+

WO2006064561A1 - Système de réseau virtuel privé - Google Patents

Système de réseau virtuel privé Download PDF

Info

Publication number
WO2006064561A1
WO2006064561A1 PCT/JP2004/018794 JP2004018794W WO2006064561A1 WO 2006064561 A1 WO2006064561 A1 WO 2006064561A1 JP 2004018794 W JP2004018794 W JP 2004018794W WO 2006064561 A1 WO2006064561 A1 WO 2006064561A1
Authority
WO
WIPO (PCT)
Prior art keywords
virtual
tcp
lan card
data
hub
Prior art date
Application number
PCT/JP2004/018794
Other languages
English (en)
Japanese (ja)
Inventor
Daiyuu Nobori
Original Assignee
Softether Corporation
Mitsubishi Materials Corporation
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by Softether Corporation, Mitsubishi Materials Corporation filed Critical Softether Corporation
Priority to PCT/JP2004/018794 priority Critical patent/WO2006064561A1/fr
Publication of WO2006064561A1 publication Critical patent/WO2006064561A1/fr

Links

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L12/00—Data switching networks
    • H04L12/28—Data switching networks characterised by path configuration, e.g. LAN [Local Area Networks] or WAN [Wide Area Networks]
    • H04L12/46—Interconnection of networks
    • H04L12/4641—Virtual LANs, VLANs, e.g. virtual private networks [VPN]

Definitions

  • the present invention relates to a virtual private network system that forms a virtual private network on a network.
  • a LAN Local Area Network
  • a facility company, school, hospital, etc.
  • a database for sharing the data of each computer. Used for data sharing and transmission / reception.
  • each computer connected to the LAN has a private IP address as a terminal, and for connecting to an external network (Internet), a NAT (Network Address) set on a server with a router function is used. Translation), firewall, and HTTP (HyperText Transfer Protocol) proxy.
  • TCPZIP Transmission Control
  • Patent Document 1 Japanese Patent Laid-Open No. 2000-224219
  • TCP over TCP is a technique for realizing VPN by using the TCP / IP protocol as a transmission means for encapsulating virtual network packets that may use the TCP / IP protocol.
  • TCP / IP protocol a transmission means for encapsulating virtual network packets that may use the TCP / IP protocol.
  • the conventional tunneling technology uses TCP / IP for data transmission, this IP packet can be streamed when transferring IP packets in Layer 2 over TCP or Layer 3 over TCP.
  • the protocol for realizing VPN communication is executed by TCP-based connection.
  • the TCP / IP packet storing the data to be transmitted is given a sequence number in the order of transmission from the sender, and the bandwidth by the route the IP packet is sent to If the arrival order changes due to differences or delays, the receiving side rearranges the data in the order of the sequence number and compensates for the data. Do what you want.
  • This time-out time is increased every time a TCP / IP packet does not reach and times out.
  • the lower layer to be encapsulated is SSH (Secure Shell)
  • the upper layer to be encapsulated is PPP (Point to Point)
  • TCP communication HTTP or POP3 which is PPP
  • HTTP or POP3 which is PPP
  • the upper layer and the lower layer have timers with different timeout periods, and each tries to adjust the timeout period independently. Therefore, these adjustments do not work well in TCP over TCP. Transmission performance will be degraded.
  • Socket Layer cannot be used, so session management and IP packet encryption. Digital signatures must be implemented by other methods than SSL.
  • IP layer IP layer, etc.
  • IP routing is required to connect LANN networks over the Internet. Necessary.
  • the present invention has been made in view of such circumstances, and via a LAN with many restrictions on communication between external networks, between the Internet and a computer in another LAN.
  • the purpose is to provide a virtual private network (VPN) system that connects the lines and operates at a practical data transfer rate.
  • VPN virtual private network
  • the present invention In the virtual private network system, the present invention generates a virtual MAC frame in which the MAC address of a destination virtual LAN card and its own MAC address as a transmission source are added to the data to be transmitted. Convert the virtual LAN card to be converted into stream data and encapsulate it, and divide the stream data and assign the Virtual Hub IP address. Generate a destination IP packet and send it to the information communication network.
  • a client terminal equipped with a TCP / IP stack, a connection port number for switching control, and a connected virtual
  • a correspondence table with the MAC address of the LAN card is provided.
  • the stream data is restored, the MAC address of the transmission destination and the transmission source is referred to, and the connection port corresponding to the transmission destination MAC address is restored.
  • a server device mounted with a virtual hub that transmits stream data in IP packets.
  • the present invention is characterized in that, in the virtual private network system, when the virtual LAN card generates a virtual MAC frame, at least a sign ⁇ or a digital signature or both are performed.
  • Item 1 Virtual private network system.
  • the present invention is characterized in that, in the virtual private network system, when the virtual HUB generates a MAC frame, at least encryption and / or electronic signature processing is performed.
  • the present invention is characterized in that, in the virtual private network system, a plurality of TCP / IP connections are provided for one session established between the virtual LAN card card and the virtual HUB. .
  • the present invention detects a state variable indicating a quality state of each TCP / IP connection in a plurality of TCP / IP connections in the virtual LAN card card / session, and obtains the best quality state.
  • the MAC frame is output to the TCP / IP connection.
  • the present invention provides the virtual private network system, wherein the virtual hub includes a transmission queue that serially shifts input MAC frames in the order of input and outputs from the oldest input order.
  • the number of MAC frames accumulated in the transmission queue is detected, and according to the number of MAC frames, input MAC frames are discarded at a predetermined rate, and the amount of MAC frames input to the transmission queue is controlled.
  • the present invention provides the virtual private network system in which the virtual hub holds a communication amount for each transmission source as a state variable, and MAC frames from a transmission source exceeding a preset set amount are transmitted at a predetermined rate. It is characterized by discarding at.
  • the present invention releases the encapsulation of the IP packet input from the Virtual Hub, extracts a virtual MAC frame, and sets the destination IP address of the virtual MAC frame after the release.
  • the virtual MAC frame data is rearranged in the order of the sequence number of the TCP header and sent to the terminal having the destination IP address in order, while the data input from the terminal is set in a predetermined data unit.
  • a virtual LAN frame having a NAT function unit that divides and configures a virtual MAC frame by adding a destination IP address, converts the MAC frame into force, and sends it to the virtual hub is provided. To do.
  • VPN virtual private network
  • FIG. 1 is a conceptual diagram illustrating a configuration example of a general communication system for explaining communication between application programs.
  • FIG. 2 is a conceptual diagram illustrating the data flow when data communication between computers is performed using the TCP / IP protocol.
  • FIG. 3 is a conceptual diagram illustrating the flow of processing for specifying a communication destination in a TCP / IP connection.
  • FIG. 4 is a conceptual diagram showing the relationship between a TCP / IP server program and a TCP / IP client program.
  • FIG. 5 is a conceptual diagram showing a configuration example of a communication system VPN system according to an embodiment of the present invention.
  • FIG. 6 is a conceptual diagram illustrating the configuration of a virtual LAN configured on a network in the VPN system of the present invention.
  • FIG. 7 is a conceptual diagram for explaining a method of exchanging MAC frames by the physical switching HUB158.
  • FIG. 8 is a conceptual diagram for explaining a method of virtual MAC frame exchange by the VPN system of the present invention.
  • FIG. 9 is a conceptual diagram simply showing the server / client relationship between the virtual hub 31 and the virtual LAN cards 11, 21,.
  • FIG. 10 is a conceptual diagram showing sequence processing when data is transmitted / received between a virtual LAN card and a virtual HUB for explaining the SE protocol sequence in the VPN system of the present invention.
  • FIG. 11 is a conceptual diagram of virtual LAN strength for explaining the processing of the encapsulation unit in the virtual LAN card.
  • FIG. 12 is a conceptual diagram showing a configuration example of a Virtual HUB for explaining processing of a Virtual HUB encapsulation unit in the VPN system of the present invention.
  • FIG. 13 is a block diagram showing a configuration example of a capsule capsule unit in FIG.
  • FIG. 14 is a conceptual diagram illustrating the MAC frame combining process of the combining unit 60 in FIG. 13.
  • FIG. 15 is a conceptual diagram illustrating the extension data adding process of the extension processing unit 61 in FIG.
  • FIG. 16 is a conceptual diagram for explaining the security information attaching process of the security information adding unit 62 in FIG.
  • FIG. 17 is a block diagram showing a configuration example of capsule capsule release units 19 and 48 in FIG. 12.
  • FIG. 18 is a conceptual diagram showing the operation of the switching process of the virtual MAC frame switching processing unit 49.
  • FIG. 20 is a conceptual diagram showing a connection relationship between a LAN card 181 and a LAN card 182 connected via a low-speed communication line (10 Mbps), a switching HUB 158, and a high-speed communication line (100 Mbps).
  • FIG. 21 is a conceptual diagram showing a configuration example of a Virtual HUB provided with a congestion control unit 300.
  • FIG. 22 is a conceptual diagram showing a configuration example of a VPN system according to the present invention.
  • FIG. 23 is a conceptual diagram showing a configuration example of a VPN system of the present invention having a bridge connection.
  • FIG. 24 is a conceptual diagram of a configuration for establishing transmission / reception by establishing a plurality of TCP / IP connections for one SE session in the VPN system of the present invention.
  • FIG. 25 is a conceptual diagram of the configuration of a computer on which NAT is implemented to explain the operation of NAT.
  • FIG. 26 is a conceptual diagram showing a system configuration of remote access using a virtual LAN card and NAT.
  • FIG. 27 is a conceptual diagram showing a system configuration for explaining the configuration and operation of a user NAT program in the embodiment of the present invention.
  • Virtual LAN card (virtual LAN card program)
  • TCP / IP stack (TCP / IP protocol
  • the present invention is a virtual private network system that installs (implements) a network device as an application program in a terminal (personal computer or the like) or a server, configures a virtual device, and performs VPN communication.
  • the devices to be virtualized correspond to LAN cards and HUBs that support Ethernet (registered trademark) and IEEE 802.3 standard protocols, which are virtual LAN cards and virtual hubs, respectively.
  • the present invention configures an Ethernet (registered trademark) or IEEE802.3 standard virtual network on a physical information communication network including the Internet, and performs VPN communication using this network. Do.
  • the virtual LAN card program is a virtual LAN card
  • the virtual hub program has a configuration that physically exists as a virtual hub.
  • IEEE802.3 is a kind of layer 2 frame exchange method generally known as Ethernet (registered trademark) and its extended standard.
  • a LAN LAN card and a switching HUB that are actually configured corresponding to a Virtual HUB and a Virtual LAN card that configure a virtual LAN on the network are connected to a physical LAN. Describe as a card and switching hub.
  • NAT Network Address Port Translation
  • plurality refers to one or more items.
  • the TCP / IP stack and the TCP / IP protocol stack are used in the same meaning, and the protocol stack is an arbitrary protocol stack of layer 3 (L3) or higher (regardless of TCP / IP).
  • L3 layer 3
  • FIG. 1 is a conceptual diagram illustrating a configuration example of a general communication system for explaining communication between application programs.
  • communication is realized by exchanging data based on the data exchange method of the application program that is to communicate.
  • an application program installed in each computer to communicate with performs communication processing by a predetermined compatible method (protocol).
  • Each application program runs on a computer that is remote from each other, and data communication between them, for example, the application program 100 running on the sender's computer A is received by the recipient's computer B. It tries to communicate with the application program 101 that operates above.
  • the data 107 to be transmitted is passed to the communication control program 102 that performs the application program 100 power communication control.
  • the communication control program 102 When the communication control program 102 cannot send the data 107 to be transmitted directly to the physical line 106, for example, when the amount of data that can be transmitted in the transmission protocol is exceeded, the communication control program 102 It is divided into relatively small chunks of data called packets that can be sent and received above.
  • the communication control program 102 divides the data 107 into packets 109 of a predetermined amount of data (number of bits), converts the format into a format that can be processed by the communication hardware 104, and performs physical processing. Output to computer B via line 106.
  • the communication hardware 104 receives the packet from the packet communication program 102 and sends it out to the connected physical line 106 as an electronic signal.
  • the physical line 106 may be a single copper wire or a frame exchange installed between the communication hardware 104 and 111.
  • routers and packet switches and various other hardware are inserted, and they are combined to deliver a packet to another specified node at a remote location. Or a set of networks including routing processing. In general, there are local area networks (LAN) and the Internet.
  • LAN local area networks
  • the communication hardware 111 receives a packet as an electrical signal via (via) the physical line 106
  • the communication hardware 111 converts it into a packet 110 as logical data, and the communication control program. Is output to 103.
  • the communication control program 103 combines the input packet 110 by the reverse method that the communication program 102 divides, and uses the received data 108 as an application. Output to Chillon Program 101.
  • the data 108 is converted into a configuration corresponding to the data 107 that the application program 100 on the sender side wishes to transmit.
  • the application program 101 is input as data 108 equivalent to the data 107 output from the application program 100.
  • the data transmitted by the application program 100 reaches the power 107 and the application program 101.
  • the above method is generally applicable to communication between applications using any communication protocol.
  • the TCP / IP protocol used as the basis of communication in the present invention is also used to communicate between applications (or computers) at remote locations as shown in FIG. The method is often used.
  • Fig. 2 is a conceptual diagram illustrating the data flow when data communication between computers is performed using the TCP / IP protocol.
  • TCP / IP is a reliable bi-directional stream data.
  • the stream data transfer service is a connection between two application programs (computers) (two sets of IP address and port number of one node and IP address and port number of one node). If a program that wants to send data sends data in multiple steps, the program that tries to receive the data can be received without changing the content and order of the data. And in fact, the data is going to be received even if it is going to be transmitted or may be divided in the transmission process.
  • a program is a data transfer service that does not need to depend on data delimiters. Stream data refers to data transferred by the transfer service.
  • stream data to be transmitted / received starts at a certain point in time, but the transmission side program does not declare the end, or the reception side program stops receiving, or the computer The network will not be terminated until either time when the network is disconnected.
  • the application program 100 transmits stream data 115 of a predetermined length at a time to the application program 101 (reception side program).
  • the application program 101 has the following character string data
  • the function may be divided as follows on the sending side by the TCP / IP stack program 117, which is one of the function programs that communicate with the TCP / IP protocol included in the OS.
  • the TCP / IP stack program 118 of the computer that has received all of the packets thus divided automatically combines the contents of the original character string.
  • FIG. 2 an application program 115, which operates on the computers A and B connected by the IP network 119 and attempts to communicate using the TCP / IP protocol, An example will be described in which an arbitrary stream data is transmitted / received between 116.
  • IP packets 120 having a predetermined amount of data, and a TCP header and an IP header are added (according to the RFC specification of TCP / IP).
  • the TCP / IP stack program 117 outputs the plurality of dividedly generated IP packets 120 to the driver 121 of the physical network interface.
  • the physical network interface driver 121 is a program for controlling a physical network interface device (noware) 123 such as a LAN card or a modem.
  • the IP network 119 has a function to directly transmit the IP packet 102 when viewed as physical wiring.
  • the driver 121 converts the IP packet 120 into a packet of a different format for each physical layer called a frame, that is, a packet that can be easily handled as an electric signal (hereinafter referred to as a frame 122).
  • the driver 121 converts the IP packet 120 into a frame 122 for transmission to the IP network 119, and converts the frame 122 into the physical network interface device 12.
  • the network interface device 123 converts the input frame 122 into an electrical signal and sends it to the existing physical IP network 119.
  • the process of converting the IP packet 120 into the frame 122 may be performed by the TCP / IP stack program 117 without being performed by the driver 121, or may be performed by the physical network interface device 123. .
  • IP packet 120 (frame 122) is propagated to the computer having the destination IP address described in the IP header of each IP packet 120. arrive.
  • this frame 122 reaches the destination computer B (the final destination application program 101 of the IP packet 120 is activated)
  • the network interface device 124 is converted from the IP network 119 into an electrical signal.
  • Frame 122 is received and output to driver 126 as frame 125.
  • the driver 126 extracts the IP packet 127 from the frame 125 force, and outputs it to the TCP / IP stack program 118 by processing reverse to that on the transmission side.
  • the TCP / IP stack program 118 refers to the IP header and TCP header in the input IP packet 127 by the method defined in the RFC specification of the TCP / IP protocol, and Referring to the destination information such as the port number, the destination application program 101 is determined, and the application program 101 is converted into stream data 116 having the same data format as stream data 115 (that is, restoration). To do.
  • the TCP / IP stack program 118 performs the reverse process of dividing the stream data 115 into a plurality of IP packets 120 performed by the TCP / IP stack program 117.
  • the connection is made based on the information indicating the transmission order of the TCP header, and the stream data 116 (that is, the stream data 115) is restored.
  • the TCP / IP stack program 118 outputs the restored stream data 116 to the application program 101.
  • the stream data 115 (stream data 116) can be transmitted and received between the application programs 100 and 101 using the TCP / IP protocol.
  • the application program 100 transmits the single stream data to the application program 101 between the two computers A and B as an example.
  • the TCP / IP protocol provides a plurality of stream data transfer services that do not interfere with each other's contents, and actually uses one physical communication line or network interface device. It has a multiplexing function that can be done via.
  • a logical set of stream data transfer services in this case, that is, a data transmission / reception path (communication line) between the application program 100 and the application program 101 is called a “TCP / IP connection”.
  • the application program 100 only transmits stream data to the application program 101 by communication using the TCP / IP protocol.
  • the reverse direction is used. This transmission process can also be performed in parallel with the forward transmission process. That is, the TCP / IP connection is a bidirectional connection.
  • Full duplex communication can be performed.
  • each application program that is a party of communication is a 16-bit numerical value to distinguish the application program that is currently connected and the communication destination application program in the TCP / IP connection from the other communication destination application programs.
  • the other party is identified by the identification information. This is the port number in the identification information STCP header.
  • FIG. Figure 3 is a conceptual diagram illustrating the flow of processing for identifying the communication destination in a TCP / IP connection. It is.
  • Two application programs 131 and 132 are running on the computer B to identify the communication destination by the TCP / IP connection, and the application program 131 is an application program using the port number X on the computer A.
  • One application program 132 communicates with the application program using port number Y on computer A by establishing a separate TCP / IP connection.
  • the application program 131 generates stream data 138 to be transmitted to the port number X of the computer A, outputs the stream data 138 to the TCP / IP protocol stack 135, and transmits the stream data 138 to the port number X of the computer A. Instruct to send.
  • the application program 132 At almost the same time, the application program 132 generates stream data to be transmitted to the port number Y of the computer A, outputs it to the TCP / IP protocol stack 135, and transmits the stream data 139 to the port Y of the computer A. Instruct.
  • the TCP / IP protocol stack 135 divides each stream data 138 and 139 input from both application programs 131 and 132 into sizes that can be transmitted, and generates IP packets 133 and 134.
  • the TCP / IP protocol stack 135 then adds the port number of the destination computer A, the sequence number indicating the transmission order, the IP address of the destination computer A, etc. Generate multiple IP packets (IP packets 133, 134) with IP headers including
  • the TCP / IP protocol stack 135 outputs the generated IP packets to the network interface driver 137 in the order in which the processing is completed or in an arbitrary order.
  • the network interface device 137f is controlled to the network interface device, and the IP packet is transmitted to the network and the IP network via the network interface device.
  • the TCP / IP protocol stack 135 implemented in the computer A uses the destination application based on the port number included in the IP packet. For each program, Is reconstructed and output to the corresponding application program.
  • TCP is sent via the network interface device and network interface driver in the opposite direction.
  • IP comes into the protocol stack.
  • the TCP / IP protocol stack refers to the IP header and TCP header of each IP packet, and extracts the IP address, the destination IP address, the source port number, and the destination port number of the transmission source computer A.
  • the TCP / IP protocol stack uses the data obtained by removing the IP header and TCP header for each set of connections based on the sequence number in the TCP header. Connect together.
  • the TCP / IP protocol stack sends the reconfigured stream data to the corresponding port number, that is, to the first application program 131 if the data arrives from port X of computer A. If the data arrives from port Y of computer A, it is output to the second application program 132, respectively.
  • the TCP / IP packet header includes a source IP address, a source port number, a destination IP address, a destination port number, a sequence number, a harmed
  • a TCP / IP connection is a logical connection that provides a two-way stream data transfer that is recognized by a program on the node that is trying to communicate or is doing so. It is distinguished from other connections by a set of four pieces of information: IP address, source port number, destination IP address, and destination port number.
  • the above sequence number is a regular number added by the sender when the stream data, which was originally a series of data flows, is divided into packets, and the received communication such as the TCP / IP protocol stack is received. It is used by the control program to reconstruct the divided packet power stream data.
  • communication can also be performed by forming multiple (two or more) TCP connections between two application programs.
  • TCP / IP server In order to establish a TCP / IP connection and enable both parties to communicate via this TCP / IP connection, as shown in Fig. 4, in general, one of the computers running on one of the computers The application program becomes a “TCP / IP server” and there is another component.
  • Figure 4 is a conceptual diagram showing the relationship between the TCP / IP server program and the TCP / IP client program.
  • the TCP / IP server program 140 is waiting for one or more TCP / IP ports (port number X).
  • the TCP / IP client program 141 is connected to the connected computer, the IP address of the computer on which the TCP / IP server program 140 is running, and the port number that the program is waiting on (TCP / IP port port number). And send a connection request signal (synchronization request signal) to the computer running the TCP / IP server program 140.
  • the TCP / IP server program 140 has a connection request. If it is determined that the connection with the TCP / IP client program 141 is permitted, a connection acceptance response signal is returned to the TCP / IP client program 141 of the transmission source.
  • the TCP / IP client program 141 returns a confirmation signal (acknowledge signal) indicating that the connection acceptance response signal has been received to the TCP / IP server program 140.
  • the TCP / IP server program 140 when receiving the confirmation signal, establishes a new TCP / IP connection between the two application programs. Configure.
  • Fig. 4 is a conceptual diagram that briefly shows the processing described above, which is an application program.
  • one of the two application programs to communicate is a TCP / IP server program in advance, and one or more TCP / IP Powerful that you need to wait for the port.
  • This port is called a standby port, and this port number is called a standby port number. Normally, one application program can prepare multiple standby ports.
  • the TCP / IP server program can permit all the connections.
  • the TCP / IP server program forms a TCP / IP connection with multiple TCP / IP client programs by itself (independently). Stream data can be sent to and received from IP client programs separately from other TCP client programs.
  • VPN virtual private network
  • IP network such as the Internet
  • VPN system does not actually have a hardware (physical) network interface
  • a network interface hereinafter referred to as a LAN card
  • a virtual network interface device hereinafter referred to as a virtual LAN card
  • a program or a hardware system composed of ASICs with similar functions
  • a hardware network interface that does not actually have Is a virtual IEEE802.3 MAC frame exchange program that emulates the operation of a packet switching device (hereinafter referred to as a switching HUB) that has a connection port from multiple network interfaces that support IEEE802.3.
  • Virtual HUB Packet Control Unit
  • FIG. 5 is a conceptual diagram showing a configuration example of a communication-system VPN system according to an embodiment of the present invention.
  • virtual LAN card programs 11 and 21 are installed on two computers, VPN client computers 10 and 20, respectively, and virtual HUB program 31 is installed on one computer.
  • IP network 119 such as the Internet
  • the configuration of the embodiment of the present invention of FIG. 5 is that the virtual hub program 31 is installed, the computer operating as the virtual hub is the VPN server computer 30, and each of the virtual LAN card programs 11 and 21 is installed.
  • the computers operating as the virtual LAN card are the VPN client computer 10 and the VPN client computer 20.
  • each of the virtual LAN card programs 11 and 21 operating on both the VPN client computer 10 and the VPN client computer 20 is a TCP / IP client program (the virtual LAN card is a hardware (If a TCP / IP client terminal) Is working as.
  • the Virtual Hub program 31 running on the VPN server computer 30 is running as a TCP / IP server program (or TCP / IP server device if the Virtual Hub is hardware).
  • the Virtual Hub program 31 prepares a predetermined TCP port as a standby port as a TCP / IP server program.
  • the Virtual Hub program 31 is configured so that the virtual LAN card programs 11 and 21 operating on both the VPN client computers 10 and 20 are connected to the TCP port on which the TCP / IP server program is listening. On the other hand, after completing the handshake using the TCP / IP protocol, a connection is formed, and authentication work and the like are completed for both the VPN client computers 10 and 20.
  • the VPN server computer 30 It is possible to send and receive arbitrary MAC frames (corresponding to frames 122 and 125 in Fig. 2) via (via) the virtual HUB program running on.
  • the protocol stack 13 provided as a part of ⁇ S already describes the above data.
  • the MAC frame is converted into a plurality of MAC frames having a predetermined amount of data, and the MAC frame is output to the LAN card set in advance in the application program 12, that is, the virtual LAN card 11.
  • the virtual LAN card 11 when the virtual LAN card 11 receives the MAC frame, the virtual LAN card 11 performs processing necessary for the VPN of the present invention, such as adding an encryption and an SE header, which will be described later, and performing encapsulation. Is output to protocol stack 13.
  • the protocol stack 13 adds a predetermined TCP / IP header to the input packet and converts the packet into an IP packet, and sends it to the IP network 119 via the interface device 14.
  • the protocol stack 33 receives the IP packet via the interface device 34. To do.
  • the protocol stack 33 When the protocol stack 33 detects that the destination of the IP packet is the Virtual HUB 31 by referring to the TCP / IP header, the protocol stack 33 outputs the IP packet to the Virtual HUB 31.
  • the Virtual Hub 31 can receive the IP packet in the VPN system of the present invention, and performs the reverse process to the encapsulation process performed by the virtual LAN card 11 in the VPN client computer 10.
  • the MAC frame generated by the protocol stack 13 of the VPN client computer 10 is extracted.
  • the Virtual HUB 31 performs processing necessary for the VPN of the present invention such as adding the encryption and SE header to be described later to the extracted MAC frame and encapsulating it, and after the change Packet is output to protocol stack 33.
  • the protocol stack 33 adds a TCP / IP header, which is the virtual LAN card 21 of the destination SVPN client computer 20, to the input packet, generates an IP packet, and sends the IP packet to the interface device. It is sent to IP network 11 9 via 34.
  • the protocol stack 23 sends the IP packet via the interface device 24. Receive. Next, when receiving the IP packet, the protocol stack 23 refers to the TCP / IP header and outputs the IP packet to the virtual LAN card 21 when the destination is the TCP / IP virtual LAN 21.
  • the virtual LAN card 21 When the virtual LAN card 21 receives the IP packet, the virtual LAN card 21 performs processing opposite to the encapsulation processing performed by the virtual hub 31 of the VPN server computer 30 and the protocol stack 13 of the VPN client computer 10 The generated MAC frames are extracted and sequentially output to the protocol stack 23.
  • the protocol stack 23 refers to the TCP / IP header for each input MAC frame, performs predetermined processing such as rearrangement of MAC frame data in the order of output from the protocol stack 13, The data transmitted by the application program 12 is reconfigured and output to the destination application program 22.
  • Fig. 6 (a) shows the concept of the normal LAN configuration
  • Fig. 6 (b) shows the concept of the virtual LAN configuration virtually formed on the network in the VPN system of the present invention. I'm going.
  • the device 36 does not need to be a single layer 2 frame switching device, but an IP network (a large-scale network such as the Internet) that is a collection of multiple layer 2 and layer 3 switching devices. But it may be good).
  • IP network a large-scale network such as the Internet
  • network interface devices (physical LAN cards) that support IEEE802.3 and are installed in multiple computers, respectively.
  • 182, 183, and IEEE802.3 MAC frame exchange device 158 (physical switching hub) installed in the center and force S, cable, optical fiber, or wireless It is connected by a communication line of any physical layer.
  • the MAC address of the LAN card 181 of one of the computers connected to the switching HUB158 is the MAC address of the LAN card 182 of another computer connected to the same switching HUB158. If the LAN card 182 with this MAC address is used as the destination to transmit data, the IEEE802.3 specification states that each transmitted data is a maximum of 1,514 bytes called a MAC frame. (Variable) packets are divided by the protocol stack.
  • the switching HUB 158 receives a MAC frame at the connection port set for the LAN card 181, the MAC frame is connected to another LAN card of an appropriate destination described in the MAC header. Send to the connected port.
  • the switching HUB 158 is connected to some device other than the connection port from which the MAC frame was transmitted. The same MAC frame is copied and transmitted to all connection ports.
  • the switching HUB 158 copies and distributes the same packet to all connected parties other than the sender of the MAC frame (this operation is called flooding). Call).
  • the MAC frame distribution function of the switching HUB 158 allows the physical network interface device on each computer to send and receive arbitrary MAC frames between them.
  • a virtual LAN card program (virtual LAN card) and a virtual switching HUB program (virtual HUB) exist as programs in the VPN as in the LAN described above.
  • two or more virtual LAN cards connected to one Virtual Hub can send and receive arbitrary MAC frames to each other.
  • FIG. 6 (b) This configuration will be described with reference to FIG. 6 (b).
  • Each virtual LAN card 12, 22, and 522 operating (provided) on each computer operates on one computer. Connected to Virtual Hub 31.
  • a virtual LAN card 12 recognizes the destination MAC address of the virtual LAN card 22 on another computer connected to the same virtual HUB 31, and the virtual LAN card 22
  • the MAC frame undergoes a process called encapsulation by the process in the virtual LAN card 12, and is converted into stream data.
  • the virtual LAN card 12 waits for the generated stream data for the physical IP address of the computer on which the virtual hub 31 to which the virtual LAN card 22 is connected and the virtual hub 31 to listen. Instructs the TCP / IP stack (protocol stack already described) to transmit to the TCP / IP port number that is being sent, and outputs stream data to the TCP / IP stack.
  • TCP / IP stack protocol stack already described
  • the TCP / IP stack 15 performs exactly the same processing as when a normal application program already described tries to send arbitrary stream data to other programs on the network using the TCP / IP protocol.
  • the stream data generated by the virtual LAN card 12 is sent to the destination Virtual Hub 31.
  • An existing IP network (such as the Internet) is used for this transmission.
  • Virtual HUB 31 performs processing opposite to encapsulation (referred to as decapsulation) for the content of stream data that is finally received from virtual LAN card 12 via TCP / IP stack 15 or the like. And take out the MAC frame that the virtual LAN card 12 tried to transmit.
  • Virtual Hub 31 refers to the destination MAC address of each MAC frame, and if it detects that virtual LAN card 22 of that destination MAC address is currently connected to itself, that virtual LAN card 22 operates.
  • the destination computer is encapsulated in the same way as the virtual LAN card 12, and the MAC frame is converted to stream data via the IP network. Sent to a computer running card 22.
  • the Virtual Hub 31 sends the virtual LAN that is the sender of the MAC frame.
  • the MAC frame is copied and distributed to all virtual LAN cards connected to cards other than card 12 (that is, flooded).
  • each of the plurality of virtual LAN cards connected to the Virtual Hub 31 can transmit / receive an arbitrary MAC frame between the Virtual Hub cards via the Virtual Hub 31.
  • FIG. 7 is a conceptual diagram illustrating a method of MAC frame exchange by the physical switching HUB158.
  • the physical LAN card 151 may overlap within a range in which MAC frames can be directly transmitted and received with the same IEEE 802.3 (this range is called a broadcast domain).
  • the MAC address is added as a unique address.
  • This MAC address is usually an identification number assigned by each LAN card manufacturer and an industry group created by the manufacturer or engineer. This MAC address is 6 bytes (48 bits).
  • the MAC frame sent from any physical LAN card 151 automatically has two MAC addresses: the MAC address of the LAN card 151 and the MAC address specified as the destination LAN card 152.
  • Information card (destination MAC address, source MAC address), additional information necessary for control of other MAC frames, and a MAC frame of up to 1,514 bytes including data that you want to actually transmit. 158 is transmitted as an electrical signal.
  • the physical switching HUB 158 When the physical switching HUB 158 receives a MAC frame as an electrical signal from the physical LAN card 151 at a predetermined connection port # 1, it is converted into digital data at a MAC frame receiving unit (usually an electronic circuit) 154.
  • a MAC frame receiving unit usually an electronic circuit
  • the MAC frame switching processing unit 155 reads two pieces of address information, that is, a destination MAC address and a source MAC address, from each input MAC frame.
  • the switching hub 158 usually has a finite number of connection ports, and if any device is connected to each connection port, the MAC frame transmission queue (160) corresponding to the connection port to which the device is connected. , 161, 162) inside.
  • 155 adds the input MAC frame to the MAC frame transmission queue corresponding to the connection port connected to the LAN card having the MAC address that is the destination of this MAC frame.
  • the MAC frame switching processing unit 155 refers to only the destination MAC address, and when it is detected in advance which connection port the LAN card 152 having the destination MAC address is connected to, The input MAC frame is added only to transmission queue 161 of connection port # 2.
  • switching HUB 158 internally has a list of known MAC addresses and a correspondence table for storing which connection port each MAC address in this list corresponds to.
  • the MAC frame switching processing unit 155 examines this table for all MAC frames that contain the MAC address information of the destination LAN card and determines which transmission port transmission queue the MAC address should be added to. It is detected every time.
  • the MAC frame switching processing unit 155 when the MAC frame switching processing unit 155 receives a new MAC frame at an arbitrary connection port, the MAC frame switching processing unit 155 refers to the transmission source MAC address extracted from the header of the received MAC frame, and determines the MAC address. Correspondence between MAC address and connection port number If the MAC address and connection port number do not exist in the table, a new MAC frame source MAC address and connection port number are registered in the correspondence table between MAC address and connection port number. If the address exists and the connection port number is different, the process of constantly updating the correspondence table between the MAC address and the connection port number is performed by overwriting the connection port number for that MAC address. I'm going.
  • the MAC frame switching processing unit 155 sends a destination to each MAC frame.
  • the MAC address and port number required for processing while adding the MAC frame to the transmission queue (160, 161, 162) corresponding to the port where the LAN card may be connected To create or update the correspondence table.
  • the MAC frame transmission unit 157 corresponding to the connection port receives The MAC frames are taken out in order from the head of the corresponding MAC frame transmission queue, and converted into electrical signals are sent out electrically from the connection port.
  • This electrical signal is sent by the MAC frame transmission unit 157 to the physical LAN card that is the destination.
  • MAC frame As described above, once a MAC frame is passed, it is assigned to the transmission queue prepared for each connected device, and then the bucket is forwarded to the actual destination in the order of the head strength of the transmission queue. Generally called “Store and Forward”.
  • the store In store-and-forward, the store is to determine the transmission queue corresponding to the appropriate connection destination and add it to the transmission queue, and the forward is to extract the leading packet from the transmission queue and connect to the connection destination. It refers to the action of sending to.
  • FIG. 8 is a conceptual diagram for explaining a method of virtual MAC frame exchange by the VPN system of the present invention. This FIG. 8 is written in contrast to the method of MAC frame exchange by the physical switching HUB158 described in FIG.
  • the VPN system constituted by the virtual LAN system of the present invention has the virtual HUB 31 and a plurality of virtual LAN cards (12, 21,%) Connected around it.
  • This virtual LAN system has the same configuration as the LAN system using the physical switching HUB 158 described in FIG. 7 and a plurality of physical LAN cards (151, 152) connected to it. ing.
  • each of the virtual LAN card 11 and the virtual LAN card 21 is logically IEEE802.3-compliant than the network interface device (physical LAN card) 16 and 26 with a physical connection connector.
  • a program (or hardware) that emulates the operation of a LAN card.
  • These virtual LAN cards (11, 21) are recognized and controlled in the same manner as physical LAN cards by the protocol stack application program operating in a higher layer.
  • a MAC frame in a format compliant with IEEE 802.3 transmitted between the virtual LAN cards 11 and 21 via the virtual hub 31 is defined as a “virtual MAC frame”.
  • the virtual MAC frame is transmitted and received between the virtual LAN card (11, 21) and the virtual hub (31), but the raw data of the virtual MAC frame is actually used as an electrical signal. This is because it is encapsulated by a header (described later) that contains some information that does not flow on the line.
  • the virtual LAN card 11 is set to a MAC address “001111111111”
  • the virtual LAN card 21 is set to a MAC address “002222222222”.
  • the virtual LAN card 11 uses itself as the source MAC address and the destination MAC address as the MAC address of the virtual LAN card 21, and transmits a virtual MAC frame including data to be transferred to the virtual LAN card 21.
  • the virtual LAN card 11 performs processing such as encryption and electronic signature on one or more virtual MAC frames to be transmitted.
  • the virtual LAN card 11 adds the SE header corresponding to the protocol in the VPN system of the present invention to the MAC frame on which the above processing has been performed.
  • Data (stream data 40 in SE protocol format) is generated and output to the TCP / IP stack 15.
  • the virtual LAN card 11 uses the IP address of the computer C on which the Virtual HUB 31 is operating and the Virtual HUB 31 operating on the computer C as the destination for transmission processing in the TCP / IP protocol. Specify as the port number of the TCP port that is listening on.
  • the TCP / IP stack 15 uses the same processing procedure as when the stream data 40 in the SE protocol format is input from the application program that performs communication using the normal TCP / IP protocol.
  • the TCP interface and the IP header are divided, and this is converted into an IP packet to form a plurality of IP packets 41 to the physical network interface device 16 provided in the computer C. Output via a device driver that supports.
  • the IP packet is transmitted on the IP network 119 by processing according to the normal TCP / IP protocol, and is a physical network interface device 34 provided in the computer C on which the virtual hub 31 is operating. To be received.
  • the network interface device 34 outputs the received IP packet 44 (IP packet 41) to the TCP / IP stack 35 via the device driver corresponding to itself.
  • the IP packet 44 input to the TCP / IP stack 35 corresponds to a plurality of IP packets 41 that the TCP / IP stack 15 converts into IP packets.
  • the TCP / IP stack 35 combines the plurality of IP packets 44 according to the sequence number included in the TCP header to restore the stream data 45.
  • the TCP / IP stack 35 uses the IP packet generated by dividing the TCP / IP stack 15 in the same way as when the data addressed to the application program that communicates according to the normal TCP / IP protocol arrives. 41 is combined, and the stream data 45 corresponding to the stream data 40 generated by the virtual LAN card 11 is restored.
  • TCP / IP stack 35 specifies stream data 45 restored by combining IP packets 44. Output to Virtual Hub 31 that listens on the specified port number.
  • the Virtual HUB 31 When the Virtual HUB 31 receives the stream data 45 in the SE protocol format, the Virtual HUB 31 performs a process reverse to the encapsulation performed by the virtual LAN card 11, that is, a decapsulation process.
  • Virtual HUB 31 extracts the virtual MAC frame in the virtual LAN system by processing such as decapsulation.
  • the extracted virtual MAC frame is a virtual MAC frame transmitted by the virtual LAN card 11, and is output from the virtual hub 31 to the virtual MAC frame switching processing unit 49. Then, the virtual MAC frame switching processing unit 49 The configuration is the same as the physical switching hub 158 described in FIG. 7, and virtual MAC frame exchange is performed by the same processing as the MAC frame exchange method performed by the switching hub 158 (details will be described later).
  • the Virtual HUB 31 operates on a plurality of computers (for example, computer B) and performs a plurality of virtual LAN cards (for example, 2 1,. ⁇ ) is established, and there is one transmission queue (51, 52, ...;) corresponding to each connection port for each virtual LAN card.
  • the virtual MAC frame switching processing unit 49 refers to the virtual MAC frame input from the decapsulation unit 48 that performs decapsulation and extracts the source MAC address and the destination MAC address.
  • Virtual HUB 31 shows a correspondence table between the virtual MAC address and the virtual LAN force connected to the connection port, with the MAC address and connection port number in the physical switching HUB158 shown in Fig. 7. Perform the same processing as the operation for the correspondence table (details will be described later), look at the destination MAC address of the input virtual MAC frame, and check the destination MAC address and the virtual LAN card connected to the connection port. From the correspondence table, a transmission queue for the destination virtual LAN card, for example, the transmission queue 51 is selected.
  • the Virtual HUB 31 adds a virtual MAC frame to the end of the selected transmission queue 51 (at the end of the queue).
  • the destination MAC address is a broadcast address or if the destination virtual LAN card cannot be determined, except for the transmission queue corresponding to the source virtual LAN card, Performs flooding processing for all other transmission queues.
  • the virtual hub 31 is provided with encapsulation units 53, 54, and 55 for performing encapsulation.
  • Each of these power psenolays 54 and 55 takes out the virtual MAC frame in order from the top in the state where one or more virtual MAC frames exist in the transmission queues 50, 51 and 52, respectively.
  • a communication protocol SE that controls the communication method between the virtual LAN card and the virtual hub, such as encrypting and digitally signing each MAC frame and adding an SE protocol header
  • SE that controls the communication method between the virtual LAN card and the virtual hub, such as encrypting and digitally signing each MAC frame and adding an SE protocol header
  • It is converted (encapsulated) into a data format according to the protocol.
  • Each of the encapsulation units 53, 54, and 55 generates stream data (stream data in the SE protocol format) 47 that can be transmitted by the TCP / IP protocol, and converts this into the TCP / IP stack 35. Output to.
  • the destination at the time of transmission processing in the TCP / IP protocol corresponds to the IP address of computer B on which the destination virtual LAN card 21 is operating and the virtual LAN card 21 operating on that computer C. Specify the TCP port number.
  • the TCP / IP stack 35 uses the same procedure as when stream data is input from an application program that performs communication using the normal TCP / IP protocol. , And a TCP header and an IP header are added to the divided packet, and the IP packet is made into a plurality of IP packets 46, and this network is connected to the physical network interface device 34 provided in the computer C. Output via a device driver compatible with interface device 34.
  • the IP packet 46 is sent to the IP network by normal TCP / IP protocol transmission control.
  • the physical network interface device 26 inputs the IP packet 46 and outputs the IP packet 43 (corresponding to the IP packet 46) to the TCP / IP stack 25.
  • the TCP / IP stack 25 combines the IP packet 43 and outputs it to the virtual LAN card 21 as stream data 42 by processing corresponding to the normal TCP / IP protocol.
  • the stream data 42 corresponds to the stream data 47 generated by the virtual HUB 31.
  • the virtual LAN card 21 receives the stream data 42 from the TCP / IP stack 25, cancels the encapsulation by the reverse process of the encapsulation process by the virtual hub 31, and finally the virtual LAN card 11 transmits it. Extract multiple MAC frames.
  • the virtual LAN card 21 can receive the virtual MAC frame transmitted by the virtual LAN card 11 and having the destination MAC address “002222222222”.
  • transmission from the virtual LAN card 21 to the virtual LAN card 11, that is, transmission of a virtual MAC frame in the reverse direction described above, or any virtual LAN operating and running on another computer 500 other than this example If there are virtual MAC frames sent to the card that are connected to the same Virtual HUB 31, any virtual MAC frame sent to or received from that virtual LAN card is the same as the process described here. Can be done.
  • transmission / reception of a virtual MAC frame between a plurality of virtual LAN cards centered on a virtual hub by the VPN system of the present invention is performed between a plurality of physical LAN cards centered on a physical switching hub. This is possible in the same way as sending and receiving MAC frames.
  • the data encapsulating the virtual MAC frame transmitted / received between the virtual LAN cards 11, 21 and the virtual hub 31 uses the TCP / IP protocol as stream data. Sent and received.
  • TCP / IP connection When a TCP / IP connection is established between two computers by using the processing according to the TCP / IP protocol described above and a bidirectional stream data transfer service is used, one is a server and the other is a client. A relationship needs to be configured.
  • a program that becomes a TCP / IP server puts a specific port number on standby
  • Program power as a TCP / IP client Specify the computer's IP address and port number, and call the TCP / IP stack (protocol stack).
  • TCP / IP client program tries to handshake the port number on which the TCP / IP server program is running, and if successful, the TCP / IP client program and the TCP / IP server program
  • a TCP / IP connection is defined that is defined by four sets of information: “server-side IP address, server-side port number, client-side IP address, client-side port number”, and is distinguished from other connections. It is.
  • Virtual Hub 31 is the center of the VPN system, that is, a TCP / IP server program, and virtual LAN cards 11, 21,... Are TCP / IP client programs.
  • a TCP / IP connection is established with the Virtual Hub 31 as the server and the Virtual LAN card as the client.
  • FIG. 9 is a conceptual diagram briefly showing the server / client relationship between the virtual hub 31 and the virtual LAN cards 11, 21,...
  • the virtual LAN card 11 is not connected to any Virtual HUB. Therefore, in order to use it, the virtual LAN card can be used on another computer or the same computer by user operation. However, it is necessary to connect to a Virtual HUB that is operating in good quality.
  • the first stage is a handshake process for connecting the Virtual LAN card 11 as a TCP / IP client to the TCP / IP port where the Virtual Hub 31 is waiting as a TCP / IP server. is there.
  • the virtual HUB 31 and the virtual hub 31 are connected to the virtual hub 31 using the established TCP / IP connection.
  • SE protocol-specific handshake processing is performed between LAN cards 11 using the SE protocol.
  • This SE protocol-specific handshake processing includes authentication processing for the virtual LAN 11 to check the validity of the Virtual Hub 31, authentication processing for the Virtual Hub 31 to check the validity of the Virtual LAN 11, This includes the process of checking the version information of Virtual Hub 31 and Virtual Network Adapter 11 between each other.
  • TCP / IP connection function established between all virtual LAN cards (11, 21, 521) and the virtual hub 31. Is called.
  • Virtual LAN Force 11 remembers that the client is authenticated by an access control database (such as a user name and password pair) that is determined by the Virtual Hub administrator in advance.
  • the Virtual Hub 31 communicates with each of the plurality of virtual LAN cards (11, 21, 521, ⁇ ) in a reliable manner. (Client side and server side force S, which means that the current session is remembered. Physically does not occupy one line) Therefore, after each reliable logical connection is established, the logical communication session with each virtual LAN card 11 is managed in units.
  • the above logical connection refers to the state in which the Virtual Hub is currently connected and can transmit / receive virtual MAC frames to / from each LAN card at any time.
  • a logical storage of the relationship between Called Yon In the VPN system of the present invention, a logical storage of the relationship between Called Yon.
  • the session in the VPN system of the present invention is logical (meaning that the client side and the server side remember that the session is currently established. Physically, one The virtual MAC frame is transmitted and received in full duplex between the virtual LAN card 11 that is the client and the virtual hub 31 that is the server in the session. You can do it.
  • the virtual MAC frame actually transmitted / received is transmitted / received by transmitting / receiving the stream data after performing the capsule processing such as encryption in the handshake processing and the attachment of the electronic signature. Flows within a logical TCP / IP connection.
  • each logical session has a one-to-one correspondence with one logical TCP / IP connection. Can support more than two TCP / IP connections).
  • FIG. 10 is a conceptual diagram showing sequence processing when data is transmitted and received between the virtual LAN card and the virtual HUB for explaining the SE protocol sequence in the VPN system of the present invention.
  • the virtual LAN card 11 requests to connect to a specific virtual HUB 31 by a communication processing operation 200 from the user (connection request 201).
  • the virtual LAN card 11 tries to establish a TCP / IP connection to the destination Virtual HUB 31 according to the connection request 200 from the user.
  • the virtual LAN card 11 determines the IP address of the Virtual Hub 31 and the standby port number.
  • a connection request 201 including the specified instruction is output to the TCP / IP stack 15.
  • the TCP / IP stack 15 attempts a handshake to establish a TCP / IP connection with the connection-destination Virtual HUB 31 according to the TCP / IP protocol.
  • the handshake process is actually a force performed by a plurality of times of IP packet transmission / reception, which is omitted here and expressed as handshake establishment 202.
  • any type of IP network (Ethernet (registered trademark), ATM, frame relay, telephone line, etc.) is connected between Virtual Hub 31 and Virtual Network Adapter 11 during this period. Even if it exists, if one computer power tries to send any stream data, it means that the stream data reaches the other computer.
  • the virtual LAN card 11 After the TCP / IP connection is established between the virtual LAN card 11 and the virtual HUB 31, the virtual LAN card 11 performs a handshake process according to the SE protocol with the virtual HUB 31. (SE protocol handshake request 203).
  • the Virtual Hub 31 transmits the following information (SE protocol handshake response 205) to the virtual LAN card 11.
  • the information (SE protocol handshake request 203) transmitted from the virtual LAN card 11 to the Virtual HUB 31 for handshake processing includes the following.
  • the TCP / IP stack 15 sends the IP packet 204 including the SE protocol handshake request 203 to the virtual HUB 31. Send.
  • the TCP / IP stack 35 outputs the input SE protocol handshake request 203 to the virtual HUB 31.
  • Virtual Hub 31 confirms the validity of virtual LAN card 11 by referring to the input SE protocol handshake request 203, and outputs SE protocol handshake response 205 to TCP / IP stack 35. To do.
  • the TCP / IP stack 35 transmits an IP packet 206 including this SE protocol handshake response 205 to the virtual LAN card 11.
  • the virtual LAN card 11 inputs the SE protocol handshake response 205 via the TCP / IP stack 15 and confirms the validity of the virtual HUB 31.
  • the hand that includes information indicating that the virtual hub 31 has completed the handshake processing and accepted the connection to the virtual LAN card 11.
  • Send a shake success notification signal final signal in the SE protocol handshake response).
  • This handshake success notification signal includes the following information.
  • the virtual MAC frame 208 transmitted from the virtual LAN card 11 to the other virtual LAN card via the virtual hub 31 is encapsulated by the virtual LAN card 11, As described above, it is converted into stream data.
  • the rules for converting to stream data are stipulated in a common protocol defined in advance by Virtual Hub 31 and Virtual LAN Card 11.
  • the virtual LAN card 11 outputs stream data 209 to the TCP / IP stack 15.
  • the TCP / IP stack 15 makes the TCP / IP connection associated with the SE session established with the Virtual Hub 31 by converting the input stream data 209 into an IP packet. Is used to transmit through the IP network and send to the computer running Virtual Hub 31.
  • the TCP / IP stack 35 operating on this computer receives this IP packet 210.
  • the TCP / IP stack 35 restores the stream data 211 from the input IP packet, and outputs this stream data 211 to the virtual HUB 31.
  • the virtual HUB 31 extracts the virtual MAC frame 212 from the input stream data 211 by performing processing reverse to the encapsulation performed by the virtual LAN 11, that is, decapsulation.
  • Virtual HUB 31 can specify a session to which another virtual LAN card corresponding to the destination MAC address described in the virtual MAC frame is connected after performing predetermined switching processing and store-and-forward processing.
  • the virtual LAN card 11 has a virtual MAC frame 20 8 is encapsulated, and the stream data 214 encapsulated in the virtual MAC frame 213 is processed by the TCP / IP stack 35 using the same process as that transmitted to the Virtual Hub 31 via the TCP / IP connection as stream data. Packet 215 is passed to other virtual LAN card via TCP / IP connection.
  • VPN that can send and receive IEEE802.3 MAC frames via Virtual Hub can be constructed and operated between remote locations in a manner that spans existing IP networks such as the Internet. It becomes like this.
  • FIG. 11 is a conceptual diagram of the virtual LAN card for explaining the processing of the encapsulation unit in the virtual LAN card.
  • the encapsulating unit 18 converts the virtual MAC frame 303 input from the protocol stack 302 of the upper layer into stream data, and forms the stream data 40 as the lower data. Output to TCP / IP protocol stack 13.
  • the capsule release unit 19 performs a process opposite to the capsule unit 18 and extracts a plurality of virtual MAC frames 304 from the stream data 42.
  • the encapsulation unit 18 and the decapsulation unit 19 have a central role in the IEEE 802.3 virtualization processing by the VPN system of the present invention.
  • the virtual LAN card 11 when the virtual LAN card 11 tries to transmit / receive arbitrary data to / from another virtual LAN card, the virtual LAN card 11 uses a program to perform communication. It can be used like a physical LAN card for the following reasons.
  • the operating system has an interface (device driver) that is no different from a virtual LAN card operating one physical LAN card. is doing.
  • the communication application program 300 instructs the protocol stack 302 of the protocol to be used to transmit data. .
  • the protocol stack 302 of the protocol you want to use is that the physical layer LAN card receives data from applications such as TCP / IP protocol stack, NetBEUI protocol stack, IPX / SPX protocol stack, etc. Any existing protocol stack can be used as long as it has the ability to be converted into a MAC frame.
  • the arbitrary protocol stack 302 is selected by the communication application program 300 and outputs a plurality of virtual MAC frames 303 to the virtual LAN card 11.
  • the force processor 18 encapsulates the plurality of virtual MAC frames and converts them into stream data 40.
  • Data 40 is output to TCP / IP protocol stack 13.
  • the TCP / IP protocol stack 13 converts the input stream data 40 into IP packets 41, and passes through the existing physical network interface device 14 to the computer running the Virtual Hub on the IP network. Send to
  • IP packet 43 is input from the computer on which the Virtual Hub is operating on the IP network to the computer on which the virtual LAN card 11 is operating, the network interface device 14 is input. IP packet 43 is output to TCP / IP stack 13. The TCP / IP stack 13 restores it as stream data 42 since the IP packet 43 is converted into stream data (encapsulated) by the Virtual Hub and converted into IP data. Output to LAN card 11.
  • the decapsulation unit 19 performs decapsulation processing on the input stream data 42, and extracts a plurality of virtual MAC frames 304. And, the decapsulation unit 19 extracts the extracted virtual MAC frames 304, The protocol number is referred to from the header part of the MAC frame, and passed to any protocol stack 302 currently available in the form of a plurality of virtual MAC frames.
  • an arbitrary communication application program 300 can finally receive data by other computer power or VPN.
  • FIG. 12 is a conceptual diagram showing a configuration example of a Virtual HUB for explaining the processing of the encapsulation unit of the Virtual HUB in the VPN system of the present invention.
  • a virtual hub for example, virtual hub 31
  • the virtual MAC frame encapsulated from these IP packets is extracted and the header is extracted.
  • the destination MAC address the destination session of the MAC frame is determined, and transmission to the destination session is actually performed, that is, switching processing logically equivalent to the IEEE802.3 switching HUB is performed.
  • the TCP / IP protocol stack 35 combines the input IP packet 44 to restore the stream data 45, and outputs this stream data 45 to the decapsulation unit 48.
  • the decapsulation unit 48 performs predetermined processing to decapsulate the input stream data 45, extracts a plurality of virtual MAC frames 307, and outputs them to the MAC frame switching processing unit 49 To do.
  • the MAC frame switching processing unit 49 uses the above-described “virtual MAC frame exchanging method by the VPN system of the present invention” to map the correspondence between the virtual MAC address and the SE session (corresponding to the connection port of Virtual Hub). , The switching process is performed according to the correspondence table, and the virtual MAC frame 306 sorted for each destination session is added to the transmission queue (50, 51, 52, ⁇ ) for each session. To do.
  • the session encapsulation units (53, 54, 55,%) Corresponding to the transmission queue each correspond to the corresponding transmission queue. From the head of (50, 51, 52,%), For example, the head force of the transmission queue 51 is taken out and a plurality of virtual MAC frames 308 are taken out and encapsulated.
  • the encapsulation unit 54 converts the plurality of virtual MAC frames into stream data 47 and outputs the stream data 47 to the TCP / IP protocol stack 35.
  • the TCP / IP protocol stack 35 converts the stream data 47 into an IP packet, generates a plurality of IP packets 46, and transmits the IP packets 46 to the IP network via the network interface device 34.
  • the IP packet is sent to the virtual LAN card ahead of the destination session.
  • VPN system of the present invention which may be shared by the HUB, these are implemented by a common program (algorithm).
  • FIG. 13 is a block diagram illustrating a configuration example of the capsule unit.
  • the capsule section 18 (53-55) has a coupling section 60, an expansion processing section 61, and a security information adding section 62.
  • the combining unit 60 When a plurality of virtual MAC frames 59 are input, the combining unit 60 performs a process of connecting and combining them in an appropriate order according to a predetermined number of frames when the plurality of virtual MAC frames arrives. Stream 63 is generated.
  • the extension processing unit 61 performs 0 or 1 or more extension processing on the input stream 63, generates stream data 64, and outputs the stream data 64 to the security information adding unit 62.
  • the expansion processing can include processing for improving communication efficiency such as data compression.
  • the security information adding unit 62 performs security processing such as encryption and digital signature on the stream data 64 to generate data 65 with the security information added. To do. Then, the security information adding unit 62 passes the data 65 as stream data 47 to the TCP / IP stack 35 in the next stage and transmits it to the program of the destination computer.
  • the security information adding unit 62 can be omitted.
  • FIG. 14 is a conceptual diagram illustrating the MAC frame combining process of the combining unit.
  • the combining unit 60 combines the input virtual MAC frames with the second virtual MAC frame after the first virtual MAC frame and the third virtual frame after the second MAC frame. Like MAC frames, they are arranged in a straight line in the order of input or in an appropriate order, but not in the order of input, that is, they are connected in series.
  • the length information (bit length) of the MAC frame is added before each MAC frame, where each virtual MAC frame is from where to where, and the total number of combined virtual MAC frames is In order to be able to detect how much it will be, the stream information described in FIG. 13 is added while adding length information and alternative delimiters to it.
  • the combined stream 63 is output to the extension processing unit 61.
  • FIG. 15 is a conceptual diagram illustrating the extension data adding process of the extension processing unit 61.
  • the input stream 63 can be subjected to 0 or one or more arbitrary number of extension processes.
  • the expansion processing unit 61 when a stream 63 containing data with a high compression rate is input, the expansion processing unit 61 outputs a data compressed using a data compression algorithm, etc. Short stream data 64 can be generated to increase efficiency.
  • the extension processing unit may use 0, that is, the input stream 61 as the output stream 64 as it is.
  • FIG. 16 is a conceptual diagram illustrating the security information adding process of the security information adding unit 62.
  • a plurality of encryption algorithms and electronic signature algorithms are stored in a table, and a signature algorithm and an electronic signature algorithm selected in advance from the table by the user are used.
  • the electronic signature unit 66 calculates the data of the electronic signature 68 for the contents of the input stream 64 by the selected electronic signature algorithm. Is added to the contents of the stream 64, and is output to the encryption unit 67.
  • the encryption unit 67 encrypts the entire stream data with the selected encryption algorithm for the stream data, and Output as stream 47. At this time, the size of the stream data may change.
  • the stream 47 obtained in this way is a stream that includes both the content of the stream 64 and the content of the electronic signature 68 and, if necessary, other extension information.
  • the encryption unit 67 first performs the encryption algorithm processing, and then the electronic signature unit 66 uses the electronic signature algorithm.
  • the processing may be performed in the reverse order as described above, in which an electronic signature is calculated and added.
  • a method compatible with SSL is adopted as the security information-added card unit 62.
  • FIG. 6 is a block diagram showing an example of the configuration of the de-releasing units 19, 48.
  • the decapsulation units 19 and 48 have a disassembling unit 71, an extended processing removing unit 72 and a security information removing unit 73.
  • the decapsulation unit 19 or 48 converts the input stream data 45 into a virtual MAC frame in the reverse order of the encapsulation units 18 and 5355.
  • the security information removing unit 73 performs processing in the reverse order to the processing detailed in the processing content of the security information adding unit 62 in Fig. 16, and is input from the TCP / IP stack.
  • the stream data 74 before encryption / electronic signature is restored from the stream data 45 added with the digital signature and output to the extended processing removal unit 72.
  • the security information removing unit 73 outputs data 74 obtained by removing the security information from the stream data 45 and restoring the stream before the sign.
  • the extended processing removal unit 72 restores the data changed by each extended processing to the original data 75 and outputs it to the decomposition unit 71.
  • the extended process removing unit 72 removes information from the extended process from the data 74 and outputs the restored data 75.
  • the disassembling unit 71 performs reverse processing to the combining unit 60 on the input data 75, and from the virtual MAC frames arranged in a straight line and the identification codes for separating them, each virtual MAC The frame 307 is extracted, and the extracted plurality of virtual MAC frames 307 are output as the capsule release unit 48.
  • FIG. 18 is a conceptual diagram showing the operation of the switching process of the virtual MAC frame switching processing unit 49.
  • the virtual MAC frame switching processing unit 49 performs switching processing for each virtual MAC frame that is input and assigns it to an appropriate session by looking at the destination MAC address.
  • One correspondence table (that is, correspondence table between virtual MAC address and SE session number) is managed.
  • Each row of this correspondence table describes the correspondence between the virtual MAC address and the session number, and it is also possible to describe extended information such as the date and time when each row was created or updated.
  • the virtual MAC frame switching processing unit 49 refers to the header of the input virtual MAC frame 307 and extracts the MAC address of the sender of the virtual MAC frame 307.
  • the virtual MAC frame switching processing unit 49 detects whether or not a row including the MAC address exists in the correspondence table between the virtual MAC address and the session number and the virtual MAC frame switching processing unit When 49 detects that the searched MAC address does not exist, 49 newly adds the correspondence between the MAC address and the transmission source session number of the MAC frame to the correspondence table.
  • the virtual MAC frame switching processing unit 49 detects that the corresponding MAC address exists, the virtual MAC frame switching processing unit 49 actually transmits the MAC frame in which the session number is recorded in the correspondence table. If the number of the session you tried is different, update the session number in that row of the correspondence table.
  • the virtual MAC frame switching processing unit 49 extracts a destination MAC address in the virtual MAC frame.
  • the virtual MAC frame switching processing unit 49 is a unique address, so the row corresponding to the MAC address is the virtual MAC address. And whether it exists in the correspondence table between and session number.
  • the virtual MAC frame switching processor 49 transmits the virtual MAC frame by reading the session number corresponding to the virtual MAC address from the correspondence table. Confirm the destination session number To do.
  • the virtual MAC frame switching processing unit 49 adds a virtual MAC frame to the transmission queue corresponding to the confirmed session number.
  • the virtual MAC frame switching processing unit 49 excludes the transmission source session when it detects that the destination MAC address does not exist in the correspondence table or when the destination MAC address is a broadcast address, because the session number cannot be determined. Packets are flooded to the transmission queue (50, 51, 52, ⁇ ) of all sessions.
  • the processing described above is the processing of the virtual MAC frame switching processing unit 49.
  • the encapsulation unit 53 55 in the Virtual HUB transmits the packet. Is read and encapsulated.
  • FIG. 19 is a conceptual diagram showing the configuration of the VPN system of the present invention using IP networks with different line speeds.
  • the virtual LAN card 11 on the sender side is first virtual. Encapsulate the MAC frame into stream data and output it to the TCP / IP stack 15.
  • the TCP / IP stack 15 uses the TCPZIP connection corresponding to the SE session already established with the Virtual Hub 31, and the TCP / IP stack 15 sends the stream data to the computer where the Virtual Hub 31 is operating. Send.
  • the computer on which Virtual Hub 31 is operating receives the stream data from the IP network (high-speed line with a line speed of 100), decapsulates the stream data with TCP / IP stack 35, and creates a virtual MAC frame. Session to the virtual LAN card 11 corresponding to the destination MAC address by various processing of the Virtual Hub 31. Insert into send queue 50 corresponding to.
  • the above-described process is a process of transferring a virtual MAC frame from the virtual LAN card 11 to the virtual HUB 31 via the high-speed line IP network.
  • the Virtual Hub 31 encapsulates the virtual MAC frames accumulated in the internal transmission queue 50, converts them into stream data, and transmits them to the IP network using the TCPZIP stack 35.
  • the TCPZIP stack 25 of the computer on which the destination virtual LAN card 21 is operating restores the stream data input via the IP network (low speed line with a line speed of 1) and outputs it to the virtual LAN card 21.
  • the virtual LAN card 21 decapsulates the input stream data and takes out the virtual MAC frame.
  • the processing up to the above is the transfer processing of the virtual MAC frame from the virtual hub 31 to the virtual LAN card 21 via the low-speed line IP network.
  • the virtual LAN card 11 is transferred through a two-stage transfer process, the “Virtual MAC frame transfer process from Virtual Network Adapter 11 to Virtual Hub 31” and the “Virtual MAC frame transfer process from Virtual Hub 31 to Virtual Network Adapter 21”.
  • the MAC frame transmitted by arriving at virtual LAN mode 21.
  • the line speed of the communication line between the computer on which the virtual LAN card 11 is operating and the computer on which the virtual hub 31 is operating and the virtual hub 31 are operating.
  • the line speed of the communication line between the computer and the computer on which the virtual LAN card 21 is operating is almost equal, or the data receiving side can communicate at high speed with the data sending side. If there is no problem, especially in communication.
  • the computer and virtual LAN on which Virtual HUB31 operates can be determined by the line speed of the communication line between the computer on which Virtual LAN card 11 is operating and the computer on which Virtual HUB31 is operating. If the line speed of the communication line with the computer on which the card 21 is operating is lower, that is, if the data receiving side can only perform low-speed communication with the data sending side, Problems occur.
  • the ratio of the transfer capability between the communication line K1 and the communication line K2 is 100: 1.
  • the virtual LAN card 11 attempts to transmit a plurality of virtual MAC frames, for example, a total size of 100, to the virtual LAN card 21.
  • the line speed between the virtual LAN card 11 and the virtual hub 31 is 100, and the size of the stream data encapsulated by the virtual LAN card 11 is 100 (actually, it is slightly Since the increase force S and its influence can be ignored compared to the above line speed difference, for example, transmission processing of all virtual MAC frames to the Virtual Hub 31 is completed in a unit time.
  • the Virtual Hub 31 obtains the TCP / IP connection of the communication session corresponding to the virtual LAN card 21 from the network and the transmission queue 50 in order from the computer running the virtual LAN card 21. Attempt to send stream data encapsulating MAC frames.
  • the number of virtual MAC frames that can be transmitted in unit time on communication line 2 is only 1% of the total number of virtual MAC frames accumulated in transmission queue 50, which is 1 The remaining 99 virtual MAC frames are still in the transmission queue 50.
  • the transmission queue 50 corresponding to the session of the Virtual LAN card 21 is stored in the transmission queue 50.
  • the MAC frame size that enters within a certain time is significantly larger than the MAC frame size that exits within a certain time, that is, congestion occurs.
  • the operation method of the application program that attempts to perform the communication described in FIG. In the case of communication between programs via a physical communication line that does not involve a VPN, a line between the communication hardware and the destination communication hardware is transmitted to one of the programs for the communication hardware. If you try to send a packet that significantly exceeds the speed capability (throughput), the transmission capacity will be exceeded by the communication hardware, physical line, or packet switching equipment such as an IP router on the physical line or routing equipment. Packets are automatically discarded and ignored because they have not arrived.
  • the role of the TCPZIP protocol stack is that multiple TCPZIP stacks are used to send stream data input to the TCP / IP stack on the source computer.
  • the packet is sent to the network and sent to the network.
  • the TCP / IP stack of the recipient's computer that receives it is restored to the original state before the IP packet arrived, and is first sent to the source computer. Attempt to restore the stream data input to the TCP / IP stack above.
  • the sending TCP / IP stack When the sending TCP / IP stack detects that such a situation has occurred, it resends to the destination computer the same IP packet that was sent again the last time it was thought to have not reached the other party.
  • a plurality of switching hubs using a normal physical IEEE802.3 are mainly used.
  • a LAN card transfers the processing capacity of the switching HUB and the communication lines (LAN cables, wireless transmission paths, etc.) that connect the switching HUB to each LAN mode. If you try to send a MAC frame that significantly exceeds its capabilities, some or all of the MAC frame will be discarded by the hardware.
  • one set of 100Mbps-compatible cables and LAN cards are connected to two types of switching hubs that support 100802_TX and 10Base_T. And a LAN card is connected.
  • FIG. Figure 20 is a conceptual diagram showing the connection relationship between LAN card 181 and LAN card 182 connected via a low-speed communication line (10 Mbps), switching HUB158, and high-speed communication line (100 Mbps).
  • FIG. 10 Mbps 10 Mbps
  • HUB158 switching HUB158
  • HP-speed communication line 100 Mbps
  • the switching HUB 158 transmits a MAC frame to the LAN card 182 by LAN card 181 power OO Mbps connected at 100 Mbps.
  • switching HUB 158 can receive packets with a throughput of 100 Mbps. Since the communication line speed to LAN card 182 is only 10 Mbps, packets are discarded electronically when the transfer capacity is exceeded, and 90 Mbps Packets will not arrive.
  • the transmission of encapsulated stream data between the Virtual Hub 31 and the Virtual LAN Cards 11 and 21 is effective for each TCP /
  • the communication speed and ratio of the communication line K1 used in the “virtual MAC frame transfer processing from the virtual LAN card 11 to the virtual hub 31” are compared.
  • the communication speed of the communication line K2 used for “Virtual MAC frame transfer processing from Virtual Hub 31 to Virtual LAN card 21” is extremely slow, the following phenomenon occurs.
  • the Virtual HUB 31 has a transmission queue 50 to be transmitted to the virtual LAN card 21, and sequentially encapsulates the virtual MAC frames accumulated in the transmission queue 50 to send a TCP to the virtual LAN card 21. Attempt to transmit using / IP connection.
  • the TCP / IP stack 35 can hardly complete the transmission of the encapsulated stream data.
  • the TCPZIP protocol specification tries to transmit all stream data in order from the beginning, even if the line speed is low, without changing the contents or losing some of the data.
  • the data to be transmitted that has been accumulated in the transmission queue 50, sequentially encapsulated, and data streamed will be accumulated immediately before the TCPZIP stack 35.
  • FIG. 21 is a conceptual diagram showing a configuration example of a Virtual HUB provided with the congestion control unit 300.
  • the above-described congestion is caused by the virtual MAC frame to be transmitted at the head portion of the transmission queue 50, the force to be transmitted by the S encapsulation unit 53, and the line speed of the communication line constituting the IP network to the destination computer is slow. Occurs when it takes time to complete the encapsulated stream data transmission by the TCP / IP stack.
  • the essence of the congestion problem is that the encapsulated stream by the TCPZIP stack
  • the congestion occurs in the transmission queue 50, and the transmission queue Since the virtual MAC frame stored in 50 is preferentially taken out and encapsulated and transmitted, the virtual MAC frame that arrives later is the time between being put in the queue and transmitted. The time interval of this will become long.
  • a state variable A is provided for each transmission queue 50.
  • the virtual MAC frame added to the transmission queue 50 from the virtual MAC frame switching unit 49 always passes through the congestion control unit 300, so that the virtual MAC frame passes through the algorithm in the congestion control unit 300. If it is permitted to pass, it is added to the transmission queue 50, and if it is rejected, the virtual MAC frame is discarded as if it was not received at first.
  • the congestion control process performed in the congestion control unit 300 is calculated for each transmission queue for each of a plurality of virtual MAC frames input simultaneously from the virtual MAC frame switching processing unit 49. It is determined whether or not to add to the transmission queue based on the probability of frame addition, and the virtual MAC frame determined to be added is added to the transmission queue and the others are discarded.
  • the frame addition probability determination method that can be determined in advance by the user is determined in advance by the Virtual Hub program and cannot be changed by the user. It ’s good, and you can change it.
  • the frame addition probability is set to 0.5. If A is not 0, update A twice and set the frame addition probability to 2 (-A). In the above method, the frame addition probability decreases exponentially when the transmission queue remains.
  • one TCPZIP connection is used for transmission of the encapsulated stream data between the Virtual Hub 31 and the Virtual LAN cards 11 and 21 in FIG.
  • the communication speed of the communication line K1 used for the “Virtual MAC frame transfer process from the virtual LAN card 11 to the Virtual HUB 31” in the configuration as described by the disadvantages of The following drawbacks that occur when the communication speed of the communication line K2 used for “Virtual MAC frame transfer processing to the LAN card 21” is extremely slow can be solved.
  • the Virtual HUB 31 has a transmission queue 50 to be transmitted to the virtual LAN card 21, and sequentially encapsulates the virtual MAC frames stored in the transmission queue 50 to send TCP / IP to the virtual LAN card 21.
  • the line speed of the communication line K2 is slower than that of the communication line K1, so the TCP / IP stack is unable to complete the transmission of the stream data that has been
  • the data to be transmitted that are encapsulated in the transmission queue 50 and sequentially encapsulated into a data stream accumulates immediately before the TCP / IP stack.
  • the congestion control unit 300 connected to the transmission queue 50 adds frames based on the number of frames accumulated in the transmission queue. Probability was determined.
  • the congestion control unit 300 In this state, the SE session power other than the SE session that sent a large amount of virtual MAC frames first ⁇
  • the state variable A of the transmission queue becomes large. Even when trying to transmit, the congestion control unit 300 also decreases the frame addition probability as the value of the state variable A of the transmission queue increases.
  • the initial value is 0, and the state variable A [n] that is updated every unit time is the state variable from session n to the transmission queue.
  • a [n] is determined for each transmission queue, but for the sake of simplicity, only one transmission queue will be described.
  • a [n] is set to 0 and the frame addition probability is set to 1.
  • the frame addition probability is set to 0.5.
  • a [n] is doubled and the frame addition probability is set to 2 (—A [n]).
  • the frame addition probability decreases exponentially when the transmission queue remains.
  • a virtual HUB The amount of packets that are automatically added to the attacked session by the congestion control unit 300 is limited, and the attacked SE session receives packets from other SE sessions. Only the packets from the attack source, that is, the source SE session, can be restricted, which can be resolved.
  • stream data in which a virtual MAC frame is encapsulated is transmitted / received via a TCP / IP connection.
  • the encapsulated data is flowing on the IP network as PPTP packets and L2TP packets.
  • the Virtual Hub that is the VPN server operates as a TCP / IP server program
  • the Virtual LAN card that is the VPN client is TC
  • the Virtual LAN card is connected to the Virtual HUB.
  • the CONNECT method in the HTTPS proxy server and the connection request signal in the SOCKS server for the proxy server corresponding to the HTTPS protocol and the proxy server corresponding to the SOCKS version 4 protocol ( The details are left to each protocol specification.)
  • the virtual LAN card can connect to a server computer running Virtual HUB via VPN.
  • FIG. 22 is a conceptual diagram showing a configuration example of the VPN system of the present invention.
  • the virtual LAN card 11 of the VPN client computer 10 is connected to the virtual HUB 31 on the VPN server computer 30 via the proxy server 301.
  • one TCP / IP connection is established between the virtual LAN card 11 and the proxy server 301, and one TCP / IP connection is established between the proxy server 301 and the virtual hub 31.
  • the virtual LAN card 11 of the VPN client computer 10 establishes a TCP / IP connection to the Virtual Hub 31 on the VPN server computer 30 and sends / receives the encapsulated data stream. Absent.
  • the proxy server 301 sends the data stream received from one TCPZIP connection as it is to the other TCP / IP connection.
  • the virtual LAN card 11 of the VPN client computer 10 establishes a TCP / IP connection directly with the Virtual HUB 31 on the VPN server computer 30 and performs communication similar to that performed by the SE protocol. Is done.
  • an application program 12 that performs network communication that operates on the VPN client computer 10 and an application prod- ucer that performs network communication that operates on the VPN client computer 20. You can communicate freely through the Virtual Hub 31 running on the VPN server computer 30.
  • a host such as a server that provides each service
  • an external IP network such as the Internet
  • the application program that you want to use by communicating between the above computer and the computer on the external IP network S, if the proxy server installed in the company LAN is not supported, the application program has been improved Rewrite to enable communication via a proxy server (such as an HTTPS server or a SOCKS server) installed on the corporate LAN. Even if the internal LAN configuration is changed and the proxy server is not used, the external IP It was necessary to take measures such as enabling communication with hosts on the network.
  • FIG. 23 is a conceptual diagram showing a configuration example of the VPN system of the present invention having a bridge connection.
  • the virtual LAN card 11 is recognized as one LAN card by the operating system.
  • any MAC frame can be transmitted and received between the PC 305 and another PC 303 (or 304) on the in-house LAN.
  • Sessions between virtual and LAN networks and virtual and HUBs may have an identification code called a session ID.
  • This session ID is known only to both the virtual LAN card and the Virtual Hub (one is determined using a random number during handshaking and notified to the other). Even when the TCP / IP connection that controls session communication between the virtual LAN card and the Virtual Hub is disconnected, the logical session remains for a certain period of time set by the user (or fixed by the program). It has been continued.
  • the virtual LAN card detects that the connection with the Virtual Hub has been disconnected, it establishes a TCP / IP connection with the Virtual Hub again and communicates as before in the handshake processing.
  • the session ID is communicated to the Virtual Hub.
  • the Virtual HUB searches for the presence of a session corresponding to the session ID for the pending session strength, and if a corresponding session ID is detected, the Virtual HUB can reconnect to the session.
  • This reconnection function is installed in the VPN system of the present invention.
  • the protocol stack application program operating at a higher level than the virtual LAN card does not respond to the fact that the line between the LAN card and the HUB was originally disconnected. Since the power is recognized as if it was not disconnected, there is an effect that the disconnection of communication in the upper layer can be suppressed even on the poor quality IP network where the TCP / IP session is disconnected.
  • the logical session indicating the communication between the virtual LAN card and the virtual HUB is one TCP / IP. It was established by a connection, and one TCP / IP connection was supported for one session.
  • two or more multiple applications not one, between application programs (specifically, between a TCP / IP server program and a TCP / IP client program)
  • the data flowing over the TCP / IP connection is capable of determining the start point because the end point is up to the end of the VPN communication. It is unknown, and due to the characteristics of VPN, it is necessary to send packets that have been encapsulated at an early time and converted into stream data as soon as possible by the encapsulation unit on the transmission side.
  • FIG. 24 is a conceptual diagram of a configuration in which a plurality of TCP / IP connections are established and transmitted / received for one SE session in the VPN system of the present invention.
  • Fig. 24 (b) The correspondence to multiple TCP / IP connections is explained using Fig. 24 (b).
  • Fig. 24 (b) in order to establish a plurality of TCP / IP connections between the virtual LAN card and the Virtual HUB and use these TCP / IP connections well, For each SE session, the same number of TCP / IP connections as the encapsulation units 181 to 183 are established.
  • the TCP / IP stack 13 divides the packet into IP packets corresponding to one TCP / IP connection, and transmits the packet via the IP network 119.
  • the TCP / IP stack 35 of the remote computer receives the transmitted IP packet, restores the IP packet to stream data, and outputs it to the capsule release unit 48.
  • the decapsulation unit 48 extracts the virtual MAC frame from this stream data.
  • the virtual MAC frame when the virtual MAC frame is transmitted, the virtual MAC frame is input to the connection selection unit 310 before being input to the encapsulation units 181 to 183.
  • connection selection unit 310 is provided as a stage immediately before the capsule unit.
  • the connection selection unit 310 distributes a plurality of input virtual MAC frames to each of the encapsulation units 181 to 183 prepared in the same number as the number of established TCP / IP connections based on a predetermined algorithm. Take control.
  • connection selection unit 310 receives the input virtual
  • the MAC frame is distributed to the encapsulation unit 181, the encapsulation unit 182, and the encapsulation unit 183.
  • Each of the encapsulating unit 181, the encapsulating unit 182, and the encapsulating unit 183 has one TCP / IP connection corresponding thereto.
  • connection selection unit 310 selects which encapsulation unit each virtual MAC frame is assigned to, and outputs the virtual MAC frame as it is based on the selection result. Do not do any processing such as editing the contents of the virtual MAC frame.
  • Each of the encapsulation units 181 to 183 outputs a plurality of virtual MAC frames to which the encapsulation unit 181 to 183 is input via the TCP / IP stack 13 to the corresponding TCP / IP connection. To help.
  • the TCP / IP stack 13 transmits the virtual MAC frame to the virtual LAN card of the receiver computer connected via the IP network 119. Then, the TCP / IP stack 35, in the order opposite to the above transmission processing by the computer that transmitted, the stream data encapsulated by the plurality of decapsulation units 481, 482, 483 corresponding to the TCP / IP connection. Decapsulation is performed, a plurality of virtual MAC frames are extracted, and the virtual MAC frames are output to the connection coupling unit 490.
  • connection coupling unit 490 rearranges the received virtual MAC frames in the order of the received time series, and outputs the received virtual MAC frames to the process for performing the next processing.
  • connection selection unit 490 can be replaced, but it is considered that the encapsulation unit that outputs the virtual MAC frame should be selected by the following method.
  • connection selection unit 490 allocates the virtual MAC frame to any one of the encapsulation units 181 to 183 will be described.
  • Each of the encapsulation units 181 to 183 has a state variable Q for managing the quality state of the corresponding TCP / IP connection.
  • the initial value of Q is “0”, and the larger the value of Q, the worse the quality.
  • connection selection unit 310 selects the one with the smallest value of the state variable Q from all the capsule units (181 to 183), Instructs the selected encapsulation unit to transmit the MAC frame. In addition, the connection selection unit 310 selects the one with the lowest value of the state variable Q from the plurality of capsule units (181 to 183). A capsule part with state variable Q is selected according to a rule set by the user at random. Further, the connection selection unit 310 can receive a plurality of virtual MAC frames at the same time as the previous process power, and can instantly perform these processes for each virtual MAC frame without blocking. This is encapsulated by the connection selector 310 This is because the process of distributing the frame to the part is a process in the memory of the computer. (Because communication is not involved, there is no blocking)
  • Encapsulation units 181 to 183 encapsulate virtual MAC frames (which may be received at the same time) input from connection selection unit 310, and hold them as stream data on a first-come-first-served basis. At this time, the capsule units 181 to 183 perform stream data combining processing by adding the stream data generated later to the end of the stream data generated immediately before.
  • Capsule section 181 attempts to transmit the currently held stream data in order from the top using a TCP / IP connection.
  • the capsule data unit passes the stream data to the TCP / IP stack 13 to instruct transmission.
  • the TCP / IP stack 13 attempts to transmit the stream data input from the encapsulation unit to the IP network.
  • the TCP / IP stack 13 notifies the encapsulation unit corresponding to the transmitted stream data of the completion of the transmission process.
  • the TCP / IP stack 13 may indicate that if the network speed is slow or the quality is poor, or if the stream data to be transmitted is too large, the transmission of the part of the stream data up to
  • the transmission information indicating that the data has not been transmitted is notified to the encapsulation unit corresponding to the stream data. This notification is sent each time the encapsulation is sent to the TCP / IP stack, and the following information is known.
  • Capsule (181, 182, 183) receives the notification from TCP / IP Stack 13 in response to (5) and transfers the data to TCP / IP Stack 13.
  • the state variable Q is initialized to “0”.
  • capsule capsule (181, 182, 1 83) adds n to the state variable Q when it receives from the TCP / IP stack 13 transmission information indicating that the instructed data transfer has not yet been completed.
  • n is a variable, and may be fixed to 1. Also, even if it is passed to the TCP / IP stack 13, the transmission is completed and the value is proportional to the total amount of data. It ’s good.
  • the virtual LAN card 11 provides a plurality of TCP / IP connections for one SE session established with the virtual hub 31 and a plurality of TCP / IP connections provided for this SE session.
  • the status variable indicating the quality status of each TCP / IP connection is detected, and the MAC frame is output to the TCP / IP connection in the best quality status.
  • an SE session can be configured with multiple TCP / IP connections, and the encapsulated stream data that should flow through the SE session is as efficient as possible for each TCP / IP connection. Will be transmitted evenly. As a result, the total throughput in the SE session is improved compared to the method in which one TCP / IP connection is supported for the SE session.
  • connection selection unit 310 needs to be placed immediately before the encapsulation unit.
  • connection combining unit 310 needs to be placed immediately after the capsule release unit on the receiving side.
  • the encapsulated part of one virtual MAC frame (that is, the IP packet into which one stream data is divided) is actually transmitted after being divided into multiple TCP / IP connections. Can happen.
  • the receiving side receives IP packets from multiple TCP / IP connections divided by the transmitting side and simply combines the IP packets to restore the original stream data. When data arrival in one line is delayed
  • the original stream data cannot be restored until the data arrives.
  • connection selection unit 310 is installed immediately before the encapsulation unit, and the TCP that transmits the virtual MAC frame by the quality state variable Q managed by each capsule unit is transmitted.
  • the method of selecting an / IP connection has an effect that cannot be realized with a normal combination.
  • any existing arbitrary communication is possible.
  • the data to be transmitted by the communication application program is encapsulated in accordance with the SE protocol. It will be divided into / IP connections and sent.
  • VPN system of the present invention all existing arbitrary communication keywords are used.
  • benefits such as improved communication speed and stable communication in parallel IJTCP / IP connection communication can be automatically received without rewriting each application program.
  • a remote access system can be configured by combining a virtual LAN card and NAT (Network Address Translation).
  • FIG. 25 is a conceptual diagram of the configuration of a computer on which NAT is implemented to explain the operation of NAT.
  • NAPT Address Translation
  • NAT technology is a general technology, and its basic specifications are defined in RFC 2663, so here are the details.
  • TCP / IP client program (port number 1234) on computer A (IP address 192 ⁇ 168.0.2) on IP network 192.168.0.0/24 inside NAT NAT IP network outside NAT 192 ⁇ Computer B on 168.10.0 / 24 (IP address
  • Computer F that becomes NAT is 192 ⁇ 168.0.1 as NAT inside, and as outside
  • computer A IP address 192.168.0.2/TCP port number 1234
  • computer B IP address 192.168.10.1/TCP port number 80
  • the TCP packet is transmitted from the physical LAN card 323.
  • the NAT program in the computer F inputs the TCP packet via the LAN card 321 and rewrites the IP address of the TCP packet.
  • the address rewriting unit 322 in the NAT program In case of either TCP / IP packet or UDP / IP packet, rewrite two sets of port number and IP address in TCP header or UDP header and IP header, but other operations such as TCP packet No reconfiguration is performed.
  • the TCP / IP packet is sent from the address rewriting unit 322 by the source.
  • the reverse TCP / IP packet flow is the opposite of the above process.
  • NAT The use of NAT in Figure 25 shows that two physical LAN cards are installed on computer F, which is one NAT, and one is outside NAT (for example, the external Internet side) and the other is on the other side. It is inside NAT (for example, in-house LAN side).
  • FIG. 26 is a conceptual diagram showing a system configuration of remote access using a virtual LAN card and NAT.
  • a virtual LAN card is logically identical to a physical LAN card from the viewpoint of the operating system, so it can be replaced with a physical LAN card.
  • the VPN configured by the VPN system of the present invention is used for remote access.
  • the system connection status is as follows: a computer with a virtual LAN card installed on the Internet and a virtual hub 3 installed on the Internet that is logically connected at the same time.
  • the virtual LAN card 11 operating in the computer F that will be the NAT for remote access is logically connected to the virtual hub 31 (SE session is established).
  • SE session is established.
  • the communication path for the encapsulated (VPN) TCP / IP connection established between Virtual LAN Card 11 and Virtual HUB 31 is the network that is connected to LAN Card 323. Forces constituted by means passing through or other means, etc. Since they are constituted by conventional means, and have already been described, description thereof will be omitted.
  • the NAT program operates in the same manner in the central computer.
  • the virtual LAN card 11 is connected to the virtual HUB 31, and the virtual LAN card of the computer 10 is also connected to the same virtual HUB 31.
  • the IP address of the virtual LAN card of the computer 10 is 192.168.0.2.
  • Figure 26 shows the TCP / IP client program (port number 1234) on this computer 10 (IP address 192.168.0.2) and computer B (IP address 192) on the IP network 192.168.10.0/24 outside NAT. ⁇ 168 ⁇ 10.1) This indicates a state in which a TCP / IP connection is established with the TCP / IP server program (port number 80) to establish communication.
  • Computer F that becomes NAT is 192.168.0.1 as inside NAT and outside as NAT
  • a TCP packet is sent from computer 10's virtual LAN card (IP address 192.168.0.2/TCP port number 1234) to computer B (IP address 192.168.10.1/TCP port number 80).
  • This sent TCP packet is IP address rewritten by the NAT program of computer F.
  • the address rewriting unit 322 in the NAT program sets the port number and IP address in the TCP header or UDP header and IP header. Perform two sets of rewriting. [0248] Here, the address rewriting unit 322 rewrites the IP address of the TCP / IP packet with the source as 192.168.10.10 and the port number 5678.
  • the TCP / IP packet with the rewritten IP address and port number arrives at the destination computer B.
  • the reverse direction that is, the transmission of the TCP / IP packet from the computer B to the computer 10, the processing opposite to that described above is performed.
  • the virtual MAC frame flowing between the Virtual Hub and each virtual LAN card is encapsulated by each encapsulating unit, and if encryption is performed when encapsulating, this It is safe to pass virtual MAC frames over dangerous networks such as the Internet.
  • This method is different from the conventional layer 3 encapsulation technology in the VPN system of the present invention, in which the MAC frame in layer 2 is encapsulated and the LAN card is emulated by the virtual LAN card program. This is what makes it possible.
  • the NAT program power of the remote access computer works correctly in the applications described in the section “Remote access using a virtual LAN card and NAT”. It must be implemented as a program that corresponds to the operating system used.
  • the virtual LAN card program is compatible with Windows 2000 (registered trademark) or later. It does not support Windows 98 (registered trademark), and other UNIX (registered trademark) operating systems are also supported. Unpublished.
  • the NAT program comes standard with an implementation that can be used as a NAT if it is a Windows (registered trademark) server-based operating system such as Windows 2000 (registered trademark) or Server 2003 (registered trademark).
  • Windows registered trademark
  • Server 2003 registered trademark
  • Versions such as Windows XP do not provide NAT program implementations that meet the NAT requirements (sometimes included in third-party gateway programs).
  • kernel mode specifications vary greatly from one operating system to another, a kernel mode program written on one system must run on another system without significant rework.
  • the programming interface specifications in the user mode are unified to some extent for each system.
  • porting a user mode program to another system is much easier than porting a kernel mode program.
  • the system (operating system) power of the computer you want to use as a remote access computer is installed in either the virtual LAN card or NAT program. It is necessary to give up using it.
  • NAT program needs to access the device driver of the LAN card that is currently connected to the computer (to rewrite the contents of the TCP or UDP packet). This is because the mode program must exercise unauthorized system privileges.
  • the VPN system of the present invention includes the function of the user mode NAT program used in the user mode.
  • This user-mode NAT program greatly expands the operation of the conventional NAT program, combines several processes for each TCP / IP packet, and can be integrated with the VPN technology of the VPN system of the present invention. It has been done.
  • the NAT program that conventionally required the kernel mode can be realized in the user mode if there are certain restrictions.
  • kernel mode In a normal system, two types of programs, kernel mode and user mode, are operating.
  • the user does not need to use a program that needs to run in the kernel mode of the system, and does not use a user in the user mode.
  • a NAT program running in kernel mode
  • FIG. 27 is a conceptual diagram showing a system configuration for explaining the configuration and operation of the user NAT program in the embodiment of the present invention.
  • the user mode NAT program 500 in FIG. 27 has two interfaces for communication with an external network.
  • TCP / IP stack 530 Communication using TCP / IP stack 530 as one (first) interface, and communication using TCP / IP stack 570 as the other (second) interface.
  • the computer on which the user mode NAT program 500 is operating that is, the computer D used for remote access, is connected to the Internet via the existing network I / F 540.
  • This user mode NAT program 500 is always logically connected to a Virtual Hub 550 installed on another PC (such as on the Internet) (that is, an SE session is established).
  • encapsulation / decapsulation unit used in the virtual LAN card Functions for encapsulating / decapsulating virtual MAC frames (for example, the capsule unit 508 and decapsulation unit 504 configured by a program or hardware) are provided in the user mode NAT. ing.
  • Virtual Hub 550 (the same configuration as Virtual Hub 31 described so far) is connected to Virtual LAN card 560 on another computer via the Internet or the like.
  • User mode NAT500-operated computer that is, the computer D used for remote access, is connected to the corporate LAN via the existing network I / F580 (connected to the Internet via the corporate LAN.
  • existing network I / F540 and existing network I / F580 may be the same). That is, the user mode NAT 500, TCP / IP stack 530, network I / F 540, TCP / IP stack 570, and network I / F 580 are mounted on the computer D.
  • networks such as the Internet and corporate LAN.
  • the TCP / IP client program 560 running on a computer connected to the Virtual Hub 550 on the Internet is connected to the existing network I / F580.
  • the following describes the state in which a TCP / IP connection is established and communicated with the TCP / IP server program 590 running on the computer E (another PC (E)) connected to the same corporate LAN.
  • the original TCP / IP server program 590 is on the corporate LAN and on the Internet.
  • the TCP / IP client program 560 should not be accessible. However, the TCP / IP client program 560 can be accessed because the user mode NAT program 500 serves as a NAT.
  • the user mode NAT program 500 it is the encapsulation unit 508 and the decapsulation unit 504 that maintain the virtual and HUB550 SE sessions.
  • the user mode NAT program 500 is set in advance by the user.
  • VPN system of the present invention One virtual MAC address and one virtual IP address that can only be used in the system are set.
  • the TCP / IP client program 560 on another PC running the virtual LAN card tries to perform TCP / IP communication using the virtual IP address set in the user mode NAT program 500 as a gateway. (Ie try to send data).
  • the encapsulated stream data is transmitted from the virtual LAN mode of the PC on which the TCP / IP client program 560 is installed.
  • the Virtual HUB 550 performs a switching process of the IP packet sent from the TCP / IP client program 560 input via the SE session, and transfers it to the computer D on which the user mode NAT program 500 is operating.
  • This IP packet then arrives at computer D and is received by the operating system via the existing network I / F 540 and TCP / IP stack 530.
  • the user mode NAT program 500 receives the virtual MAC frame output from the TCP / IP stack 530.
  • the user mode NAT program 500 is set with a virtual MAC address and a virtual IP address used for transfer in the VPN system of the present invention.
  • ARP Address Resolution Protocol
  • the stream data received by the decapsulation release unit 504 is expanded into a plurality of virtual MAC frames 604 by the decapsulation unit 504.
  • the IP header analysis unit 503 refers to the input virtual MAC frame, and reads the information of the IP header when the transmitted packet (virtual MAC frame) is an IP packet. On the other hand, if the IP header protocol number is 503 (TCP), The packet is detected as a TCP packet and output to the TCP header analysis unit 502.
  • TCP IP header protocol number
  • the TCP header analysis unit 502 refers to the TCP header, extracts the information stored in the TCP header, and combines the information extracted by the IP header analysis unit 503 with the source IP address,
  • a logical TCP / IP connection is identified by a set of four types: source port number, destination IP address, and destination IP address.
  • a list of logical TCP / IP connections identified for each set of these four types of information is maintained. For each logical connection, the transmission data queue 510 and One receive data queue 509 is held in the program.
  • the TCP / IP header analysis unit 502 extracts the payload (text) of the received TCP packet 605 and outputs it to the data combining unit 501 as data 606.
  • the data combining unit 501 receives the divided data 606 (payload (text) of the received TCP packet 605) input from the TCP header analysis unit 502 as the sequence number of each TCP packet. (The sorting behavior is defined in the TCP / IP RFC specification).
  • the data combining unit 501 adds the stream to the transmission data queue 510 in order from the top.
  • the transmission data queue 510 is a buffer in which bit strings are arranged on a straight line, and is a queue having a data structure (first in first out) in which a bit string is added from the end and output from the head. is there.
  • the user mode NAT program 500 sequentially transmits the stream data from the head of the transmission data queue 510 to the TCP / Using IP stack 570, send to TCP / IP server program 590 that is waiting on computer E on the existing network (company LAN) that is specified as the destination of the logical TCP / IP connection. To instruct.
  • the already established TCP / IP connection is used.
  • the TCP / IP client program 560 runs on the remote access computer D.
  • the user mode NAT program 500 is another computer on a private network that cannot be normally accessed, such as a corporate LAN.
  • the above TCP / IP server can connect to the TCP port on which one program 590 is listening, and can send arbitrary data.
  • TCP / IP server program 590 on computer E sends the stream data to the TCP / IP client program 560 of the computer on the Internet using the established TCP / IP connection.
  • the processing to be performed will be described below.
  • the data transmission process the data transmission process from the TCP / IP client program 560 to the TCP / IP server program 590 described above, that is, a process almost opposite to the process in the user mode NAT 500 is performed.
  • the user mode NAT program 500 is the destination for establishing a direct TCP / IP connection.
  • the user mode NAT program 500 When stream data is input from the TCP / IP server program 590 on the computer E via the existing network I / F 580 and TCP / IP stack 570, the user mode NAT program 500 receives this stream data as received data. When the received data queue 509 contains received data of 1 byte or more, the user mode NAT program 500 finally operates the virtual LAN mode. It is sent as transfer data to a TCP / IP client program 560 on another PC via a logical TCP / IP connection.
  • the data division unit 505 starts the user mode from the top of the reception data queue 509.
  • the data 600 sequentially read by the NAT program 500 is divided into data smaller than the maximum size that can be transmitted as IP packets, as described in “Specifying the communication destination by TCP / IP connection” in FIG. Output as 601 to TCP header adder 506.
  • the TCP header adding unit 506 sets the source port number as the port number of the TCP / IP server program 590 on the computer E, and the destination port number as a TCP / IP client on another PC that operates the virtual LAN card.
  • Program 560 port number is attached to input data 601 and output as TCP packet 602 to IP header ZMAC header adding unit 507.
  • the IP header / MAC header adding unit 507 adds an IP header and a MAC header to the input TCP packet 602 (actually a plurality of packets), and creates a virtual MAC frame 603 as a power packet. Output to the conversion unit 508.
  • IP address of the computer running the TCP / IP server program 590 as the source IP address in the IP header
  • IP address of the computer running the TCP / IP client program 560 as the destination IP address Is attached.
  • the encapsulating unit 508 encapsulates the generated virtual MAC frame 603, and virtualizes it as an IP packet via the TCP / IP stack 530 and the network I / F 540.
  • the TCP / IP client program 560 receives the IP packet switched by the Virtual HUB 550 via the Internet via the virtual LAN card.
  • the retransmission control unit 520 stores transmission information such as the transmission time and the number of transmission trials in the internal storage unit as a transmission table for each TCP packet that has been transmitted once. Based on this transmission information, refer to the transmission table and resend TCP packets that have arrived, received, and possibly.
  • the maximum size is set by the user or fixed by a program.
  • the receiving apparatus receives data from the transmitting apparatus, the receiving apparatus must notify the transmitting apparatus by transmitting an "acknowledgment response". Les.
  • the user mode NAT program in the VPN system of the present invention also follows this specification.
  • reception window size advertisement an integer value called “reception window size advertisement” is included in the acknowledgment packet.
  • the value of “Receiving window size advertisement” is the value for general NAT or when NAT is not used at all.
  • the nodes at both ends that are doing the notification of the size of the free buffer called the current “Receiving window size”.
  • the advertisement value of the reception window size of the TCP packet for the node inside the NAT indicates the smaller one between the free size of the transmission data queue 510 and 65,536.
  • the user one-mode NAT program needs to implement most of the detailed requirements defined in other TCP / IP protocols.
  • Each logical connection managed by the user mode NAT program has a timeout, and this timeout period can be set by the user arbitrarily.
  • the user NAT program functions as a relay terminal having a virtual IP address that is effective in the external virtual network in remote access processing, etc., for example, an external virtual hub and an internal LAN (local With a terminal connected to the This is a virtual LAN card installed in this relay terminal when transferring data between them, and decapsulating the IP packet input by the Virtual Hub, extracting the virtual MAC frame, and extracting the virtual MAC frame after this release.
  • a virtual IP address that is effective in the external virtual network in remote access processing, etc.
  • an external virtual hub and an internal LAN local With a terminal connected to the This is a virtual LAN card installed in this relay terminal when transferring data between them, and decapsulating the IP packet input by the Virtual Hub, extracting the virtual MAC frame, and extracting the virtual MAC frame after this release.
  • a terminal that exists in an external virtual network that can communicate with an external Virtual Hub is a terminal connected to the internal LAN by being relayed by the external Virtual Hub and a user NAT program. It is possible to communicate with
  • the client software for example, virtual LAN force
  • the NAT program is premised on operating in the kernel mode.
  • a program for realizing the functions of the virtual LAN card, the virtual hub, and the user mode NAT is recorded on a computer-readable recording medium, and the program recorded on the recording medium is recorded on the computer.
  • the communication control processing in the virtual LAN card, virtual hub, and user mode NAT described above may be performed by loading the system and executing it.
  • the “computer system” here includes the OS and hardware such as peripheral devices.
  • “Computer system” includes a WWW system equipped with a home page provision environment (or display environment).
  • the “computer-readable recording medium” refers to a storage device such as a flexible disk, a magneto-optical disk, a portable medium such as ROM, CD-ROM, or a hard disk built in the computer system.
  • “computer-readable recording medium” means a volatile memory (RAM) in a computer system that becomes a server or client when a program is transmitted via a network such as the Internet or a communication line such as a telephone line. As described above, it is assumed that the program is held for a certain period of time.
  • RAM volatile memory
  • the program may be transmitted from a computer system storing the program in a storage device or the like to another computer system via a transmission medium or by a transmission wave in the transmission medium.
  • the “transmission medium” for transmitting a program refers to a medium having a function of transmitting information, such as a network (communication network) such as the Internet or a communication line (communication line) such as a telephone line.
  • the program may be for realizing a part of the functions described above.
  • the functions described above can be What can be realized in combination with programs already recorded in the system, so-called differential files (difference programs).

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Small-Scale Networks (AREA)
  • Data Exchanges In Wide-Area Networks (AREA)

Abstract

Ce système de réseau virtuel privé comprend un terminal client équipé d'une carte réseau virtuelle et d’une pile TCP/IP. La carte réseau virtuelle génère des trames MAC virtuelles, dans lesquelles l’adresse MAC de la carte réseau virtuelle d’une destination de transmission et sa propre adresse MAC en tant que source de transmission sont ajoutées à des données à transmettre, et convertit et encapsule les trames MAC virtuelles en données de flux. La pile TCP/IP génère un paquet IP destiné à l’adresse IP du concentrateur virtuel en divisant les données de flux et envoie le paquet IP à un réseau de communication d’informations. Le système de réseau virtuel privé comprend en outre un dispositif serveur comportant une table de mappage de numéros de port de connexion pour la commande de commutation et l’adresse MAC de la carte réseau virtuelle connectée. Le dispositif serveur comprend un concentrateur virtuel l’équipant qui restaure les données de flux lorsqu’il reçoit le paquet IP et qui transmet, avec référence aux adresses MAC de destination et de source de transmission, les données de flux dans le paquet IP au port de connexion correspondant à l’adresse MAC.
PCT/JP2004/018794 2004-12-16 2004-12-16 Système de réseau virtuel privé WO2006064561A1 (fr)

Priority Applications (1)

Application Number Priority Date Filing Date Title
PCT/JP2004/018794 WO2006064561A1 (fr) 2004-12-16 2004-12-16 Système de réseau virtuel privé

Applications Claiming Priority (1)

Application Number Priority Date Filing Date Title
PCT/JP2004/018794 WO2006064561A1 (fr) 2004-12-16 2004-12-16 Système de réseau virtuel privé

Publications (1)

Publication Number Publication Date
WO2006064561A1 true WO2006064561A1 (fr) 2006-06-22

Family

ID=36587626

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/JP2004/018794 WO2006064561A1 (fr) 2004-12-16 2004-12-16 Système de réseau virtuel privé

Country Status (1)

Country Link
WO (1) WO2006064561A1 (fr)

Cited By (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
WO2008019630A1 (fr) * 2006-08-15 2008-02-21 Huawei Technologies Co., Ltd. Procédé, réseau et dispositif nodal pour la retransmission de données dans un réseau à double couche
JP2012257069A (ja) * 2011-06-09 2012-12-27 Saxa Inc 電話システム
WO2016125554A1 (fr) * 2015-02-03 2016-08-11 日本電気株式会社 Système de réseau virtuel, procédé de commande de réseau virtuel, base de données de fonction de réseau virtuel, dispositif de commande intégré, dispositif de commande, procédé et programme de commande associés
CN107577543A (zh) * 2017-09-18 2018-01-12 郑州云海信息技术有限公司 数据读写方法、装置、存储系统及计算机可读存储介质
CN113507506A (zh) * 2021-06-23 2021-10-15 烽火通信科技股份有限公司 虚拟专用网络系统及其搭建方法、设备以及可读存储介质

Citations (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
JPH08298535A (ja) * 1995-04-27 1996-11-12 Nec Corp Ｏｓｉ通信システム

Patent Citations (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
JPH08298535A (ja) * 1995-04-27 1996-11-12 Nec Corp Ｏｓｉ通信システム

Non-Patent Citations (2)

* Cited by examiner, † Cited by third party
Title
HAKKO, SOFTBANK PUBLISHING INC.: "SoftEther no Shikumi o Saguru", DOS/V MAGAZINE, 15 February 2004 (2004-02-15), pages 190 - 191, XP003006187 *
NOBORI D.: "SoftEther ni yoru Ethernet no Kasoka to Tunneling Tsushin", DAI 45 KAI INFORMATION PROCESSING SOCIETY OF JAPAN PROGRAMMING SYMPOSIUM, 2004 NEN 1 GATSU HAKKO, 2004, pages 147 - 158, XP003006186 *

Cited By (11)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
WO2008019630A1 (fr) * 2006-08-15 2008-02-21 Huawei Technologies Co., Ltd. Procédé, réseau et dispositif nodal pour la retransmission de données dans un réseau à double couche
CN101127696B (zh) * 2006-08-15 2012-06-27 华为技术有限公司 二层网络中的数据转发方法和网络及节点设备
US8804713B2 (en) 2006-08-15 2014-08-12 Huawei Technologies Co., Ltd. Method and system for forwarding data in layer-2 network
US9100351B2 (en) 2006-08-15 2015-08-04 Huawei Technologies Co., Ltd. Method and system for forwarding data in layer-2 network
JP2012257069A (ja) * 2011-06-09 2012-12-27 Saxa Inc 電話システム
WO2016125554A1 (fr) * 2015-02-03 2016-08-11 日本電気株式会社 Système de réseau virtuel, procédé de commande de réseau virtuel, base de données de fonction de réseau virtuel, dispositif de commande intégré, dispositif de commande, procédé et programme de commande associés
JPWO2016125554A1 (ja) * 2015-02-03 2017-11-09 日本電気株式会社 仮想ネットワークシステム、仮想ネットワーク制御方法、仮想ネットワーク機能データベース、統合制御装置、制御装置およびその制御方法と制御プログラム
US11665061B2 (en) 2015-02-03 2023-05-30 Nec Corporation Virtual network system, virtual network control method, virtual network function database, orchestration apparatus, control apparatus, and control method and control program of control apparatus
CN107577543A (zh) * 2017-09-18 2018-01-12 郑州云海信息技术有限公司 数据读写方法、装置、存储系统及计算机可读存储介质
CN113507506A (zh) * 2021-06-23 2021-10-15 烽火通信科技股份有限公司 虚拟专用网络系统及其搭建方法、设备以及可读存储介质
CN113507506B (zh) * 2021-06-23 2022-07-29 烽火通信科技股份有限公司 虚拟专用网络系统及其搭建方法、设备以及可读存储介质

Similar Documents

Publication Publication Date Title
US8250643B2 (en) Communication device, communication system, communication method, and program
CN112583647B (zh) 用于针对有线和无线节点的公共控制协议的方法和设备
US9154512B2 (en) Transparently proxying transport protocol connections using an external server
CN102238230B (zh) 用于在云计算中卸载隧道数据包的方法和系统
US8473620B2 (en) Interception of a cloud-based communication connection
JP3343064B2 (ja) フレームを捕獲、カプセル化及び暗号化するための擬似ネットワークアダプタ
US6708218B1 (en) IpSec performance enhancement using a hardware-based parallel process
EP1333642B1 (fr) Procédé et appareil d'integration de fonctions d'augmentation de performance dans un réseau privé virtuel (RPV)
US7526577B2 (en) Multiple offload of network state objects with support for failover events
EP1844402B1 (fr) Techniques permettant la migration d'un protocole point à point a un protocole pour réseau d'accès
EP2362586B1 (fr) Système et procédé pour la communication de données entre un terminal utilisateur et une passerelle via un noeud de réseau
CN108601043B (zh) 用于控制无线接入点的方法和设备
US20040243703A1 (en) Cooperative proxy auto-discovery and connection interception
EP1443731A2 (fr) Procédé et système permettant d'assurer la sécurité dans un éeseau avec l'amélioration de la performance
EP1443713A2 (fr) Procédé et système pour utiliser les raccordements privés virtuels du réseau (VPN) dans un réseau à performance améliorée
AU2007320794B2 (en) Selective session interception method
JP2005085284A (ja) フェイルオーバーイベントをサポートするネットワーク状態オブジェクトの多重オフロード
WO2006064561A1 (fr) Système de réseau virtuel privé
US7969998B2 (en) Method and system for tunneling data using a management protocol
US7761508B2 (en) Access device-based fragmentation and interleaving support for tunneled communication sessions
KR102736167B1 (ko) 분리망 환경에서 대용량 파일 데이터 단방향 고속 전송 시스템
JP2002271417A (ja) トンネリング装置
JP2006279771A (ja) パケット伝送方式およびパケット伝送プログラム
CN116320074A (zh) 基于tcp协议的访问方法、装置及电子设备
Napier SECURING VIRTUAL PRIVATE NETWORKS

Legal Events

Date Code Title Description
AK Designated states

Kind code of ref document: A1

Designated state(s): AE AG AL AM AT AU AZ BA BB BG BR BW BY BZ CA CH CN CO CR CU CZ DE DK DM DZ EC EE EG ES FI GB GD GE GH GM HR HU ID IL IN IS JP KE KG KP KR KZ LC LK LR LS LT LU LV MA MD MG MK MN MW MX MZ NA NI NO NZ OM PG PH PL PT RO RU SC SD SE SG SK SL SM SY TJ TM TN TR TT TZ UA UG US UZ VC VN YU ZA ZM ZW

AL Designated countries for regional patents

Kind code of ref document: A1

Designated state(s): BW GH GM KE LS MW MZ NA SD SL SZ TZ UG ZM ZW AM AZ BY KG KZ MD RU TJ TM AT BE BG CH CY CZ DE DK EE ES FI FR GB GR HU IE IS IT LT LU MC NL PL PT RO SE SI SK TR BF BJ CF CG CI CM GA GN GQ GW ML MR NE SN TD TG

121 Ep: the epo has been informed by wipo that ep was designated in this application
NENP Non-entry into the national phase

Ref country code: DE

122 Ep: pct application non-entry in european phase

Ref document number: 04807153

Country of ref document: EP

Kind code of ref document: A1

点击 这是indexloc提供的php浏览器服务，不要输入任何密码和下载