JPH0595372A - Access check circuit - Google Patents

Abstract

PURPOSE:To check whether a transfer is permitted for a packet to be inputted in a packet switching or a packet to be outputted. CONSTITUTION:A transmission origin address and a destination address for which transfer are preliminarily permitted are set in an associative memory circuit 4. An address extraction circuit 2 extracts the transmission origin address and the destination address from a packet and endows a comparison control circuit 3 with them. The comparison control circuit 3 checks the presence or absence of the coincidence after these two addresses is endowed to the associative memory circuit 4 as comparison data. If the associative memory circuit 4 outputs a signal showing the coincidence, the packet is to have the permitted address. The comparison control circuit 3 notifies it to a gate circuit 5 by a permission signal 12. The packet is inputted in a packet switch 7 via the gate circuit 5. The same operation is performed for the output from the packet switch 7.

Description

Detailed Description of the Invention

[0001]

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to an access check circuit for checking whether or not a user has permitted access to a packet data communication network.

[0002]

2. Description of the Related Art FIG. 3 is a block diagram showing an example of a conventional access check circuit. The access check circuit of this conventional example includes a transfer control circuit 20 connected to the communication line 1,
The memory circuit 21 temporarily stores packets, and the processor 22 that performs an address check on the packets on the memory circuit 21.

In FIG. 3, the packet input from the upstream communication line 1 is transferred to the memory circuit 21 by the transfer control circuit 20. The transferred packet is checked by the processor 22 whether the destination address inside the packet is valid, and if the packet has a destination address to which access is permitted, the transfer control circuit 20 causes the memory circuit 21 to send the packet. Read the packet switch 7
Is output to the input line 6 which is an input to the. The packet switch 7 performs packet switching on the input packet in accordance with the destination address and outputs the packet to the output line 8.

[0004]

In the above-mentioned conventional access check circuit, since it is checked by the software processing of the processor whether or not the destination address of the packet is permitted, the packet of the communication line is not checked. When the transfer speed becomes high, there is a disadvantage that the software processing by the processor cannot catch up with the access check. Further, since it is checked whether or not the access is permitted only to the destination address, there is a drawback that the access violation cannot be detected for the packet sent from the user who is not permitted to send the packet to the packet switch.

[0005]

The access check circuit of the present invention accommodates a plurality of communication lines to which a packet including a destination address and a source address is transferred, and exchanges each packet corresponding to the destination address. An access check circuit for checking whether the address of the packet on the communication line of the packet switch is permitted, the source address being permitted for the packet input from the communication line, and the A first associative memory circuit that stores each of the destination addresses in advance, and the associative memory circuit that extracts and gives the source address and the destination address from the packet that passes through the communication line to the first associative memory circuit. The result of the comparison by the above shows that a match is obtained in both the source address and the destination address that are permitted. If only and a first control means for outputting the packet to the packet switch.

In addition to the above access check circuit, a second associative memory which stores a source address and a destination address which permit output of a packet output from the packet switch and output to the communication line The source address and the destination address are extracted from the memory circuit and the packet output from the packet switch and given to the second associative memory circuit for comparison, and both source address and destination address match. And second control means for outputting the packet to the communication line only when

[0007]

DESCRIPTION OF THE PREFERRED EMBODIMENTS Next, the present invention will be described with reference to the drawings. 1 is a block diagram showing an embodiment of the access check circuit of the present invention, FIG. 2 is a diagram showing the access check operation in FIG. 1, (A) is a block diagram, and (B) is a signal of FIG. Is a time chart of.

The access check circuit of this embodiment is composed of an address extraction circuit 2, a comparison control circuit 3, an associative memory circuit 4, and a gate circuit 5 for the upstream communication line 1. Further, there is an access check circuit including the same constituent elements to which the same number is assigned to the downlink communication line 14.

A packet including therein a destination address indicating the destination of data and a source address indicating the source of data flows from the upstream communication line 1. The address extraction circuit 2 identifies and extracts the destination address and the source address in the packet, and sequentially outputs them to the packet address signal 9 connected to the comparison control circuit 3. The comparison control circuit 3 that has received the source address and the destination address outputs the comparison signal 10 connected to the associative memory circuit 4 in a format in which the address identifier 15 is added. Associative memory circuit 4
The source and destination addresses that can be permitted for packet transfer are set internally in advance, and the comparison and collation operation of the input comparison signal 10 and the internally set address group is performed to determine the match. The coincidence signal 11 indicating the presence or absence is output as the comparison result. Here, the associative memory circuit 4 is composed of a combination of a sequential circuit and a memory, and at least one finite number of symbol strings can be written and registered. The registered symbol string is compared and collated, and if any one or more of the registered symbol strings are matched, a match signal 11 indicating the match is output. If the packet input from the upstream communication line 1 is a packet from a permitted transmission source and is a packet to a permitted destination, a match is obtained by comparing both the source address and the destination address, and a match signal 11 Is output to. The comparison control circuit 3 outputs the permission signal 12 to the gate circuit 5 as a value indicating permission when the coincidence signal 11 has a value indicating the coincidence. If the permission signal 12 has a value indicating permission, the gate circuit 5 accepts the input packet as it is from the input line 6 of the packet switch 7.
Is output to, and is not output if the value indicates disapproval.

The packet input to the packet switch 7 is switched so as to be transferred to the user corresponding to the destination address of the packet. The packet output from the output line 8 of the packet switch 7 after the packet switching is executed, the source and destination addresses are checked again by the access check circuit provided for the downlink communication line 14, and the permitted address If the packet has the following, it is output to the downlink communication line 14 via the gate circuit 5. As shown in FIG. 1, the circuit for access check performs the same operation as the circuit provided in the upstream communication line 1.

Next, in FIG. 2, the address of the packet permitted to be transferred on the communication line in which the associative memory circuit 4 is provided is stored in the associative memory circuit 4. That is, addresses of a plurality of users who are allowed to send packets to the communication line are set as the permitted transmission source address group 16. For each address, one address is set in one word, and an identifier 15 indicating that the address is a source address
a is added and set at a predetermined bit position in the word direction. Similarly, a destination address permitted to be sent out from the communication line is set as a permitted destination address group 17 by adding an identifier 15b having a value indicating the destination address. Here, the destination address is not limited to an individual destination address indicating only one user, but may be a group address in which a group of a plurality of users is expressed by one address. When a packet is given a group address and then transmitted, it is premised that the packet switch 7 duplicates and outputs a plurality of packets corresponding to a plurality of users.

As shown in the time chart of FIG. 2B, the comparison control circuit 3 sequentially outputs the source address and the destination address on the comparison signal 10. At this time, in order to enable discrimination between the source address and the destination address, the comparison signal 1
An identifier is added to 0 and output. The value of the identifier is output so as to correspond to the value of the identifiers 15a and 15b set in the associative memory circuit 4. If the value of the identifier is different, a match cannot be obtained even if the following addresses have the same value. Therefore, the source address is verified by this identifier in the source address group 16 and the destination address is permitted. The collation is performed in the destination address group 17.

The associative memory circuit 4 performs a collating operation for each of the source address and the destination address, and outputs the result to the coincidence signal 11. If both the source address and the destination address are permitted addresses, a match can be obtained for each, so that it can be determined. On the other hand, if the packet is not permitted, no match is obtained and, as a result, the permission signal 12 to the gate circuit 5 shown in FIG. 1 is not output and the packet is not input to the packet switch 7.

[0014]

As described above, the access check circuit of the present invention uses the associative memory circuit,
It is possible to check whether access is permitted to both the source address and the destination address. Further, since access checking is entirely realized by hardware operation, it is possible to check packets flowing on the communication line at high speed.
Therefore, as compared with the conventional access check method in which the access check is performed only by the destination address by software, it is possible to check the line at a higher speed and further to the packet network of the user having the unauthorized address. It has an effect that access can be prevented.

[Brief description of drawings]

FIG. 1 is a block diagram showing an embodiment of an access check circuit of the present invention.

FIG. 2 is a diagram showing an access check operation in FIG.

FIG. 3 is a block diagram showing an example of a conventional access check circuit.

[Explanation of Codes] 1 upstream communication line 2 address extraction circuit 3 comparison control circuit 4 associative memory circuit 5 gate circuit 6 input line 7 packet switch 8 output line 9 packet address signal 10 comparison signal 11 match signal 12 enable signal 13 processor interface 14 Downlink communication lines 15a, 15b Identifier 16 Allowed source address group 17 Allowed destination address group 20 Transfer control circuit 21 Memory circuit 22 Processor

Claims (2)

[Claims] 1. A packet switch on a communication line of a packet switch for accommodating a plurality of communication lines to which a packet including a destination address and a source address is transferred, and performing switching for each packet corresponding to the destination address. An access check circuit for checking whether or not the address is permitted, the first association in which each of a source address and a destination address permitted for the packet input from the communication line is stored in advance. A memory circuit and a source address for which the result of the comparison by the associative memory circuit is permitted, which is obtained by extracting the source address and the destination address from the packet passing through the communication line to the first associative memory circuit; Outputs the packet to the packet switch only when both destination addresses match. An access check circuit comprising: first control means. 2. A second associative memory circuit for storing a source address and a destination address for permitting output of a packet output from the packet switch and output to the communication line, and output from the packet switch. The source address and the destination address are extracted from the stored packet and are given to the second associative memory circuit for comparison. Only when the source address and the destination address are coincident with each other, the packet is extracted. The access check circuit according to claim 1, further comprising second control means for outputting to the communication line.