information (bit length) of the MAC frame is added before each MAC frame, where each virtual MAC frame is from where to where, and the total number of combined virtual MAC frames is In order to be able to detect how much it will be, the stream information described in FIG. 13 is added while adding length information and alternative delimiters to it. The combined stream 63 is output to the extension processing unit 61.

[0151] <Processing content of extended processing part>

Next, the configuration of the extension processing unit 61 in the encapsulation units 18, 53 to 55 shown in FIG. 13 will be described in detail with reference to FIG. FIG. 15 is a conceptual diagram illustrating the extension data adding process of the extension processing unit 61.

The input stream 63 can be subjected to 0 or one or more arbitrary number of extension processes.

For example, when a stream 63 containing data with a high compression rate is input, the expansion processing unit 61 outputs a data compressed using a data compression algorithm, etc. Short stream data 64 can be generated to increase efficiency. Here, when the user does not need it, the extension processing unit may use 0, that is, the input stream 61 as the output stream 64 as it is.

[0152] <Processing content of security information adding part>

Next, the configuration of the security information adding unit 62 in the encapsulation units 18 and 5355 shown in FIG. 13 will be described in detail with reference to FIG. FIG. 16 is a conceptual diagram illustrating the security information adding process of the security information adding unit 62.

First, a plurality of encryption algorithms and electronic signature algorithms are stored in a table, and a signature algorithm and an electronic signature algorithm selected in advance from the table by the user are used.

[0153] Then, in the security information card 62, the electronic signature unit 66 calculates the data of the electronic signature 68 for the contents of the input stream 64 by the selected electronic signature algorithm. Is added to the contents of the stream 64, and is output to the encryption unit 67.

Next, when the stream data to which the input electronic signature 68 is added is input, the encryption unit 67 encrypts the entire stream data with the selected encryption algorithm for the stream data, and Output as stream 47. At this time, the size of the stream data may change.

[0154] The stream 47 obtained in this way is a stream that includes both the content of the stream 64 and the content of the electronic signature 68 and, if necessary, other extension information.

In the above-described processing, depending on the type of the digital signature algorithm and the 喑 sign algorithm, the encryption unit 67 first performs the encryption algorithm processing, and then the electronic signature unit 66 uses the electronic signature algorithm. The processing may be performed in the reverse order as described above, in which an electronic signature is calculated and added.

In the VPN system of the present invention, as an example, a method compatible with SSL (Secure Socket Layer) is adopted as the security information-added card unit 62.

[0155] <Process of decapsulation unit>

Next, since the processes of the encapsulation units 18 and 5355 have been described, the process of the decapsulation units 19 and 48, which is the reverse process, will be described with reference to FIG. Figure 17 shows the above capsule. FIG. 6 is a block diagram showing an example of the configuration of the de-releasing units 19, 48.

The decapsulation units 19 and 48 have a disassembling unit 71, an extended processing removing unit 72 and a security information removing unit 73.

The decapsulation unit 19 or 48) converts the input stream data 45 into a virtual MAC frame in the reverse order of the encapsulation units 18 and 5355.

[0156] First, the security information removing unit 73 performs processing in the reverse order to the processing detailed in the processing content of the security information adding unit 62 in Fig. 16, and is input from the TCP / IP stack. The stream data 74 before encryption / electronic signature is restored from the stream data 45 added with the digital signature and output to the extended processing removal unit 72.

That is, the security information removing unit 73 outputs data 74 obtained by removing the security information from the stream data 45 and restoring the stream before the sign.

Next, when the data 74 is input, the extended processing removal unit 72 restores the data changed by each extended processing to the original data 75 and outputs it to the decomposition unit 71.

That is, the extended process removing unit 72 removes information from the extended process from the data 74 and outputs the restored data 75.

Finally, the disassembling unit 71 performs reverse processing to the combining unit 60 on the input data 75, and from the virtual MAC frames arranged in a straight line and the identification codes for separating them, each virtual MAC The frame 307 is extracted, and the extracted plurality of virtual MAC frames 307 are output as the capsule release unit 48.

The virtual MAC frame operating in the Virtual HUB used in the description of the method of virtual MAC frame exchange by the VPN system of the present invention shown in FIG. 8 and the processing of the encapsulation unit in the Virtual HUB shown in FIG. The explanation of the switching processing unit will be explained with reference to FIG. FIG. 18 is a conceptual diagram showing the operation of the switching process of the virtual MAC frame switching processing unit 49.

The virtual MAC frame switching processing unit 49 performs switching processing for each virtual MAC frame that is input and assigns it to an appropriate session by looking at the destination MAC address.

[0159] As a prerequisite for this switching process, multiple sessions are connected to the Virtual Hub. The transmission queue is prepared for each session.

One correspondence table (that is, correspondence table between virtual MAC address and SE session number) is managed.

Each row of this correspondence table describes the correspondence between the virtual MAC address and the session number, and it is also possible to describe extended information such as the date and time when each row was created or updated.

First, the virtual MAC frame switching processing unit 49 refers to the header of the input virtual MAC frame 307 and extracts the MAC address of the sender of the virtual MAC frame 307.

Next, the virtual MAC frame switching processing unit 49 detects whether or not a row including the MAC address exists in the correspondence table between the virtual MAC address and the session number and the virtual MAC frame switching processing unit When 49 detects that the searched MAC address does not exist, 49 newly adds the correspondence between the MAC address and the transmission source session number of the MAC frame to the correspondence table.

On the other hand, when the virtual MAC frame switching processing unit 49 detects that the corresponding MAC address exists, the virtual MAC frame switching processing unit 49 actually transmits the MAC frame in which the session number is recorded in the correspondence table. If the number of the session you tried is different, update the session number in that row of the correspondence table.

Next, the virtual MAC frame switching processing unit 49 extracts a destination MAC address in the virtual MAC frame.

[0162] Then, when the extracted destination MAC address does not correspond to the broadcast address in IEEE802.3, the virtual MAC frame switching processing unit 49 is a unique address, so the row corresponding to the MAC address is the virtual MAC address. And whether it exists in the correspondence table between and session number.

At this time, if there is a row corresponding to the MAC address, the virtual MAC frame switching processor 49 transmits the virtual MAC frame by reading the session number corresponding to the virtual MAC address from the correspondence table. Confirm the destination session number To do.

Next, when the session number is confirmed, the virtual MAC frame switching processing unit 49 adds a virtual MAC frame to the transmission queue corresponding to the confirmed session number.

Also, the virtual MAC frame switching processing unit 49 excludes the transmission source session when it detects that the destination MAC address does not exist in the correspondence table or when the destination MAC address is a broadcast address, because the session number cannot be determined. Packets are flooded to the transmission queue (50, 51, 52, ■) of all sessions. The processing described above is the processing of the virtual MAC frame switching processing unit 49. When the virtual MAC frame switching processing unit 49 detects a state in which one or more virtual MAC frames are accumulated in the transmission queue set for each SE session, the encapsulation unit 53 55 in the Virtual HUB transmits the packet. Is read and encapsulated.

[0164] <Problems with TCP / IP connection power>

Next, referring to Figure 19, when one TCP / IP connection is used for each SE session in sending and receiving encapsulated stream data between each Virtual Hub and virtual LAN card. The shortcomings of will be described. FIG. 19 is a conceptual diagram showing the configuration of the VPN system of the present invention using IP networks with different line speeds.

In the above description, when two virtual LAN cards transmit and receive virtual MAC frames via a remote Virtual Hub, for example, in the case of FIG. 19, the virtual LAN card 11 on the sender side is first virtual. Encapsulate the MAC frame into stream data and output it to the TCP / IP stack 15.

[0165] The TCP / IP stack 15 uses the TCPZIP connection corresponding to the SE session already established with the Virtual Hub 31, and the TCP / IP stack 15 sends the stream data to the computer where the Virtual Hub 31 is operating. Send.

The computer on which Virtual Hub 31 is operating receives the stream data from the IP network (high-speed line with a line speed of 100), decapsulates the stream data with TCP / IP stack 35, and creates a virtual MAC frame. Session to the virtual LAN card 11 corresponding to the destination MAC address by various processing of the Virtual Hub 31. Insert into send queue 50 corresponding to.

[0166] The above-described process is a process of transferring a virtual MAC frame from the virtual LAN card 11 to the virtual HUB 31 via the high-speed line IP network.

On the other hand, the Virtual Hub 31 encapsulates the virtual MAC frames accumulated in the internal transmission queue 50, converts them into stream data, and transmits them to the IP network using the TCPZIP stack 35.

Then, the TCPZIP stack 25 of the computer on which the destination virtual LAN card 21 is operating restores the stream data input via the IP network (low speed line with a line speed of 1) and outputs it to the virtual LAN card 21.

Thereby, the virtual LAN card 21 decapsulates the input stream data and takes out the virtual MAC frame.

It can be seen that the processing up to the above is the transfer processing of the virtual MAC frame from the virtual hub 31 to the virtual LAN card 21 via the low-speed line IP network.

The virtual LAN card 11 is transferred through a two-stage transfer process, the “Virtual MAC frame transfer process from Virtual Network Adapter 11 to Virtual Hub 31” and the “Virtual MAC frame transfer process from Virtual Hub 31 to Virtual Network Adapter 21”. The MAC frame transmitted by arriving at virtual LAN mode 21.

[0168] If this process is simply considered, the line speed of the communication line between the computer on which the virtual LAN card 11 is operating and the computer on which the virtual hub 31 is operating and the virtual hub 31 are operating. The line speed of the communication line between the computer and the computer on which the virtual LAN card 21 is operating is almost equal, or the data receiving side can communicate at high speed with the data sending side. If there is no problem, especially in communication. However, the computer and virtual LAN on which Virtual HUB31 operates can be determined by the line speed of the communication line between the computer on which Virtual LAN card 11 is operating and the computer on which Virtual HUB31 is operating. If the line speed of the communication line with the computer on which the card 21 is operating is lower, that is, if the data receiving side can only perform low-speed communication with the data sending side, Problems occur.

[0169] For example, if a computer running Virtual LAN Card 11 and Virtual HUB 31 are running, Communication line between the computer and the computer running Virtual HUB31 and the computer running Virtual LAN card 21 is set to 1 To do.

That is, the ratio of the transfer capability between the communication line K1 and the communication line K2 is 100: 1. In such an environment, the virtual LAN card 11 attempts to transmit a plurality of virtual MAC frames, for example, a total size of 100, to the virtual LAN card 21.

[0170] The line speed between the virtual LAN card 11 and the virtual hub 31 is 100, and the size of the stream data encapsulated by the virtual LAN card 11 is 100 (actually, it is slightly Since the increase force S and its influence can be ignored compared to the above line speed difference, for example, transmission processing of all virtual MAC frames to the Virtual Hub 31 is completed in a unit time.

Next, the Virtual Hub 31 obtains the TCP / IP connection of the communication session corresponding to the virtual LAN card 21 from the network and the transmission queue 50 in order from the computer running the virtual LAN card 21. Attempt to send stream data encapsulating MAC frames.

[0171] However, since the line speed between Virtual Hub 31 and Virtual LAN Force 21 is 1, communication is completed before the transmission of the virtual MAC frames accumulated in all transmission queues is completed. The communication line K2 takes 100 times as much time as the unit time of the line K1.

Therefore, the number of virtual MAC frames that can be transmitted in unit time on communication line 2 is only 1% of the total number of virtual MAC frames accumulated in transmission queue 50, which is 1 The remaining 99 virtual MAC frames are still in the transmission queue 50.

[0172] When the above-described state occurs, when the virtual MAC frame is encapsulated from the Virtual Hub 31 to the Virtual LAN card 21 and the transmission process is performed, the transmission queue 50 corresponding to the session of the Virtual LAN card 21 is stored in the transmission queue 50. In other words, the MAC frame size that enters within a certain time is significantly larger than the MAC frame size that exits within a certain time, that is, congestion occurs.

[0173] Usually, the operation method of the application program that attempts to perform the communication described in FIG. In the case of communication between programs via a physical communication line that does not involve a VPN, a line between the communication hardware and the destination communication hardware is transmitted to one of the programs for the communication hardware. If you try to send a packet that significantly exceeds the speed capability (throughput), the transmission capacity will be exceeded by the communication hardware, physical line, or packet switching equipment such as an IP router on the physical line or routing equipment. Packets are automatically discarded and ignored because they have not arrived.

[0174] Therefore, most existing communication protocols are designed on the assumption that packets sent to the physical layer may be discarded or altered before reaching the destination.

In the description of the data flow when communication is performed using the TCPZIP protocol in Figure 2, the role of the TCPZIP protocol stack is that multiple TCPZIP stacks are used to send stream data input to the TCP / IP stack on the source computer. The packet is sent to the network and sent to the network. The TCP / IP stack of the recipient's computer that receives it is restored to the original state before the IP packet arrived, and is first sent to the source computer. Attempt to restore the stream data input to the TCP / IP stack above.

[0175] In this case, if there is an accident on the communication line between the computers that send and receive data, or if an IP packet that exceeds the transfer capacity of the communication line is sent, some or all of the multiple IP packets The IP packet is discarded and may not reach the destination.

When the sending TCP / IP stack detects that such a situation has occurred, it resends to the destination computer the same IP packet that was sent again the last time it was thought to have not reached the other party.

[0176] This retransmission processing is repeated many times until transmission of all stream data passed to the transmission source TCPZIP stack is completed.

Therefore, if you send a data stream using the TCPZIP protocol,

As long as the TCP / IP connection is not interrupted, there is no possibility that some data will be lost or altered on the way, even if you try to send a large amount of stream data via a communication line with a slow line speed, The stream data will be received by the receiver in its complete state. [0177] As described in the comparison between the normal LAN shown in FIG. 6 and the virtual LAN in the VPN system of the present invention, a plurality of switching hubs using a normal physical IEEE802.3 are mainly used. In a network in which LAN cards exchange MAC frames, a LAN card transfers the processing capacity of the switching HUB and the communication lines (LAN cables, wireless transmission paths, etc.) that connect the switching HUB to each LAN mode. If you try to send a MAC frame that significantly exceeds its capabilities, some or all of the MAC frame will be discarded by the hardware.

[0178] Therefore, for example, one set of 100Mbps-compatible cables and LAN cards are connected to two types of switching hubs that support 100802_TX and 10Base_T. And a LAN card is connected.

An example of packet discard by hardware will be described with reference to FIG. Figure 20 is a conceptual diagram showing the connection relationship between LAN card 181 and LAN card 182 connected via a low-speed communication line (10 Mbps), switching HUB158, and high-speed communication line (100 Mbps). FIG.

[0179] The switching HUB 158 transmits a MAC frame to the LAN card 182 by LAN card 181 power OO Mbps connected at 100 Mbps.

In this transmission process, switching HUB 158 can receive packets with a throughput of 100 Mbps. Since the communication line speed to LAN card 182 is only 10 Mbps, packets are discarded electronically when the transfer capacity is exceeded, and 90 Mbps Packets will not arrive.

[0180] As shown in FIG. 19, the transmission of encapsulated stream data between the Virtual Hub 31 and the Virtual LAN Cards 11 and 21 is effective for each TCP / As explained by the shortcomings of using an IP connection, the communication speed and ratio of the communication line K1 used in the “virtual MAC frame transfer processing from the virtual LAN card 11 to the virtual hub 31” are compared. When the communication speed of the communication line K2 used for “Virtual MAC frame transfer processing from Virtual Hub 31 to Virtual LAN card 21” is extremely slow, the following phenomenon occurs. [0181] First, the Virtual HUB 31 has a transmission queue 50 to be transmitted to the virtual LAN card 21, and sequentially encapsulates the virtual MAC frames accumulated in the transmission queue 50 to send a TCP to the virtual LAN card 21. Attempt to transmit using / IP connection.

However, since the line speed of the communication line K2 is much slower than that of the communication line K1, the TCP / IP stack 35 can hardly complete the transmission of the encapsulated stream data.

[0182] As already mentioned, the TCPZIP protocol specification tries to transmit all stream data in order from the beginning, even if the line speed is low, without changing the contents or losing some of the data. In order to try, the data to be transmitted that has been accumulated in the transmission queue 50, sequentially encapsulated, and data streamed will be accumulated immediately before the TCPZIP stack 35.

[0183] Due to the specifications of the TCP / IP protocol, even if the transfer capacity of the communication line is exceeded, a part of the data stream to be transmitted is not automatically discarded. If this continues, congestion will worsen, and the virtual MAC frame that comes later will take longer to complete transmission, and eventually communication may become impossible.

Therefore, it is considered effective to limit the quantity at the stage of adding virtual MAC frames to the transmission queue 50 that can be controlled by the Virtual Hub 31.

[0184] <Congestion control in Virtual HUB transmission queue>

As a method to alleviate the above-mentioned congestion problem, a congestion control unit that performs congestion control in the Virtual HUB transmission queue shown in Fig. 21 may be provided. Has been verified to be significantly reduced. FIG. 21 is a conceptual diagram showing a configuration example of a Virtual HUB provided with the congestion control unit 300.

The above-described congestion is caused by the virtual MAC frame to be transmitted at the head portion of the transmission queue 50, the force to be transmitted by the S encapsulation unit 53, and the line speed of the communication line constituting the IP network to the destination computer is slow. Occurs when it takes time to complete the encapsulated stream data transmission by the TCP / IP stack.

[0185] That is, the essence of the congestion problem is that the encapsulated stream by the TCPZIP stack When a virtual MAC frame is added from the virtual MAC frame switching unit 49 to the transmission queue 50 at a higher speed than the transmission speed of the transmission data, the congestion occurs in the transmission queue 50, and the transmission queue Since the virtual MAC frame stored in 50 is preferentially taken out and encapsulated and transmitted, the virtual MAC frame that arrives later is the time between being put in the queue and transmitted. The time interval of this will become long.

[0186] Therefore, first, a state variable A is provided for each transmission queue 50. The initial value of this state variable A is A [0] = 0, the next value is A [l], the next is A [2], and so on, A [3], A [4], and so on. Next, the virtual MAC frame added to the transmission queue 50 from the virtual MAC frame switching unit 49 always passes through the congestion control unit 300, so that the virtual MAC frame passes through the algorithm in the congestion control unit 300. If it is permitted to pass, it is added to the transmission queue 50, and if it is rejected, the virtual MAC frame is discarded as if it was not received at first.

That is, the congestion control process performed in the congestion control unit 300 is calculated for each transmission queue for each of a plurality of virtual MAC frames input simultaneously from the virtual MAC frame switching processing unit 49. It is determined whether or not to add to the transmission queue based on the probability of frame addition, and the virtual MAC frame determined to be added is added to the transmission queue and the others are discarded.

It is appropriate to determine the frame addition probability according to the number of packets remaining in the transmission queue, and in order to prevent congestion, it is appropriate to decrease the addition probability as the number of remaining packets increases. Appropriate determination methods can be determined according to changes in traffic.

[0188] Here, the frame addition probability determination method that can be determined in advance by the user is determined in advance by the Virtual Hub program and cannot be changed by the user. It ’s good, and you can change it.

For example, it is verified that the efficiency of data transmission / reception is high when the following determination method based on state variable A, which has an initial value of 0 and is updated every unit time, is used. Note that A is defined for each transmission queue, but for ease of explanation, one transmission queue is used. Only one will be described.

(1) When no packets remain in the transmission queue

Let A be 0 and the frame addition probability be 1.

(2) When packets remain in the transmission queue

If A is 0, after updating A to 1, the frame addition probability is set to 0.5. If A is not 0, update A twice and set the frame addition probability to 2 (-A). In the above method, the frame addition probability decreases exponentially when the transmission queue remains.

[0189] The principle that congestion can be reduced by the above-described method is as follows. First, according to the specifications of the encapsulating unit (53 in the figure) described above, if virtual MAC frames are accumulated in the transmission queue, encapsulate them in the order of the head and transmit them through the TCP / IP connection. Try.

However, if the state of the TCP / IP connection is bad (physical line is congested, etc.), blocking may occur at the stage of transmission instruction for the TCP / IP connection. Because the data that we tried to send before that has not been sent yet. When the possibility of blocking is detected, that is, when the transmission of the previous data is not completed, the virtual MAC frame taken from the head of the queue is not deleted from the head of the queue but remains in the queue. Therefore, when a new packet is added to the queue, it can be detected that a state in which the transfer is not in time has occurred if the packet remains in the queue.

[0190] Next, whenever this "transfer is not in time" occurs, the number of times is added and recorded. When the transfer is in time, the recorded count is initialized to zero. If the rate of discarding packets is doubled, quadrupled, 8x, etc. for each number of times, when a large number of packets are to be queued, the probability that the packets will pass is 1 / 2, 1/4, 1/8, ... Therefore, the number of packets that pass through will decrease even if the sending power ^ and how many packets are sent. If the source stops sending packets, it will be encapsulated in order from the front of the queue and transmission will be completed, and the queue will be empty, so the variable will be reset to 0 at that stage. The By this principle Therefore, it is possible to reduce the occurrence of a situation where a frame exceeding the transmission capacity of the destination session is pushed into the queue, and to maintain the limit of the transfer capacity.

[0191] As a result of implementing the congestion control unit 300, the "defects in the case of one TCP / IP connection" in the VPN system of the present invention were alleviated.

That is, by providing the congestion control unit 300 in the Virtual Hub 31, one TCPZIP connection is used for transmission of the encapsulated stream data between the Virtual Hub 31 and the Virtual LAN cards 11 and 21 in FIG. Compared to the communication speed of the communication line K1 used for the “Virtual MAC frame transfer process from the virtual LAN card 11 to the Virtual HUB 31” in the configuration as described by the disadvantages of The following drawbacks that occur when the communication speed of the communication line K2 used for “Virtual MAC frame transfer processing to the LAN card 21” is extremely slow can be solved.

That is, the Virtual HUB 31 has a transmission queue 50 to be transmitted to the virtual LAN card 21, and sequentially encapsulates the virtual MAC frames stored in the transmission queue 50 to send TCP / IP to the virtual LAN card 21. When transmitting using the IP connection, the line speed of the communication line K2 is slower than that of the communication line K1, so the TCP / IP stack is unable to complete the transmission of the stream data that has been The data to be transmitted that are encapsulated in the transmission queue 50 and sequentially encapsulated into a data stream accumulates immediately before the TCP / IP stack.

[0193] Therefore, according to the TCP / IP specifications, even if the transfer capacity of the line is exceeded, a part of the data stream to be transmitted is not automatically discarded. If the situation continues, the congestion will worsen, and the virtual MAC frame that came later will take longer to complete transmission, and eventually it may become impossible to communicate was there.

[0194] As a result of implementing the congestion control unit 300, this disadvantage is that the transmission queue for each destination session (

50, 51, 52, ■■■) When a virtual MAC frame is about to be added from the virtual MAC frame switching processing unit 49 at a speed faster than the speed of the virtual MAC frame going out, try to add it. Discard each MAC frame at a certain rate, and adjust the rate according to how much virtual MAC frames to be transmitted remain in the current transmission queue. It is possible to reduce power S.

[0195] <Limiting the amount of packets per source session by increasing the state variable>

In contrast to the method of “congestion control in the transmission queue of the Virtual Hub” described above, the congestion control unit 300 connected to the transmission queue 50 adds frames based on the number of frames accumulated in the transmission queue. Probability was determined.

In this method, if a virtual LAN card corresponding to another SE session continuously sends a large number of virtual MAC frames to one SE session in the VPN, a large number of virtual MAC frames A large amount of virtual MAC frames accumulates in the transmission queue of the session that received the message, and the value of state variable A of the transmission queue of the SE session gradually increases due to the algorithm based on the TCP / IP protocol.

[0196] Therefore, the probability that a virtual MAC frame that is subsequently transmitted to the transmission queue of the SE session is added to the transmission queue becomes low.

In this state, the SE session power other than the SE session that sent a large amount of virtual MAC frames first \ The state variable A of the transmission queue becomes large. Even when trying to transmit, the congestion control unit 300 also decreases the frame addition probability as the value of the state variable A of the transmission queue increases.

[0197] This means that if an attack such as intentionally sending a large number of virtual MAC frames to a specific session is performed, the attack to the session automatically attacked by the congestion control unit of the Virtual Hub The amount of additional packets is limited, causing an attacked session to receive other session power packets.

In order to solve this problem, the fact that the frame addition probability was determined for each transmission queue in the above-mentioned “congestion control in the transmission queue of Virtual Hub” was expanded, and a frame was added for each transmission queue and each transmission source session. The probability will be determined.

When the extension is performed in this way, the above-described method for determining the frame addition probability is changed as follows.

[0198] The initial value is 0, and the state variable A [n] that is updated every unit time is the state variable from session n to the transmission queue. As described above, A [n] is determined for each transmission queue, but for the sake of simplicity, only one transmission queue will be described. (1) When no packet from session n remains in the transmission queue, A [n] is set to 0 and the frame addition probability is set to 1.

(2) When packets from session n remain in the send queue

If A [n] is 0, after updating A [n] to 1, the frame addition probability is set to 0.5.

If A [n] is not 0, A [n] is doubled and the frame addition probability is set to 2 (—A [n]).

In the above method, the frame addition probability decreases exponentially when the transmission queue remains.

[0199] By adjusting the frame addition probability determination method including the transmission source information in the transmission queue of each SE session by the above extension, packets for every pair from each SE session to other SE sessions. The number can be limited (adjustment of the probability of discarding packets).

As a result, if an attack such as intentionally sending a large number of virtual MAC frames to a specific session while performing dynamic adjustment of the transmission queue for each SE session, a virtual HUB The amount of packets that are automatically added to the attacked session by the congestion control unit 300 is limited, and the attacked SE session receives packets from other SE sessions. Only the packets from the attack source, that is, the source SE session, can be restricted, which can be resolved.

[0200] <Communication via proxy server>

In the VPN system according to the present invention, stream data in which a virtual MAC frame is encapsulated is transmitted / received via a TCP / IP connection.

In VPN using conventional protocols such as IPsec and GRE, the encapsulated data is flowing on the IP network as PPTP packets and L2TP packets.

[0201] However, in a VPN using a protocol such as IPsec or GRE, an environment in which IP packets cannot be directly sent and received between the VPN client and the VPN server (for example, a proxy that supports the HTTPS protocol on a company LAN, etc.) Must go through the server In such an environment where it is not possible to connect to the Internet, it is not possible to establish a logical connection between the VPN client and the VPN server, so these VPNs cannot be used for IJ.

[0202] On the other hand, in the VPN system of the present invention, when the Virtual Hub that is the VPN server operates as a TCP / IP server program, the Virtual LAN card that is the VPN client is TC, and the Virtual LAN card is connected to the Virtual HUB. By using the CONNECT method in the HTTPS proxy server and the connection request signal in the SOCKS server for the proxy server corresponding to the HTTPS protocol and the proxy server corresponding to the SOCKS version 4 protocol ( The details are left to each protocol specification.) Through a proxy server that supports HTTPS protocol and a proxy server that supports SOCKS protocol, the virtual LAN card can connect to a server computer running Virtual HUB via VPN.

[0203] The communication via the proxy server will be described with reference to FIG. FIG. 22 is a conceptual diagram showing a configuration example of the VPN system of the present invention.

The virtual LAN card 11 of the VPN client computer 10 is connected to the virtual HUB 31 on the VPN server computer 30 via the proxy server 301.

That is, one TCP / IP connection is established between the virtual LAN card 11 and the proxy server 301, and one TCP / IP connection is established between the proxy server 301 and the virtual hub 31.

[0204] For this reason, the virtual LAN card 11 of the VPN client computer 10 establishes a TCP / IP connection to the Virtual Hub 31 on the VPN server computer 30 and sends / receives the encapsulated data stream. Absent.

However, the proxy server 301 sends the data stream received from one TCPZIP connection as it is to the other TCP / IP connection.

[0205] Therefore, the virtual LAN card 11 of the VPN client computer 10 establishes a TCP / IP connection directly with the Virtual HUB 31 on the VPN server computer 30 and performs communication similar to that performed by the SE protocol. Is done. In the configuration example of FIG. 22, an application program 12 that performs network communication that operates on the VPN client computer 10 and an application prod- ucer that performs network communication that operates on the VPN client computer 20. You can communicate freely through the Virtual Hub 31 running on the VPN server computer 30.

[0206] The maximum advantage of using the VPN system of the present invention in the communication configured through the proxy server shown in Fig. 22 will be described below.

Normally, it is an environment that cannot connect to a host (such as a server that provides each service) on an external IP network (such as the Internet) unless a proxy server is used in the company LAN, etc. The application program that you want to use by communicating between the above computer and the computer on the external IP network S, if the proxy server installed in the company LAN is not supported, the application program has been improved Rewrite to enable communication via a proxy server (such as an HTTPS server or a SOCKS server) installed on the corporate LAN. Even if the internal LAN configuration is changed and the proxy server is not used, the external IP It was necessary to take measures such as enabling communication with hosts on the network.

[0207] In the above situation, when the virtual LAN card and the Virtual Hub support communication via a proxy server installed in the company by using the VPN system of the present invention, There is no need to change the internal network configuration or improve and rewrite the application program that you want to use. 通信 Use the SE protocol to communicate any application program that you want to use for IJ. Therefore, by encapsulating and transmitting to the Virtual HUB, there is an advantage that arbitrary communication can be performed with a similar application program in another computer connected to the same Virtual HUB. can get.

[0208] <Advantages of bridge connection>

Generally, by using an existing program called “MAC bridge” or simply “bridge”, two or more LAN cards existing in the same computer can be made into one segment (broadcast domain) . The VPN system of the present invention having a bridge connection configuration will be described with reference to FIG. FIG. 23 is a conceptual diagram showing a configuration example of the VPN system of the present invention having a bridge connection. As described above, the virtual LAN card 11 is recognized as one LAN card by the operating system.

[0209] Therefore, by using an existing bridge program, it is possible to configure a bridge connection between the physical LAN card driver 302 and the virtual LAN card 11, and the virtual LAN card 11 side is connected. The same segment (broadcast domain) is configured between the existing IEEE802.3 network, that is, the VPN centering on Virtual Hub 31 and the physical switching hub 158 to which the physical LAN card driver 302 is connected. Will be.

[0210] As a result, as shown in Figure 23, it is not connected directly to the corporate LAN via a bridge connection, but is connected to the virtual LAN card power virtual hub 31 of another PC 305 at a remote location via the IP network. If so, the PC 305 is indirectly connected to the same segment as the physical switching HUB158.

Therefore, for example, any MAC frame can be transmitted and received between the PC 305 and another PC 303 (or 304) on the in-house LAN.

[0211] In this case, setting work for installing the VPN software of the VPN system of the present invention or operating the virtual LAN card is not required on the other PC 303 (or 304) on the in-house LAN.

This advantage is achieved by enlarging Layer 2 encapsulation, which was impossible with VPN that encapsulated very large conventional Layer 3 networks. Can do.

[0212] <Reconnect function>

Sessions between virtual and LAN networks and virtual and HUBs may have an identification code called a session ID.

This session ID is known only to both the virtual LAN card and the Virtual Hub (one is determined using a random number during handshaking and notified to the other). Even when the TCP / IP connection that controls session communication between the virtual LAN card and the Virtual Hub is disconnected, the logical session remains for a certain period of time set by the user (or fixed by the program). It has been continued.

[0213] Then, when the virtual LAN card detects that the connection with the Virtual Hub has been disconnected, it establishes a TCP / IP connection with the Virtual Hub again and communicates as before in the handshake processing. The session ID is communicated to the Virtual Hub.

As a result, the Virtual HUB searches for the presence of a session corresponding to the session ID for the pending session strength, and if a corresponding session ID is detected, the Virtual HUB can reconnect to the session. This reconnection function is installed in the VPN system of the present invention.

[0214] Also, after the TCPZIP connection is disconnected, until the reconnection is completed by the reconnection function, if the TCP / IP connection is not disconnected, the stream data that can be transmitted is queued. When the reconnection is completed, the stream data kept waiting in the queue can be sent to the other party at once.

[0215] As a result, the protocol stack application program operating at a higher level than the virtual LAN card does not respond to the fact that the line between the LAN card and the HUB was originally disconnected. Since the power is recognized as if it was not disconnected, there is an effect that the disconnection of communication in the upper layer can be suppressed even on the poor quality IP network where the TCP / IP session is disconnected.

[0216] Support for multiple TCP / IP connections>

As explained in the virtual MAC frame exchange method using the VPN system of the present invention shown in FIG. 8, the logical session indicating the communication between the virtual LAN card and the virtual HUB is one TCP / IP. It was established by a connection, and one TCP / IP connection was supported for one session.

By the way, in broadband Internet connection,

1. Relatively high throughput

2. Application program via IP network with relatively long delay time Transfer any data

In this case, two or more multiple applications, not one, between application programs (specifically, between a TCP / IP server program and a TCP / IP client program)

It is better to establish a TCP / IP connection, divide and send arbitrary data to be transmitted by an algorithm agreed in advance, and combine the divided and transmitted data at the receiving side. Faster than when using a TCP / IP connection

It is known that the transfer is completed (in a short time).

[0217] Therefore, in communication by the VPN system of the present invention, the point that the encapsulated stream data was transmitted by one TCP / IP connection for one SE session was improved. Immediately before transmission of the stream data flowing through the SE session with the TCP / IP stack, it may be possible to divide the data into a uniform size by some algorithm and establish multiple TCP / IP connections for transmission.

[0218] However, in the communication of the VPN system of the present invention, the data flowing over the TCP / IP connection is capable of determining the start point because the end point is up to the end of the VPN communication. It is unknown, and due to the characteristics of VPN, it is necessary to send packets that have been encapsulated at an early time and converted into stream data as soon as possible by the encapsulation unit on the transmission side.

For this reason, the conventional method of simply increasing the communication speed by simply using multiple TCP / IP connections cannot be applied.

[0219] With reference to FIG. 24, a method of establishing and transmitting a plurality of TCP / IP connections for one SE session in the VPN system of the present invention will be described. FIG. 24 is a conceptual diagram of a configuration in which a plurality of TCP / IP connections are established and transmitted / received for one SE session in the VPN system of the present invention.

The correspondence to multiple TCP / IP connections is explained using Fig. 24 (b). In Fig. 24 (b), in order to establish a plurality of TCP / IP connections between the virtual LAN card and the Virtual HUB and use these TCP / IP connections well, For each SE session, the same number of TCP / IP connections as the encapsulation units 181 to 183 are established.

One TCP / IP connection for one SE session as described above in Figure 24 (a) In the configuration for establishing the network, when the encapsulating unit 18 is passed a plurality of virtual MAC frames, the encapsulating unit 18 encapsulates it and outputs the stream data to the TCP / IP stack 13.

[0220] Then, the TCP / IP stack 13 divides the packet into IP packets corresponding to one TCP / IP connection, and transmits the packet via the IP network 119.

Next, the TCP / IP stack 35 of the remote computer receives the transmitted IP packet, restores the IP packet to stream data, and outputs it to the capsule release unit 48. The decapsulation unit 48 extracts the virtual MAC frame from this stream data.

On the other hand, in the configuration shown in FIG. 24 (b), when the virtual MAC frame is transmitted, the virtual MAC frame is input to the connection selection unit 310 before being input to the encapsulation units 181 to 183. The

That is, the connection selection unit 310 is provided as a stage immediately before the capsule unit.

The connection selection unit 310 distributes a plurality of input virtual MAC frames to each of the encapsulation units 181 to 183 prepared in the same number as the number of established TCP / IP connections based on a predetermined algorithm. Take control.

[0222] Specifically, as shown in FIG. 24 (b), the connection selection unit 310 receives the input virtual

The MAC frame is distributed to the encapsulation unit 181, the encapsulation unit 182, and the encapsulation unit 183.

Each of the encapsulating unit 181, the encapsulating unit 182, and the encapsulating unit 183 has one TCP / IP connection corresponding thereto.

As a process for allocating virtual MAC frames, the connection selection unit 310 selects which encapsulation unit each virtual MAC frame is assigned to, and outputs the virtual MAC frame as it is based on the selection result. Do not do any processing such as editing the contents of the virtual MAC frame.

[0223] Each of the encapsulation units 181 to 183 outputs a plurality of virtual MAC frames to which the encapsulation unit 181 to 183 is input via the TCP / IP stack 13 to the corresponding TCP / IP connection. To help.

As a result, the TCP / IP stack 13 transmits the virtual MAC frame to the virtual LAN card of the receiver computer connected via the IP network 119. Then, the TCP / IP stack 35, in the order opposite to the above transmission processing by the computer that transmitted, the stream data encapsulated by the plurality of decapsulation units 481, 482, 483 corresponding to the TCP / IP connection. Decapsulation is performed, a plurality of virtual MAC frames are extracted, and the virtual MAC frames are output to the connection coupling unit 490.

[0224] The connection coupling unit 490 rearranges the received virtual MAC frames in the order of the received time series, and outputs the received virtual MAC frames to the process for performing the next processing.

Here, the specific algorithm in the connection selection unit 490 can be replaced, but it is considered that the encapsulation unit that outputs the virtual MAC frame should be selected by the following method.

[0225] An algorithm in which the connection selection unit 490 allocates the virtual MAC frame to any one of the encapsulation units 181 to 183 will be described.

(1) Each of the encapsulation units 181 to 183 has a state variable Q for managing the quality state of the corresponding TCP / IP connection. Here, the initial value of Q is “0”, and the larger the value of Q, the worse the quality.

[0226] (2) When a new virtual MAC frame is input, the connection selection unit 310 selects the one with the smallest value of the state variable Q from all the capsule units (181 to 183), Instructs the selected encapsulation unit to transmit the MAC frame. In addition, the connection selection unit 310 selects the one with the lowest value of the state variable Q from the plurality of capsule units (181 to 183). A capsule part with state variable Q is selected according to a rule set by the user at random. Further, the connection selection unit 310 can receive a plurality of virtual MAC frames at the same time as the previous process power, and can instantly perform these processes for each virtual MAC frame without blocking. This is encapsulated by the connection selector 310 This is because the process of distributing the frame to the part is a process in the memory of the computer. (Because communication is not involved, there is no blocking)

(3) Encapsulation units 181 to 183 encapsulate virtual MAC frames (which may be received at the same time) input from connection selection unit 310, and hold them as stream data on a first-come-first-served basis. At this time, the capsule units 181 to 183 perform stream data combining processing by adding the stream data generated later to the end of the stream data generated immediately before.

[0228] (4) Capsule section 181—183 attempts to transmit the currently held stream data in order from the top using a TCP / IP connection. In other words, when the capsule unit is notified from the TCP / IP stack 13 that the network line has enough space and the next data can be transferred, the capsule data unit passes the stream data to the TCP / IP stack 13 to instruct transmission. .

(5) The TCP / IP stack 13 attempts to transmit the stream data input from the encapsulation unit to the IP network. When the transmission process is completed, the TCP / IP stack 13 notifies the encapsulation unit corresponding to the transmitted stream data of the completion of the transmission process. In addition, the TCP / IP stack 13 may indicate that if the network speed is slow or the quality is poor, or if the stream data to be transmitted is too large, the transmission of the part of the stream data up to The transmission information indicating that the data has not been transmitted is notified to the encapsulation unit corresponding to the stream data. This notification is sent each time the encapsulation is sent to the TCP / IP stack, and the following information is known.

• Sending up to 50 bytes was instructed to send 100 bytes. I have not sent the rest. • 80 bytes out of 80 bytes have been sent.

• One byte could not be sent (due to line congestion).

[0230] (6) Capsule (181, 182, 183) receives the notification from TCP / IP Stack 13 in response to (5) and transfers the data to TCP / IP Stack 13. When all of the above are completed and the TCP / IP stack 13 detects that the next data transfer can be instructed at any time, the state variable Q is initialized to “0”. On the other hand, capsule capsule (181, 182, 1 83) adds n to the state variable Q when it receives from the TCP / IP stack 13 transmission information indicating that the instructed data transfer has not yet been completed. Here, n is a variable, and may be fixed to 1. Also, even if it is passed to the TCP / IP stack 13, the transmission is completed and the value is proportional to the total amount of data. It ’s good.

That is, the virtual LAN card 11 provides a plurality of TCP / IP connections for one SE session established with the virtual hub 31 and a plurality of TCP / IP connections provided for this SE session. In, the status variable indicating the quality status of each TCP / IP connection is detected, and the MAC frame is output to the TCP / IP connection in the best quality status.

With the algorithm described above, an SE session can be configured with multiple TCP / IP connections, and the encapsulated stream data that should flow through the SE session is as efficient as possible for each TCP / IP connection. Will be transmitted evenly. As a result, the total throughput in the SE session is improved compared to the method in which one TCP / IP connection is supported for the SE session.

[0232] The distribution process in the connection selection unit 310 needs to be placed immediately before the encapsulation unit.

Similarly, the process of combining received data distributed by the connection combining unit 310 needs to be placed immediately after the capsule release unit on the receiving side.

In a VPN communication in which a virtual MAC frame is streamed using a TCP / IP connection like the VPN system of the present invention, and this stream data is encapsulated to transmit data, it is a parallel 1J TCP / IP connection. The idea of speeding up the use of is simply distributing the TCP / IP connection, which was originally only between the virtual LAN network and the Virtual Hub, and the data in the connection. It cannot be thought of in combination with a program that performs processing.

[0233] This is because there is a program that simply distributes multiple data to be transmitted via TCP / IP connections to multiple connections, and combines the data received later on the receiver side. Is applied to a "TCP over TCP" VPN such as the VPN system of the present invention, and if the quality (time to packet arrival, throughput, etc.) differs for each TCP connection, multiple virtual MAC frame The separation between each other cannot be determined by just looking at the stream after it has been encapsulated into stream data.

[0234] For this reason, the encapsulated part of one virtual MAC frame (that is, the IP packet into which one stream data is divided) is actually transmitted after being divided into multiple TCP / IP connections. Can happen.

The receiving side receives IP packets from multiple TCP / IP connections divided by the transmitting side and simply combines the IP packets to restore the original stream data. When data arrival in one line is delayed

The original stream data cannot be restored until the data arrives.

[0235] On the other hand, in the method shown in FIG. 24, that is, in the method of installing the connection selection unit 310 immediately before the capsule part, even in the case described above, it is possible to release the decapsulation from the data force that has arrived first-come Yes (because the data flowing in each TCP / IP connection is independent and can be unencapsulated alone).

Therefore, in comparison with the method shown in FIG. 24, in the method in which one TCP / IP connection after encapsulation is simply divided into multiple connections and the receivers combine, the virtual MAC frame physically arrives. There is a disadvantage that the time until decapsulation is delayed.

[0236] Therefore, in both the virtual LAN card and the virtual hub, the connection selection unit 310 is installed immediately before the encapsulation unit, and the TCP that transmits the virtual MAC frame by the quality state variable Q managed by each capsule unit is transmitted. The method of selecting an / IP connection has an effect that cannot be realized with a normal combination.

[0237] In addition, as another effect of the method of FIG. 24, when the VPN system of the present invention that can divide one session into a plurality of TCP / IP connections is used, any existing arbitrary communication is possible. In the communication of an application program, even if the communication application does not support data transfer using multiple TCP / IP connections, the data to be transmitted by the communication application program is encapsulated in accordance with the SE protocol. It will be divided into / IP connections and sent.

For this reason, by using the VPN system of the present invention, all existing arbitrary communication keywords are used. In the communication of a prescription program, benefits such as improved communication speed and stable communication in parallel IJTCP / IP connection communication can be automatically received without rewriting each application program.

[0238] <Normal NAT operation>

In the VPN system of the present invention, a remote access system can be configured by combining a virtual LAN card and NAT (Network Address Translation).

The power to explain the system using this virtual LAN card and NAT Before that, for comparison with the case of using a conventional physical LAN card, we will briefly explain NAT. The operation of NAT will be described with reference to FIG. FIG. 25 is a conceptual diagram of the configuration of a computer on which NAT is implemented to explain the operation of NAT.

[0239] In a normal NAT operation, a brief description of the operation related to the address translation technology currently used generally called NAT (NAPT) will be given.

NAT technology is a general technology, and its basic specifications are defined in RFC 2663, so here are the details.

In Figure 25, TCP / IP client program (port number 1234) on computer A (IP address 192 · 168.0.2) on IP network 192.168.0.0/24 inside NAT NAT IP network outside NAT 192 · Computer B on 168.10.0 / 24 (IP address

This shows a state where a TCP / IP connection is established with the TCP / IP server program (port number 80) on 192.168.10.1) and data is being sent and received.

[0240] Computer F that becomes NAT is 192 · 168.0.1 as NAT inside, and as outside

Two IP addresses 192.168.10.10 are set.

Next, computer A (IP address 192.168.0.2/TCP port number 1234) communicates with computer B (IP address 192.168.10.1/TCP port number 80) via physical HUB320 and NAT (computer F). Then, the TCP packet is transmitted from the physical LAN card 323. Then, the NAT program in the computer F inputs the TCP packet via the LAN card 321 and rewrites the IP address of the TCP packet.

Here, the address rewriting unit 322 in the NAT program In case of either TCP / IP packet or UDP / IP packet, rewrite two sets of port number and IP address in TCP header or UDP header and IP header, but other operations such as TCP packet No reconfiguration is performed.

[0241] Then, the TCP / IP packet is sent from the address rewriting unit 322 by the source.

It is rewritten to 192.168.10.10 and port number 5678 and reaches destination computer B via physical HUB324.

The reverse TCP / IP packet flow is the opposite of the above process.

The use of NAT in Figure 25 shows that two physical LAN cards are installed on computer F, which is one NAT, and one is outside NAT (for example, the external Internet side) and the other is on the other side. It is inside NAT (for example, in-house LAN side).

[0242] Remote access using virtual LAN card and NAT>

Next, remote access using a virtual LAN card and NAT in the VPN system of the present invention will be described with reference to FIG. FIG. 26 is a conceptual diagram showing a system configuration of remote access using a virtual LAN card and NAT.

The power of using physical LAN cards inside and outside NAT in Fig. 25 In the system shown in Fig. 26, the inside of NAT is configured as a virtual LAN card. As already mentioned, a virtual LAN card is logically identical to a physical LAN card from the viewpoint of the operating system, so it can be replaced with a physical LAN card.

[0243] The configuration of remote access using a virtual LAN card and NAT shown in Figure 26 is virtual.

By using a LAN card and NAT, the VPN configured by the VPN system of the present invention is used for remote access.

In Fig. 26, the system connection status is as follows: a computer with a virtual LAN card installed on the Internet and a virtual hub 3 installed on the Internet that is logically connected at the same time. The virtual LAN card 11 operating in the computer F that will be the NAT for remote access is logically connected to the virtual hub 31 (SE session is established). [0244] The communication path for the encapsulated (VPN) TCP / IP connection established between Virtual LAN Card 11 and Virtual HUB 31 is the network that is connected to LAN Card 323. Forces constituted by means passing through or other means, etc. Since they are constituted by conventional means, and have already been described, description thereof will be omitted.

Here, as shown in FIG. 25 and FIG. 26, the NAT program operates in the same manner in the central computer.

The difference is that the physical LAN card 321 in FIG. 25 is replaced with the virtual LAN card 11 in FIG.

From the point of view of the NAT program, all are recognized as LAN cards, so there is no particular difference in processing.

In the configuration of FIG. 26, the virtual LAN card 11 is connected to the virtual HUB 31, and the virtual LAN card of the computer 10 is also connected to the same virtual HUB 31. Here, the IP address of the virtual LAN card of the computer 10 is 192.168.0.2.

In addition, Figure 26 shows the TCP / IP client program (port number 1234) on this computer 10 (IP address 192.168.0.2) and computer B (IP address 192) on the IP network 192.168.10.0/24 outside NAT. · 168 · 10.1) This indicates a state in which a TCP / IP connection is established with the TCP / IP server program (port number 80) to establish communication.

[0246] Computer F that becomes NAT is 192.168.0.1 as inside NAT and outside as NAT

Two IP addresses 192.168.10.10 are set.

A TCP packet is sent from computer 10's virtual LAN card (IP address 192.168.0.2/TCP port number 1234) to computer B (IP address 192.168.10.1/TCP port number 80).

[0247] This sent TCP packet is IP address rewritten by the NAT program of computer F.

Here, when the input packet is either a TCP / IP packet or a UDP / IP packet, the address rewriting unit 322 in the NAT program sets the port number and IP address in the TCP header or UDP header and IP header. Perform two sets of rewriting. [0248] Here, the address rewriting unit 322 rewrites the IP address of the TCP / IP packet with the source as 192.168.10.10 and the port number 5678.

The TCP / IP packet with the rewritten IP address and port number arrives at the destination computer B. In the reverse direction, that is, the transmission of the TCP / IP packet from the computer B to the computer 10, the processing opposite to that described above is performed.

In the case of UDP / IP packets, almost the same control is performed. Refer to RFC2663 for details.

[0249] By connecting both the physical LAN card and the virtual LAN card to the NAT program by using the method described above, connect the physical LAN card and the virtual LAN card to the NAT program. The computer 10 that is connected to the virtual LAN card 11 can access the external Virtual Hub 31 and set the IP gateway for the IP address of the virtual LAN card of the computer F that is NAT. The private network such as the corporate LAN to which the computer F belongs can be accessed from the outside.

[0250] In this case, the virtual MAC frame flowing between the Virtual Hub and each virtual LAN card is encapsulated by each encapsulating unit, and if encryption is performed when encapsulating, this It is safe to pass virtual MAC frames over dangerous networks such as the Internet.

Therefore, by combining a virtual LAN card and a NAT program, secure remote access to an in-house LAN using VPN is possible.

This method is different from the conventional layer 3 encapsulation technology in the VPN system of the present invention, in which the MAC frame in layer 2 is encapsulated and the LAN card is emulated by the virtual LAN card program. This is what makes it possible.

[0251] <User mode NAT program>

In the method described in FIG. 26, the following two conditions (1) and (2) are required to operate NAT on a specific remote access computer and use it for remote access. (1) A virtual LAN card program corresponding to the operating system of the remote access computer must be installed, and a NAT program corresponding to the operating system must be installed.

(2) The operating system on the remote access computer must have kernel mode privileges.

[0252] The reason why the conditions (1) and (2) are necessary will be described below.

First, in (1), the NAT program power of the remote access computer works correctly in the applications described in the section “Remote access using a virtual LAN card and NAT”. It must be implemented as a program that corresponds to the operating system used.

It is also necessary to implement a NAT program that is compatible with the operating system used by the remote access computer.

[0253] However, there are a number of target systems that are not currently available for both virtual LAN cards and NAT programs.

For example, the virtual LAN card program is compatible with Windows 2000 (registered trademark) or later. It does not support Windows 98 (registered trademark), and other UNIX (registered trademark) operating systems are also supported. Unpublished.

In addition, the NAT program comes standard with an implementation that can be used as a NAT if it is a Windows (registered trademark) server-based operating system such as Windows 2000 (registered trademark) or Server 2003 (registered trademark).

[0254] However, the normal version of Windows 98 (registered trademark), Windows 2000 (registered trademark),

Versions such as Windows XP (registered trademark) do not provide NAT program implementations that meet the NAT requirements (sometimes included in third-party gateway programs).

Other UNIX (registered trademark) operating systems do not have a corresponding NAT program.

In this way, the reason why it takes time to complete the implementation of virtual LAN cards and NAT programs that support various operating systems is the reason for both virtual LAN cards and NAT programs. This is because it is a program that operates in a privileged mode on the computer system called kernel mode.

[0255] Because the kernel mode specifications vary greatly from one operating system to another, a kernel mode program written on one system must run on another system without significant rework.

This is because the specification of programming interface in kernel mode is not uniform for each system.

Compared to the kernel mode described above, the programming interface specifications in the user mode are unified to some extent for each system.

Therefore, porting a user mode program to another system is much easier than porting a kernel mode program.

[0256] Next, the reason for the condition (2) will be described.

For both NAT programs and virtual LAN cards, ordinary operating systems allow direct access to general user mode programs.

In other words, access to an important part called a device driver is required to access the NAT program and virtual LAN card (same for physical LAN cards).

Therefore, in order to install a virtual LAN card or NAT program, you must have system authority to access the kernel mode of the system, execute the program, and change settings.

[0257] Next, defects in the conditions in (1) and (2) will be described.

For (1), the system (operating system) power of the computer you want to use as a remote access computer is installed in either the virtual LAN card or NAT program. It is necessary to give up using it.

[0258] Regarding (2), since both the virtual LAN card and the NAT program must operate in kernel mode, there is a problem or vulnerability in either the virtual LAN card or the NAT program. If they are The stability and security of the access computer, such as the operation of the access computer being stopped, illegal processing, or in some cases, a malicious person attacking the vulnerability from the outside and executing arbitrary code on the computer. It becomes a serious problem in securing.

Therefore, if possible, a system administrator who wants to avoid running both virtual LAN cards and NAT programs in kernel mode on remote access computers that are likely to run unattended for a long time. Yes.

[0259] However, if only conventional techniques are combined, a program that performs NAT must be implemented in kernel mode, and NAT cannot be created as a user mode program. .

The reason for this is that the NAT program needs to access the device driver of the LAN card that is currently connected to the computer (to rewrite the contents of the TCP or UDP packet). This is because the mode program must exercise unauthorized system privileges.

[0260] Therefore, the VPN system of the present invention includes the function of the user mode NAT program used in the user mode.

This user-mode NAT program greatly expands the operation of the conventional NAT program, combines several processes for each TCP / IP packet, and can be integrated with the VPN technology of the VPN system of the present invention. It has been done.

As a result, in the VPN system of the present invention, the NAT program that conventionally required the kernel mode can be realized in the user mode if there are certain restrictions.

[0261] The user mode NAT program of the present invention will be described in detail below.

First, all user mode NAT programs will run in user mode.

In a normal system, two types of programs, kernel mode and user mode, are operating.

However, it is an object of the present invention that the user does not need to use a program that needs to run in the kernel mode of the system, and does not use a user in the user mode. By performing processing as a normal application that is permitted for one mode, it is possible to perform the same operation as a NAT program (running in kernel mode).

[0262] A user mode NAT program according to the present invention will be described with reference to FIG. Figure

FIG. 27 is a conceptual diagram showing a system configuration for explaining the configuration and operation of the user NAT program in the embodiment of the present invention.

The user mode NAT program 500 in FIG. 27 has two interfaces for communication with an external network.

Communication using TCP / IP stack 530 as one (first) interface, and communication using TCP / IP stack 570 as the other (second) interface.

[0263] Normally, in most operating systems currently in use, user-mode programs cannot directly access LAN card drivers and rewrite the packet data sent and received.

However, in most operating systems, limited communication with external hosts using the TCP / IP stack provided by the operating system (usually called socket communication) is permitted. The

[0264] Here, the computer on which the user mode NAT program 500 is operating, that is, the computer D used for remote access, is connected to the Internet via the existing network I / F 540.

This user mode NAT program 500 is always logically connected to a Virtual Hub 550 installed on another PC (such as on the Internet) (that is, an SE session is established).

[0265] Although it is a virtual LAN card that can establish an SE session for Virtual HUB550, it is necessary to perform processing only in user mode this time. It is assumed that the virtual LAN card cannot be installed and operated.

Therefore, it is the same as the encapsulation / decapsulation unit used in the virtual LAN card. Functions for encapsulating / decapsulating virtual MAC frames (for example, the capsule unit 508 and decapsulation unit 504 configured by a program or hardware) are provided in the user mode NAT. ing.

In FIG. 27, it is assumed that Virtual Hub 550 (the same configuration as Virtual Hub 31 described so far) is connected to Virtual LAN card 560 on another computer via the Internet or the like.

User mode NAT500-operated computer, that is, the computer D used for remote access, is connected to the corporate LAN via the existing network I / F580 (connected to the Internet via the corporate LAN. In existing networks, existing network I / F540 and existing network I / F580 may be the same). That is, the user mode NAT 500, TCP / IP stack 530, network I / F 540, TCP / IP stack 570, and network I / F 580 are mounted on the computer D.

Between the network I / F 540 and virtual / HUB550, and between the network I / F 580 and computer E, there are networks such as the Internet and corporate LAN.

[0267] Here, the TCP / IP client program 560 running on a computer connected to the Virtual Hub 550 on the Internet is connected to the existing network I / F580. The following describes the state in which a TCP / IP connection is established and communicated with the TCP / IP server program 590 running on the computer E (another PC (E)) connected to the same corporate LAN.

In relation to the TCP / IP client program 560 and the server program 690, the original TCP / IP server program 590 is on the corporate LAN and on the Internet.

The TCP / IP client program 560 should not be accessible. However, the TCP / IP client program 560 can be accessed because the user mode NAT program 500 serves as a NAT.

That is, in the user mode NAT program 500, it is the encapsulation unit 508 and the decapsulation unit 504 that maintain the virtual and HUB550 SE sessions. The user mode NAT program 500 is set in advance by the user. VPN system of the present invention One virtual MAC address and one virtual IP address that can only be used in the system are set.

The TCP / IP client program 560 on another PC running the virtual LAN card tries to perform TCP / IP communication using the virtual IP address set in the user mode NAT program 500 as a gateway. (Ie try to send data).

[0269] As a result, the encapsulated stream data is transmitted from the virtual LAN mode of the PC on which the TCP / IP client program 560 is installed.

Then, the Virtual HUB 550 performs a switching process of the IP packet sent from the TCP / IP client program 560 input via the SE session, and transfers it to the computer D on which the user mode NAT program 500 is operating.

This IP packet then arrives at computer D and is received by the operating system via the existing network I / F 540 and TCP / IP stack 530.

Then, the user mode NAT program 500 receives the virtual MAC frame output from the TCP / IP stack 530.

The user mode NAT program 500 is set with a virtual MAC address and a virtual IP address used for transfer in the VPN system of the present invention. When an ARP (Address Resolution Protocol) request is issued, the ARP response is returned based on the specifications of the ARP packet.

[0271] Stream data encapsulating multiple virtual MAC frames sent by TCP / IP client program 560 on another PC running a virtual LAN card is switching-controlled by Virtual HUB550, and user mode NAT program 500 The decapsulation unit 504 in FIG.

The stream data received by the decapsulation release unit 504 is expanded into a plurality of virtual MAC frames 604 by the decapsulation unit 504.

Next, the IP header analysis unit 503 refers to the input virtual MAC frame, and reads the information of the IP header when the transmitted packet (virtual MAC frame) is an IP packet. On the other hand, if the IP header protocol number is 503 (TCP), The packet is detected as a TCP packet and output to the TCP header analysis unit 502.

[0272] Then, the TCP header analysis unit 502 refers to the TCP header, extracts the information stored in the TCP header, and combines the information extracted by the IP header analysis unit 503 with the source IP address, A logical TCP / IP connection is identified by a set of four types: source port number, destination IP address, and destination IP address.

In the user mode NAT program 500, a list of logical TCP / IP connections identified for each set of these four types of information is maintained. For each logical connection, the transmission data queue 510 and One receive data queue 509 is held in the program.

Then, the TCP / IP header analysis unit 502 extracts the payload (text) of the received TCP packet 605 and outputs it to the data combining unit 501 as data 606.

[0273] Next, the data combining unit 501 receives the divided data 606 (payload (text) of the received TCP packet 605) input from the TCP header analysis unit 502 as the sequence number of each TCP packet. (The sorting behavior is defined in the TCP / IP RFC specification).

Then, after restoring the logical TCP / IP connection stream, the data combining unit 501 adds the stream to the transmission data queue 510 in order from the top.

[0274] Here, the transmission data queue 510 is a buffer in which bit strings are arranged on a straight line, and is a queue having a data structure (first in first out) in which a bit string is added from the end and output from the head. is there.

Then, when 1 byte or more of data (stream) is accumulated in the transmission data queue 510, the user mode NAT program 500 sequentially transmits the stream data from the head of the transmission data queue 510 to the TCP / Using IP stack 570, send to TCP / IP server program 590 that is waiting on computer E on the existing network (company LAN) that is specified as the destination of the logical TCP / IP connection. To instruct.

[0275] Therefore, at this point, it is specified as the destination of the user mode NAT program 500 and the TCP / IP connection that this user mode NAT program 500 is processing. If a TCP / IP connection has not yet been established with a computer on the company LAN, etc., a TCP / IP connection will be established.

On the other hand, if the data has already been established and the second and subsequent data transmission is performed, the already established TCP / IP connection is used.

[0276] Then, by the above-described series of processes, the computers on the Internet

The TCP / IP client program 560 runs on the remote access computer D. The user mode NAT program 500 is another computer on a private network that cannot be normally accessed, such as a corporate LAN. The above TCP / IP server can connect to the TCP port on which one program 590 is listening, and can send arbitrary data.

[0277] Conversely, TCP / IP server program 590 on computer E sends the stream data to the TCP / IP client program 560 of the computer on the Internet using the established TCP / IP connection. The processing to be performed will be described below. In the data transmission process, the data transmission process from the TCP / IP client program 560 to the TCP / IP server program 590 described above, that is, a process almost opposite to the process in the user mode NAT 500 is performed.

First, with respect to the TCP / IP server program 590 on the computer E, the user mode NAT program 500 is the destination for establishing a direct TCP / IP connection.

When stream data is input from the TCP / IP server program 590 on the computer E via the existing network I / F 580 and TCP / IP stack 570, the user mode NAT program 500 receives this stream data as received data. When the received data queue 509 contains received data of 1 byte or more, the user mode NAT program 500 finally operates the virtual LAN mode. It is sent as transfer data to a TCP / IP client program 560 on another PC via a logical TCP / IP connection.

[0279] Here, the data division unit 505 starts the user mode from the top of the reception data queue 509. The data 600 sequentially read by the NAT program 500 is divided into data smaller than the maximum size that can be transmitted as IP packets, as described in “Specifying the communication destination by TCP / IP connection” in FIG. Output as 601 to TCP header adder 506.

The TCP header adding unit 506 then sets the source port number as the port number of the TCP / IP server program 590 on the computer E, and the destination port number as a TCP / IP client on another PC that operates the virtual LAN card. Program 560 port number is attached to input data 601 and output as TCP packet 602 to IP header ZMAC header adding unit 507.

[0280] Next, the IP header / MAC header adding unit 507 adds an IP header and a MAC header to the input TCP packet 602 (actually a plurality of packets), and creates a virtual MAC frame 603 as a power packet. Output to the conversion unit 508.

Here, the IP address of the computer running the TCP / IP server program 590 as the source IP address in the IP header, and the IP address of the computer running the TCP / IP client program 560 as the destination IP address Is attached.

[0281] Then, the encapsulating unit 508 encapsulates the generated virtual MAC frame 603, and virtualizes it as an IP packet via the TCP / IP stack 530 and the network I / F 540.

Send to HUB550.

As a result, the TCP / IP client program 560 receives the IP packet switched by the Virtual HUB 550 via the Internet via the virtual LAN card.

[0282] Also, as a specification of the TCP / IP protocol, it is possible to confirm that the sent TCP / IP packet has arrived at the destination within a certain time. There is a need to retransmit all TCP / IP packets.

In FIG. 27, the retransmission control unit 520 stores transmission information such as the transmission time and the number of transmission trials in the internal storage unit as a transmission table for each TCP packet that has been transmitted once. Based on this transmission information, refer to the transmission table and resend TCP packets that have arrived, received, and possibly. In addition, for each of the transmission data queue 510 and the reception data queue 509, the maximum size is set by the user or fixed by a program.

[0283] Then, if the receiving apparatus receives data from the transmitting apparatus, the receiving apparatus must notify the transmitting apparatus by transmitting an "acknowledgment response". Les. The user mode NAT program in the VPN system of the present invention also follows this specification.

Normally, an integer value called “reception window size advertisement” is included in the acknowledgment packet.

[0284] For details, refer to the RFC, but the value of “Receiving window size advertisement” is the value for general NAT or when NAT is not used at all. The nodes at both ends that are doing the notification of the size of the free buffer called the current “Receiving window size”.

However, in the case of the user mode NAT program, the advertisement value of the reception window size of the TCP packet for the node inside the NAT indicates the smaller one between the free size of the transmission data queue 510 and 65,536.

[0285] The user one-mode NAT program needs to implement most of the detailed requirements defined in other TCP / IP protocols.

Each logical connection managed by the user mode NAT program has a timeout, and this timeout period can be set by the user arbitrarily.

During this timeout period, SE connections that do not send or receive data even with at least one bit are automatically disconnected.

[0286] Also, in the above-described user mode NAT program, the force explained for passing TCP / IP as NAT When passing UDP / IP, among these processes, data division 505, data The subsequent processing is almost the same as in the case of TCP, except that the combining unit 501 and the acknowledgment transmission and the retransmission control unit 520 do not have three functions.

In other words, the user NAT program functions as a relay terminal having a virtual IP address that is effective in the external virtual network in remote access processing, etc., for example, an external virtual hub and an internal LAN (local With a terminal connected to the This is a virtual LAN card installed in this relay terminal when transferring data between them, and decapsulating the IP packet input by the Virtual Hub, extracting the virtual MAC frame, and extracting the virtual MAC frame after this release. Refers to the destination IP address, sorts the data of this virtual MAC frame in the order of the sequence number of the TCP header, and sends it to the terminal that has the destination IP address in order (for example, from the virtual IP address to the local On the other hand, the data input from the terminal is divided into predetermined data units, the destination IP address is added to form a virtual MAC frame, and the MAC frame is encapsulated. Is sent to the Virtual Hub (local IP address force conversion processing to a virtual IP address). Therefore, a terminal that exists in an external virtual network that can communicate with an external Virtual Hub according to the present invention is a terminal connected to the internal LAN by being relayed by the external Virtual Hub and a user NAT program. It is possible to communicate with

[0287] As described above, by using the user mode NAT program, the problems (1) and (2) indicated as conditions were solved.

Here, the client software (for example, virtual LAN force) in the VPN system of the present invention is premised on operating in the kernel mode, and the NAT program is premised on operating in the kernel mode.

As already mentioned, when shifting both of these functions to the user mode, it is completely meaningless to perform the transition process separately.

[0288] At the same time, that is, the advantages of integrating the functions of the NAT program and the virtual LAN card into a user-mode NAT program are as follows: Shown in

(A) Software that needs to be processed in kernel mode, such as NAT or bridge, is not required to install or configure.

(B) When operating a computer that a user is using for daily work as a gateway computer for connecting to an existing IP network to which the computer is connected via a virtual network, the entire system is affected. It eliminates the need to install a virtual network interface, NAT, bridge, etc. Connection between the virtual network and the existing IP network is easily possible.

(C) When vulnerabilities exist in modules that operate in kernel mode, such as NAT, bridge software, and virtual network interface software (virtual LAN cards and virtual hubs), if those software operate in kernel mode, There is a risk that the entire system can be taken over by a malicious party.

However, if a user-mode process is used, if the user's privilege to start the process is minimized, even if the user-mode process program is vulnerable, the user's It can only take over authority and does not endanger the entire system.

[0289] A program for realizing the functions of the virtual LAN card, the virtual hub, and the user mode NAT is recorded on a computer-readable recording medium, and the program recorded on the recording medium is recorded on the computer. The communication control processing in the virtual LAN card, virtual hub, and user mode NAT described above may be performed by loading the system and executing it. The “computer system” here includes the OS and hardware such as peripheral devices. “Computer system” includes a WWW system equipped with a home page provision environment (or display environment). The “computer-readable recording medium” refers to a storage device such as a flexible disk, a magneto-optical disk, a portable medium such as ROM, CD-ROM, or a hard disk built in the computer system. Furthermore, “computer-readable recording medium” means a volatile memory (RAM) in a computer system that becomes a server or client when a program is transmitted via a network such as the Internet or a communication line such as a telephone line. As described above, it is assumed that the program is held for a certain period of time.

[0290] The program may be transmitted from a computer system storing the program in a storage device or the like to another computer system via a transmission medium or by a transmission wave in the transmission medium. Here, the “transmission medium” for transmitting a program refers to a medium having a function of transmitting information, such as a network (communication network) such as the Internet or a communication line (communication line) such as a telephone line. Further, the program may be for realizing a part of the functions described above. In addition, the functions described above can be What can be realized in combination with programs already recorded in the system, so-called differential files (difference programs).

Claims

The scope of the claims

[1] Generates a virtual MAC frame with the MAC address of the destination virtual LAN card and its own MAC address as the source for the data to be transmitted, converts them into stream data, and encapsulates them The virtual LAN card and this stream data are divided, and an IP packet destined for the virtual hub IP address is generated and sent to the information communication network.

A client terminal with a TCP / IP stack,

Correspondence table of connection port number for switching control and MAC address of connected virtual LAN card is provided. When the IP packet is received, the stream data is restored and the destination and source MACs are restored. With reference to the address, a server device with a Virtual Hub that transmits stream data as IP packets at the connection port corresponding to this destination MAC address

A virtual private network system characterized by comprising:

2. The virtual private network system according to claim 1, wherein when the virtual LAN card generates a virtual MAC frame, at least encryption and / or electronic signature processing are performed.

[3] The virtual private network system according to [1], wherein when the Virtual Hub generates a MAC frame, at least encryption, electronic signature, or both processes are performed.

[4] The virtual LAN card power according to any one of claims 1 to 3, wherein a plurality of TCP / IP connections are provided for one session established with the virtual hub. Virtual private network system.

[5] For each of the multiple TCP / IP connections in the virtual LAN card power session,

5. The virtual private network system according to claim 4, wherein a state variable indicating a quality state of the TCP / IP connection is detected, and a MAC frame is output to the TCP / IP connection having the best quality state.

[6] The Virtual Hub has a transmission queue that shifts input MAC frames in series in the order of input and outputs them from the oldest input order.

The Virtual Hub detects the number of MAC frames accumulated in the transmission queue and 4. The method according to claim 1, wherein the input MAC frames are discarded at a predetermined rate according to the number of frames, and the amount of MAC frames input to the transmission queue is controlled. Virtual private network system.

[7] The claim, wherein the Virtual Hub holds the traffic amount for each transmission source as a state variable, and discards MAC frames from the transmission source exceeding a preset set amount at a predetermined rate. 6. The virtual private network system described in 6.

[8] Unencapsulate the IP packet input from the Virtual Hub, extract the virtual MAC frame, refer to the destination IP address of the virtual MAC frame after this release,

The MAC frame data is rearranged in the order of the sequence number of the TCP header and sent to the terminal having the destination IP address in order. On the other hand, the data input from the terminal is divided into predetermined data units, A virtual MAC frame having a NAT function unit configured to add a IP address to form a virtual MAC frame, encapsulate the MAC frame, and send it to the virtual hub is provided. The virtual private network system according to any one of claims 1 to 7.