JPH09214540A - Network and its group management method - Google Patents

Abstract

(57) [Summary] [Problem] In a group communication method of a network in which a plurality of terminals are divided into groups and communication is performed between the groups, it is possible to flexibly set groups of terminals.
Allows group communication without obstacles. A terminal sends out a signal including a source address and a destination address and a protocol type.
Based on this protocol type information, it is determined whether or not the communication partner of the other party belongs to the same group, and if communication is possible by belonging to the same group, the routing processing means performs routing of that group to establish connection.

Description

Detailed Description of the Invention

[0001]

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to a group management system in a network in which a plurality of computer terminals or servers are connected and these terminals are divided into groups for communication between the groups. In particular, it relates to a method in which computer terminals and servers having the same communication protocol are divided into groups, and terminals belonging to the same group communicate with each other. The present invention can be used in local area networks, wide area networks and other networks.

[0002]

2. Description of the Related Art Conventionally, when a plurality of registered users communicate with a plurality of computer terminals or with an information server, conventionally, all terminals log in to a modem server or a management server for authentication. Was taken. This method has a problem that the load is concentrated on the modem server and the management server, and the responsiveness deteriorates when the number of users who access at the same time increases. Further, when trying to handle a plurality of network layer protocols, there is a problem that versatility is poor because an authentication server corresponding to each protocol must be prepared.

To solve these drawbacks, the literature. "R
egional PC Communication Network for Residential Us
e Supported by Fiber PC Optic Access Systems "(K.Ir
ie, N.Ohta, M.Morisaki and H.Tsuji / International W
orkshop on Community Network, 1995/6) is the MAC address (Media Acces
s Control address) and IP address (Internet P
We have proposed a method that realizes group communication by preparing a multi-protocol brouter that has a function to authenticate rotocol address) and performing routing according to address information. A multi-protocol brouter is a device that has both a bridge function that passes Ethernet packets and a router function that routes IP packets of Ethernet packets. It supports packet routing for multiple protocols and unrecognized protocol packets. On the other hand, it has a function of performing bridge processing.

In the method of the above-mentioned document, the packet data from the computer terminal is routed in the middle layer by the multi-protocol brouter without passing through the management server, thereby reducing the load on the management server, high-speed routing and a plurality of routings. It is possible to provide various services using the protocol.

The configuration of a group communication system based on the method described in this document will be described with reference to FIG.

Computer terminals 2-11, 2-1n, 2
-1m is the adapter 3-11, 3-1n, 3
-1 m, subscriber's line termination unit (ONU) 3-21,
3-2n, 3-2m, respectively, through the network side line terminator (SLT) 3-31, 3-3n, 3-
It is connected to 3m via a communication line. Network side line terminator (SLT)) 3-31, 3-3n, 3
-3m is adapter 3-41, 3-4n, 3-
It is connected to the multi-protocol brouter 1-1 via 4 m. The management server 1-2, the information server 1-3, and the multi-protocol brouter 1-1 are mutually connected.

On this group communication network, MAC is used for any network layer protocol.
Since the authentication can be performed by routing based on the address (corresponding to the second layer data link layer address in the OSI reference model), the versatility is high and it corresponds to a plurality of network layer protocols (corresponding to the third layer protocol in the OSI reference model). , TCP / IP, Apple Talk, IPX / SP
X, OSI, etc.) can be used simultaneously on the network.

These protocols use terminal addresses (OS
The I reference model is classified into two types according to the determination method of the network layer address of the third layer). TCP /
A protocol such as IP, IPX / SPX, and OSI in which uniqueness of addresses is guaranteed in all terminals (called terminals including not only computer terminals but also information servers) (hereinafter referred to as type A protocol) and Apple Talk There are two types of protocols (hereinafter referred to as B-type protocol) that randomly determine the terminal address. The A-type protocol is superior in terms of network utilization efficiency,
The B-type protocol has an advantage that it is easy to handle because it is not necessary to assign an address to a terminal in advance.

In the B-type protocol, the address of the terminal is randomly determined when the power of the terminal is turned on. The activated terminal randomly determines its own address, and then broadcasts the data link layer packet to inform the other terminal of the address, and confirms whether the address has already been used by the other terminal. If it has already been used, a different address will be randomly decided again,
The process of confirming by broadcast packet is repeated. This guarantees the uniqueness of the address. This method is designed on the assumption that the address may be duplicated with the terminal that the broadcast packet does not reach.

Therefore, in the method of the above-mentioned document, when a protocol other than TCP / IP flows on the group communication network, in the routing based only on the data link layer address (corresponding to the second layer address in the OSI reference model), A failure occurs in group communication of terminals using the B-type protocol.

[0011]

As shown in FIG. 2, there are three or more terminals that use the B-type protocol, and there are two or more groups, one of the terminals (see FIG. 2 terminal 2) belongs to two groups, group α and group β, but the other terminals belong to different groups (in FIG. 2, terminal 1 belongs only to group α and terminal 3 belongs only to group β). It belongs). At this time, the broadcast of the terminal 1 in the group α is the terminal 2
, But does not reach the terminal 3 (because the terminal 3 does not belong to the group α), the broadcast of the terminal 3 similarly reaches the terminal 2 but does not reach the terminal 1.

Therefore, there is a possibility that the terminal 1 and the terminal 3 may give the same network layer address to themselves.
When the addresses are duplicated, the terminal 2 cannot communicate with both the terminals 1 and 3 but cannot distinguish the addresses from each other, which causes a communication failure.

In order to solve this obstacle, it is effective to restrict the terminals using the B-type protocol so that they do not belong to two or more groups at the same time. However, in the method of the above-mentioned document, since the routing is performed only by the data link layer address, the information transmitted from the same terminal is filtered according to the same routing rule. For example, as shown in FIG. 4, there are four terminals, the terminals 1 and 2 belong to one group α and are allowed to communicate freely using the B-type protocol, and the terminals 3 and 4 are also different groups β. If you want to perform communication using the B-type protocol while belonging to the above, but you want to put security into a group different from the terminal 1 and the terminal 3, you have to do grouping as shown in FIG. Even if the terminal 2 and the terminal 3 try to communicate with each other in the A-type protocol in this state, if the terminal 2 and the terminal 3 try to belong to the same group γ,
Due to the restriction of B type protocol, a failure occurs,
Such group settings are not allowed.

As described above, even when a terminal using the A-type protocol is used, only one group can belong to the group, resulting in a great loss of convenience of group communication.

FIG. 3 shows the structure of the filtering information table provided in the management server or the multi-protocol brouter in the prior art, and FIG. 5 shows which part of the Ethernet packet is used for authentication in the prior art. FIG. 6 is a diagram for explaining whether or not a source address and a destination address are conventionally used for group authentication.

The present invention solves such a problem. In a network in which a plurality of protocols other than TCP / IP coexist, the group is managed according to the protocol type and the flexibility of group accommodation is ensured. The purpose is to guarantee the uniqueness of addresses within a group and to provide group communication without failure.

[0017]

SUMMARY OF THE INVENTION In order to solve the above problems, the present invention has a function of managing a group and filtering packets according to a protocol type as well as a data link layer or network layer address of a terminal. The main feature is to give to.

That is, a first aspect of the present invention relates to a network configuration, in which a plurality of terminals, a management server, and a multi-protocol brouter having a routing and bridge function are connected, and the terminals are registered in advance in the management server. In a local area network provided with means for communicating with terminals in the same group via the multi-protocol brouter based on a predetermined communication protocol, the terminals have a protocol indicating a protocol type together with a source address and a destination address. Means for transmitting a signal including information, means for analyzing the source address, the destination address, and the protocol information, and means for determining whether or not the destination terminal belongs to the same group based on the protocol information Comprising the multi Lot Kolb router performs connection by case of the group protocol belonging to the same group, in the case of different groups, characterized in that it comprises a means not connect.

It should be noted that the management server has a filtering information table indicating to which group the terminal belongs, a means for analyzing the source address, the destination address and the protocol information, and a destination terminal based on the protocol information. And means for determining whether they belong to the same group.

Further, the multi-protocol brouter is
A filtering information table indicating which group the terminal belongs to, a means for analyzing the source address, the destination address and the protocol information, and whether the destination terminal belongs to the same group according to the protocol information from the terminal. And means for determining

A second aspect of the present invention relates to a group management method in a local area network, in which a terminal transmits a signal including protocol information indicating a protocol type together with a source address and a destination address,
Analyzing the source address and the destination address and the protocol information, it is determined whether the destination terminal belongs to the same group by the protocol information, and if the destination terminal belongs to the same group, connect by the protocol of the group, In the case of different groups, the group management is performed so as not to connect.

Differences from the prior art of the present invention are as follows: (1) In the prior art, only the address of the terminal (data link layer or network layer) was used for group management. In addition, the group is managed by using the protocol type as well. (2) In the conventional technology, only two terminals, the communication sending terminal and the destination terminal, are identified and authenticated, whereas in the present invention, in addition to the terminal There are two points: to identify the network layer protocol type.

In order to realize (1), in the present invention, information of "usable protocol type" is newly added to the filtering information table referred to for filtering packets. As a result, the conventional filtering information table as shown in FIG. 3 becomes as shown in FIG. 6, and the usable protocol type can be set for each group.

In order to realize (2), in the present invention, the header of the data link layer packet is read up to the field indicating the protocol type in addition to the fields of the source address and the destination address. For example, Ethernet type III (Ethernet Type III
), The frame type field (f
Since the rame type) is represented by the protocol type, in the prior art, only the portion shown in FIG. 5 was read, whereas the present invention reads the portion shown in FIG.

There are two types of authentication of the terminal address and the protocol type: a case where a communication start packet is sent to the management server for authentication, and a case where the packet passed by the multi-protocol brouter is intercepted. The latter has the advantage that the response is simplified because it does not require the exchange of information between the computer terminal and the management server, but its size is large because the multi-protocol brouter must hold the filtering information table. The difference is that a storage capacity and a search processing capacity commensurate with the above are required.

[0026]

Embodiments of the present invention will be described below with reference to the drawings.

(First Embodiment) FIG. 1 shows a configuration example of a group communication system according to an embodiment of the present invention. The system hardware configuration is the same as the conventional example, but the authentication method is different from the conventional example.

First, the system configuration will be described.

Reference numeral 1-1 is a multi-protocol brouter which has a plurality of input / output ports (individual ports or multiplexed logical ports) and performs routing or switching between ports corresponding to a plurality of protocols. . Reference numeral 1-2 is a management server, and reference numeral 1-3 is an information server. The adapters 3-11 to 3-1n and 3-1m convert signals from the Ethernet terminals of the computer terminals 2-11 to 2-1n and 2-1m into digital line interfaces. Reference numerals 3-21 to 3-2n, 3-
3 m is a line terminating device on the subscriber side (for example, ONU: Optica)
l Network Unit / DSU: Digital Service Unit). Further, reference numerals 3-31 to 3-3n and 3-3m denote network side line terminating devices (SLT: Subscriber Line Tes).
rminal). Also, reference numerals 3-41 to 3-4n and 3-
4m is an adapter for converting a signal from the communication line into an Ethernet signal. Subscriber side line terminator (3-3
1 to 3-3n and 3-3m) are called ONU when the communication medium is an optical fiber, and DSU when the communication medium is a metal (for example, twisted pair wire or coaxial cable). In the present invention, the communication medium is not limited by the optical fiber / metal, but the ONU will be described in the following description.

In the present embodiment, a plurality of terminals (including computer terminals 1-11 to 2-1m and information server 1-3).
The management server 1-2 and the multi-protocol brouter 1-1 having a routing and bridge function are connected, and the terminal is based on a predetermined communication protocol with the terminal of the same group registered in advance in the management server 1-2. In a network having means for communicating via the multi-protocol brouter 1-1, the terminal has means for transmitting a signal including protocol information indicating a protocol type together with a source address and a destination address,
The management server 1-2 includes means for analyzing a source address, a destination address and protocol information, and means for determining whether or not the destination terminals belong to the same group based on the protocol information. Is characterized in that it includes means for performing connection according to the protocol of the group when belonging to the same group, and not performing connection for different groups.

The operation of this embodiment will be described below.

The bruta is a device having both a bridge function for passing an Ethernet packet and a router function for routing an IP packet on the Ethernet packet. The multi-protocol brouter 1-1 is a packet corresponding to a plurality of protocols. The routing process and the bridging process are performed for the packet of the unrecognized protocol. In the initial state, each computer terminal 2-11 to 2-1m is given only the address information of the management server 1-2 as a communication partner, and even in the multi-protocol brouter 1-1, the packet from each computer terminal is not transmitted. All are set to be transferred to the management server 1-2.

Therefore, for example, the computer terminal 2-
Computer terminal 2-11 when 11 starts communication.
Data from the Ethernet terminal is sent to the adapter 3-11 as an Ethernet packet, and the adapter 3-11
Is passed to the line terminating device (ONU) 3-21 on the subscriber side via the. From the line terminating device (ONU) 3-21 to the network side line terminating device (S
LT) 3-31, and is returned to the Ethernet packet by the adapter 3-41. After that, the Ethernet packet is sent to the management server 1-2 connected to the destination via the multi-protocol brouter 1-1. In the present embodiment, the management server 1-2 is accessed only when this communication is started, and when the communication with the other party is started thereafter, the management server 1-2 is not accessed.

This will be described with reference to FIGS. 9 to 12.

For example, when the computer terminal 2-11 starts communication with the information server 1-3, the data from the computer terminal 2-11 is first sent from the Ethernet terminal to the adapter 3-11 as an Ethernet packet, and the adapter 3-11. Line termination unit (ONU) on the subscriber side via -11
3-21, and the line termination unit (ONU) 3-
21 is sent to the line terminating device (SLT) 3-31 on the network side via the digital communication line, and then returned to the Ethernet packet by the adapter 3-41 connected to the end (FIG. 9). This Ethernet packet is sent to the management server 1-2 connected to the destination via the multi-protocol brouter 1-1 (FIG. 10). The management server 1-2 analyzes the header information of the Ethernet packet,
The source is the computer terminal 2-11, the destination is the information server 1-3, and the type of the third layer protocol stored in the Ethernet packet is read. The management server 1-2 searches the filtering information table to check whether the computer terminal 2-11 can communicate with the information server 1-3 by this protocol. If possible, the multi-protocol brouter 1-1 is instructed to set the routing so that packets can be exchanged between the computer terminal 2-11 and the information server 1-3 (FIG. 11). This allows multi-protocol bruta 1
-1 sets a routing path, and the computer terminal 2-11 can communicate with the information server 1-3 (FIG. 1).
2).

In this embodiment, the management server 1
-2 is accessed only at the start of this communication,
After that, when communication with the other party is started, the communication is performed without going through the management server 1-2. This method is effective when connection-type communication is performed between specific terminals because the load for authentication is generated only at the start of communication. However, for an application that performs packet communication without establishing a connection (for example, UDP in TCP / IP), it is necessary to exchange information with the management server for each packet, which causes a large overhead. Hold. Especially in an environment where a lot of broadcast packets are used, this overhead increases the load.

(Second Embodiment) Next, a group communication system according to a second embodiment of the present invention will be described. The second embodiment is characterized in that the multi-protocol brouter 1-1 has a terminal authentication function. That is, when the multi-protocol brouter 1-1 analyzes the filtering information table indicating which group the terminal belongs to, the source address, the destination address, and the protocol information, the destination terminal receives the signal including the protocol information from the terminal. It includes means for determining whether or not they belong to the same group, and means for performing connection according to the protocol of the group when they belong to the same group, and not performing connection for different groups. In this method as well, the hardware configuration of the system is the same as that in FIG. 1, but the multi-protocol brouter has a terminal authentication function instead of the management server, and the management server only manages and updates the filtering information table.

The operation of the second embodiment will be described below with reference to FIGS.

In this embodiment, the computer terminals 2-11 to 2-1m do not access the management server 1-2. Computer terminals 2-11 to 2-1m
When the multi-protocol brouter 1-1 receives the information packet sent out for communication, the source / destination address of the packet and the protocol type are detected, and it is determined whether the communication is possible by comparing with the filtering information table, Pass or drop the packet. Therefore, the multi-protocol brouter 1-1 has a filtering information table inside, and updates this table according to an instruction from the management server 1-2.

For example, when the computer terminal 2-11 starts communication with the information server 1-3, the data from the computer terminal 2-11 is first sent from the Ethernet terminal to the adapter 3-11 as an Ethernet packet.
Subscriber's line termination unit (ONU) 3 via adapter
-31, and is sent from the line terminating device (ONU) 3-31 to the network side line terminating device (SLT) 3-31 via the digital communication line, and then the adapter 3-41.
Then, it is returned to the Ethernet packet (FIG. 13). Multi-protocol brouter 1-1 that received this Ethernet packet
Reads the source and destination addresses of the Ethernet packet header and the protocol type (see FIG. 1).
4). Referring to the filtering information table from this result, if the computer terminal 2-11 and the information server 1-3 belong to the same group and can communicate with each other,
The packet is sent to the destination (FIG. 15). If the packets do not belong to the same group, the packet is discarded. Unlike the first embodiment, this authentication is performed for each packet. Therefore, even when the second packet is subsequently sent from the computer terminal 2-11, the processing from FIG. 13 to FIG. 15 is repeated. Packets sent from the information server 1-3 to the computer terminal 2-11 are also processed in the same way, although the packet flow direction is opposite (FIG. 1).
6).

When the group to which the subscriber belongs is changed,
When there is a new subscriber or when a new terminal is added, the filtering information table of the multi-protocol brouter 1-1 must be updated, and the management server 1-2 performs the processing. . When the change of the subscriber information is input, the management server 1-2 generates a new filtering information table accordingly, transfers it to the multi-protocol brouter 1-1, and instructs the update (FIG. 17).

In any of the above-described embodiments, according to the present invention, the group γ setting request as shown in FIG. 4 is prepared by preparing a group for each protocol type as shown in FIG. can do. That is, the group α to which the terminals 1 and 2 belong and the group β to which the terminals 3 and 4 belong are the B-type protocol group, the terminal 2
The group γ to which the terminal 3 belongs can be accommodated in the form of an A-type protocol group. This allows the terminals 2 and 3 to communicate by the A-type protocol while grouping the terminals 1 and 3 into groups.

[0043]

As described above, according to the present invention,
By reading the type of the network layer protocol from the information packet in group communication and performing grouping routing according to it, even when protocols of different types other than TCP / IP are mixed, while ensuring flexibility of group accommodation, It is possible to guarantee the uniqueness of addresses within a group and provide group communication without trouble.

[Brief description of drawings]

FIG. 1 is a system configuration diagram of a group communication system.

FIG. 2 is a diagram illustrating an example in which a communication failure occurs in a B-type protocol in conventional group communication.

FIG. 3 is a configuration diagram of a filtering information table in a conventional technique.

FIG. 4 is a diagram illustrating a group accommodation method of a B-type protocol in the related art.

FIG. 5 is a diagram illustrating which part of an Ethernet packet is used for authentication in the related art.

FIG. 6 is a configuration diagram of a filtering information table according to the present invention.

FIG. 7 is a diagram illustrating a method of grouping and distributing A-type and B-type protocols using the present invention.

FIG. 8 is a diagram illustrating which part of an Ethernet packet is used for authentication in the present invention.

FIG. 9 is a diagram illustrating a processing procedure when the management server of the present invention has an authentication function.

FIG. 10 is a diagram illustrating a processing procedure when the management server of the present invention has an authentication function.

FIG. 11 is a diagram illustrating a processing procedure when the management server of the present invention has an authentication function.

FIG. 12 is a diagram illustrating a processing procedure when the management server of the present invention has an authentication function.

FIG. 13 is a diagram illustrating a processing procedure when the multi-protocol brouter of the present invention has an authentication function.

FIG. 14 is a diagram illustrating a processing procedure when the multi-protocol brouter of the present invention has an authentication function.

FIG. 15 is a diagram illustrating a processing procedure when the multi-protocol brouter of the present invention has an authentication function.

FIG. 16 is a diagram illustrating a processing procedure when the multi-protocol brouter of the present invention has an authentication function.

FIG. 17 is a diagram illustrating a processing procedure when the multi-protocol brouter of the present invention has an authentication function.

[Explanation of symbols]

1-1 Multiprotocol Brouter 1-2 Management Server 1-3 Information Server 2-11 to 2-1n, 2-1m Computer Terminal 3-21 to 3-2n, 3-2m Line Termination Device (ON
U) 3-31 to 3-3n, 3-3m Line termination device (SL)
T) 3-11 to 3-1n, 3-1m, 3-41 to 3-4n,
3-4m adapter

Claims (4)

[Claims] 1. A plurality of terminals, a management server, and a multi-protocol brouter having a routing and bridging function are connected, and the terminals are based on a predetermined communication protocol with terminals of the same group registered in advance in the management server. In the network including means for performing communication via the multi-protocol brouter, the terminal includes means for transmitting a signal including protocol information indicating a protocol type together with a source address and a destination address, and the source address and A means for analyzing the destination address and the protocol information, and means for determining whether or not the destination terminal belongs to the same group by the protocol information, the multi-protocol brouter, when belonging to the same group The group It makes a connection by Tokoru, in the case of different groups network comprising means for not connect. 2. The management server, a filtering information table indicating which group the terminal belongs to,
The network according to claim 1, further comprising: a unit that analyzes the source address, the destination address, and the protocol information, and a unit that determines whether the destination terminal belongs to the same group based on the protocol information. 3. The multi-protocol brouter has a filtering information table indicating to which group the terminal belongs, a means for analyzing the source address, the destination address and the protocol information, and protocol information from the terminal. The network according to claim 1, further comprising means for determining whether or not the destination terminals belong to the same group. 4. A multi-protocol brouter having a routing and bridging function based on a predetermined communication protocol with a plurality of terminals and a management server, the terminals being registered in advance in the management server and being in the same group. In a network that communicates via, the terminal transmits a signal containing protocol information indicating a protocol type together with a source address and a destination address, analyzes the source address and the destination address and the protocol information, A group characterized by determining whether or not the destination terminal belongs to the same group based on the protocol information, and connecting if it belongs to the same group by the protocol of that group, and not connecting if it is a different group Management method.