JPH11243394A - IP-ATM hybrid communication device and communication network - Google Patents

Abstract

(57) [Summary] [PROBLEMS] To avoid a decrease in throughput due to an increase in traffic and to prevent an unauthorized user from invading the system. SOLUTION: When a large amount of data needs to be transferred during IP communication, A-
An agreement is made to set up a TM logical line, and an ATM logical line is set up between the terminals according to the agreement and data is transferred. Further, the terminal is provided with a means for rejecting communication performed by setting an ATM logical line between the terminals for which no setting is previously made and a means for limiting an application executable on the ATM logical line set between the terminals. It shall be.

Description

DETAILED DESCRIPTION OF THE INVENTION

[0001]

[0001] The present invention relates to ATM communication and IP.
Used for communication in which communication is mixed. The present invention relates to a technique for performing ATM communication during IP communication.

[0002]

2. Description of the Related Art First, conventional IP communication will be described using an example of the Internet. I standardized by the US ISOC
Internet Protocol (IP) is a packet transfer protocol used between many communication devices. In communication by IP (IP communication), information is stored in a packet called an IP packet and transferred by a network (IP routing network) configured by connecting devices called an IP router.

[0003] In an IP packet, an address indicating a destination communication terminal called a destination IP address is written.
The IP router understands the destination IP address of the received IP packet, and if possible, transmits the IP packet to the destination terminal. If this is not possible, an appropriate one of the connected IP routers is sent to the next stage. It is selected as a router and transfers the IP packet (IP routing processing). Connected IP
By increasing the number of routers, a wide area communication network is formed, and remote communication in which a packet passes through a plurality of IP routers becomes possible.

[0004] For example, in the case of telephone or facsimile, in order to send information to a communication partner, the communication partner is notified to the network in advance and a line (connection) is set. This communication form is called connection-oriented communication (CO communication). In contrast, I
The P communication does not require a prior connection setting, and can immediately start sending information to any terminal. This communication form is called connectionless communication (CL communication)
Call.

Further, an identifier called a port number is written in the IP packet in addition to the destination address. FIG. 43 is a diagram for explaining the IP interface. As shown in FIG. 43, in a computer having an IP communication function, a layer for processing an IP packet is mounted independently of an application, and the content of an arriving packet is transmitted to each related application based on a port number in this layer. Forward. As a result, a plurality of applications can simultaneously perform a plurality of communications on one IP interface.

[0006] There is a globally constructed IP routing network called the "Internet" today,
It is widely used as a P-routing network as a means for realizing communication between communication terminals of users who do not know each other. The Internet has been growing rapidly in recent years in terms of an increase in the number of connected users, an increase in applications, and the like, and has the following problems. Decrease in throughput due to increased traffic:
Due to the increase in the number of users, the performance of user terminals and the amount of information transferred in one communication, the amount of traffic transferred in the network (traffic) continues to increase exponentially, and traffic Since the increase in the packet transfer capability of the network cannot keep up with the increase in the number of users, the communication throughput achievable on the Internet cannot reach a level satisfactory to users or applications.

Problem 2. Occurrence of system intrusion by unauthorized users: Since communication between various users has become possible, malicious users have invaded others' terminals and systems, causing incidents of damage.

Next, conventional ATM communication will be described. On the other hand, there is an ATM technology as an information transfer technology for constructing a high-speed data transfer network.
It has already been standardized by ATM Forum and the like. A
In TM communication, a network is constructed by connecting devices called ATM switches. The information is stored in a 53-byte packet called a cell and transferred in the network. V in cell
A label called PI / VCI is entered.

The ATM switch has a plurality of ports for connecting physical lines. When a cell is input to a switch from a certain port and output from a certain port, the port to which the cell is input is called an input port, and the output port is called an output port. The label value of the cell at the time of input is called an input label, and the label value at the time of output is called an output label. The ATM switch has a means (routing table) for storing and managing the relationship between an input port, an input label, an output port, and an output label (hereinafter referred to as a "routing table entry") in a cell transfer process. When a cell arrives, a routing table is searched according to the input port and input label of the cell to determine the output port and output label, the cell is transferred to the output port, the label value is rewritten to the output value, and output (cell transfer processing). The ATM communication network operates on the premise of CO communication, and the routing table entry is generated at the same time as the connection is created, and is deleted at the same time as the connection is released.

The connection of the ATM communication network is VC (Virtu
al Channel). The message procedure between the network and the terminal for setting up and releasing the connection is called signaling, and the terminal requesting the connection setting is the calling terminal, and the terminal designated as the communication partner is the called terminal. Call. In the connection setting procedure, the calling terminal sets the ATM switch accommodating itself in the SET.
Sends a message called UP.

Then, according to the connection path, the ATM
Control messages are transferred between the switches and the required ATM
The state of the switch is updated, and the AT accommodating the called terminal
When the control message arrives at the M switch, the ATM switch sends a SETUP message to the called terminal. The called terminal determines whether or not to accept the call based on the contents of the SETUP message (determination of whether or not to accept the call). If the call is accepted, it sends out a message called CONNECT as a response to the switch, and if the call is rejected, R
Send a message called ELEASE COMPLETE to the switch.

Since it is only necessary to store the routing information for the existing VC, the number of entries to be held in the routing table is small, and the cell transfer process can be implemented by hardware. Thus, the ATM has an advantage that high-speed information transfer is possible.

[0013] With respect to a communication terminal having an ATM communication capability, most of the applications executed by the communication terminal use IP communication. The ATM transmits and receives IP packets between the communication terminal and the IP router. Often used for. It is important for many communication applications that the number of terminals that can be interconnected is large, and since ATM is a technology realized later than IP, it is recommended that communication applications use IP communication. This is because it is advantageous because it can secure the interconnection with the already existing IP communication terminal.

[0014] On the other hand, without using the IP routing network, the ATM
A communication application that transfers information by connecting to a partner terminal via a communication network is referred to as a NATM (Native ATM) communication application. The NATM communication application has a disadvantage that the number of terminals that can be interconnected is significantly reduced as compared with a communication application using IP communication.

Here, a description will be given of a conventional technique which addresses the problem of the Internet cited as an example of IP communication. First, as a means for solving the above-mentioned problem 1, communication is usually performed via an IP routing network. However, when transferring a large amount of information, an ATM-VC called cut-through VC is transmitted between IP terminals or between IP terminals. A method of setting between IP routers on a transfer path and transferring an IP packet on a cut-through VC has been studied.

When a cut-through VC is generated between communication terminals, high-speed information transfer can be performed without passing through an IP routing network. Further, even when a cut-through VC is generated between IP routers on a transfer path, the communication execution speed can be improved by the amount of avoiding an intermediate IP router.

FIG. 44 shows an ATM-SVC using NHRP.
FIG. 9 is a diagram for explaining generation. As shown in FIG.
In order to generate a cut-through VC, it is necessary for the communication terminal that is the calling side to acquire the address of the communication terminal that is the called side when the cut-through VC is generated. As a procedure for realizing this, there is a protocol called NHRP. In this method, a terminal sends an ATM address inquiry message to an IP router. The IP router is A
If the TM address is known, a response message is returned to the communication terminal. If the TM address is not known, the inquiry message is transferred to the router along the same transfer path as a normal IP packet.

The inquiry message is transferred until it reaches a router that knows the ATM address, and a response message is returned from the router that knows the ATM address. As described above, NHRP is a procedure for transferring an inquiry message from router to router. This method has the following advantages.

1. Even if the other communication terminal does not necessarily have the ATM communication means, a cut-through VC can be generated with an IP router as close as possible to the other communication terminal.

2. By setting the router that is the boundary for security management so that the address inquiry message is not forwarded any more, an illegal cut-through VC is generated for the communication terminal in the area protected from the external network for security. In addition, as a solution to the problem 2, as a solution from the viewpoint of security, an area to be shielded from an external network (hereinafter, “private domain”) and an external network such as the Internet (hereinafter, “public domain”) There is a method in which information transfer by IP routing is not performed. Instead, a device called a “FireWall” having a network interface for both domains is installed at the boundary between the two domains. FIG. 45 is a diagram for explaining the principle of FireWall.

A function of receiving an application message from a certain terminal and transmitting the application message to another device as a substitute for the terminal that issued the message is called a proxy function. Fire shown in FIG.
Wall provides a proxy function for some applications that are highly convenient and have little effect on security, and realize applications for terminals in the private domain and terminals in the public domain. As a result, security can be ensured while maintaining the convenience for the user to some extent.

[0022]

The method of generating the cut-through VC using NHRP and solving the above problem 1 has the following problems.

Problem 3. Many of the current computer communication applications frequently repeat communication with a small amount of information between a plurality of different terminals in the process of searching for information. When a cut-through VC is generated for a communication with a small amount of information, the setting and release requests exceeding the processing capacity reach the network and the network is congested, and the response speed of the application greatly increases due to a delay caused by the generation of the connection. Resulting in. FIG. 46 is a diagram for explaining a problem (problem 3.).

Problem 4. Even when both terminals performing communication have ATM communication means and are allowed to generate a cut-through VC with an external device also from the viewpoint of security management, the information transfer path in the normal IP communication between the two terminals is If the router does not have the NHRP function, the ATM address cannot be obtained and the cut-through VC cannot be generated. FIG. 47 is a diagram for explaining the problem (problem 4.) of NHRP.

Problem 5 Knowing only the address of the other terminal by NHRP does not make it possible to know the effective communication speed that can be achieved because the performance and network environment of the other terminal are not known. There is no way for the terminal to know if it should be set to a value. FIG.
FIG. 8 is a diagram for explaining a problem (problem 5.).

Further, if the generation of the cut-through VC and the installation of the FireWall are performed simultaneously to solve the problems 1 and 2, the following problem occurs.

Problem 6. Even if there is a terminal executing a communication application via an application protocol in the FireWall and both terminals have ATM communication means, it is necessary to terminate the application protocol in the FireWall.
A cut-through VC that crosses Wall cannot be generated.
FIG. 49 is a diagram showing a problem (problem 6.).

A possible form of setting a cut-through VC is a form in which separate cut-through VCs are set between one terminal and the FireWall and between the other terminal and the FireWall. In FireWalle, the information from one VC is processed in the application layer and sent to the other VC. In this form, Fire
Concentration of load on the wall occurs, which hinders improvement in communication speed. FIG. 50 is a view showing a problem (load concentration).

If the terminal does not use the IP communication, and the communication is performed by the NATM communication application, the above problem does not occur. However, if the terminal does not use the IP communication as described above, the number of communication terminals that can be interconnected is remarkably large. It will be less.

The present invention has been made in such a background, and solves the problems 1 and 2 without the problems 3, 4, 5, and 6 occurring, and solves the conventional problem without the existing ATM communication means. It is an object of the present invention to provide a communication system using high-speed information transfer by ATM while securing the interoperability with the IP terminal.

That is, the present invention provides an IP-based communication system capable of avoiding a decrease in throughput due to an increase in traffic.
It is an object to provide an ATM hybrid communication device and a communication network. SUMMARY OF THE INVENTION An object of the present invention is to provide an IP-ATM hybrid communication device and a communication network that can prevent the occurrence of system intrusion by an unauthorized user.

[0032]

(Means for Solving the Problems) (Means 1) First, in communication according to the present invention, communication terminals performing communication execute an application using IP communication between the communication terminals, and both of the communication applications use ATM. -SVC
Executing a step of confirming whether or not the terminal has communication capability (“cut-through capability confirmation step”), and if one or both communication terminals do not have ATM-SVC communication capability, do not use ATM-SVC communication; When it is confirmed that both have the ATM-SVC communication capability when the communication application is continuously executed, it is desirable to generate a cut-through VC (for example, when transferring a large amount of information). It is characterized in that a cut-through VC is generated according to the following procedure, and information transfer using the cut-through VC is executed: (Procedure 1: VC generation registration step) A cut-through VC is generated by IP communication.

(Procedure 2: VC-TAG determination step) One of the communication terminals (hereinafter, referred to as “master side”) determines a VC-TAG for the VC agreed upon.

(Procedure 3: VC-TAG notification step) The master communication terminal is connected to the other communication terminal (hereinafter referred to as “slave side”).
) Is notified by IP communication of the determined VC-TAG.

(Procedure 4: Call-through step of cut-through VC) The slave-side communication terminal sends the notified VC-TAG to S
ATM calling request while filling in ETUP message
Perform for the communication network.

(Procedure 5: VC-TAG collation step) When a SETUP message arrives at the master communication terminal from the ATM communication network, the master communication terminal notifies the VC-TAG in the SETUP message and the VC-TAG notification step. By comparing the VC-TAGs
"VC-TAG collation step"), if the VC-TAG does not match, reject the call acceptance, and if the VC-TAG matches, accept the call and generate a cut-through VC.

One of the features of one mode of the communication terminal according to the present invention that realizes the means 1 is a means for performing communication using an IP routing network (hereinafter referred to as “IP communication”), and an ATM.
Communication (hereinafter referred to as "ATM-S") on an ATM-VC (hereinafter "cut-through VC") generated between terminals in a signaling procedure.
(Hereinafter referred to as “ATM-SVC”).
Communication means "), and further comprising a step (" cut-through capability confirmation step ") of confirming to the partner communication terminal whether or not it has ATM-SVC communication means.
Means for executing an application using communication, means for making a cut-through VC between the terminals by IP communication (“VC generation making means”),
Means for allocating an identifier (hereinafter, “VC-TAG”) that can be commonly recognized by both terminals to the cut-through VC for which generation has been requested (hereinafter, “VC-TAG allocating means”)
And a VC that has been agreed to be generated with the currently held VC (hereinafter “held VC”) (hereinafter “planned generation VC”).
C) for storing and managing a VC-TAG (hereinafter referred to as a “VC-TAG management table”). The ATM-SVC communication means has a function of writing a VC-TAG in a SETUP message at the time of calling. SET at incoming
The VC-TAG in the UP message is referred to as the “VC-TAG”.
It has a function of rejecting call acceptance if there is no VC-TAG generation scheduled VC that matches the SETUP message (referred to as “non-generation scheduled call rejection function”).

The differences from the prior art are as follows.

1. Compared with the method of generating a cut-through VC using NHRP, in the communication method according to the present invention, it has been previously agreed that the device that generates the cut-through VC directly generates the cut-through VC.
The method of generating a cut-through VC using HRP is different in that generation of a cut-through VC is not mutually agreed between apparatuses.

2. Compared with the NATM communication application, the communication method according to the present invention confirms each other's ATM communication capability in the communication application using IP communication, and uses only IP communication when both or any of them does not have the ATM communication capability. Although the communication application is continuously executed, since the NATM communication application connects to the partner device via the ATM communication network, the difference is that the partner device has the ATM communication capability.

(Means 2) Further, the communication according to the present invention is characterized in that the master side terminal notifies the slave side terminal of the ATM address of the own terminal by IP communication before the cut-through VC calling step. Compared with the conventional method of generating a cut-through VC using NHRP, the communication method according to the present invention is different in that an ATM address is notified by direct IP communication between terminals generating the cut-through VC.

(Means 3) Further, in the communication according to the present invention, the master communication terminal predicts the effective communication speed achievable in consideration of the processing capability of the own communication terminal and the network environment, and performs the cut-through VC generation step. This value is notified to the slave communication terminal by IP communication before execution. In the conventional method of generating a cut-through VC using NHRP, the communication terminal that issues the cut-through VC cannot acquire the effective communication speed that can be achieved by the other communication terminal. Also, even in the NATM communication application, the calling communication terminal cannot acquire the effective communication speed achievable by the other communication terminal before connecting to the other communication terminal.

(Means 4) Further, in the communication according to the present invention, one of the communication terminals is a "server" for providing information, and the other is a "client" for obtaining information.
, The client is set as the slave side and the server is set as the master side.

(Means 5) Further, the communication terminal according to the present invention is characterized in that the communication terminal according to the present invention has means for limiting an application executed on the cut-through VC to a specific application (hereinafter, “designated application”). Determines the designated application before the cut-through VC calling step.

On the other hand, in the conventional method of generating a cut-through VC using NHRP, it is not possible to apply for a designated application because the cut-through VC is not applied in advance, and once the cut-through VC is set. However, it is not possible to limit the applications executed on the cut-through VC.

(Means 6) Cut-through VC for means 5
As one method for preventing the execution of an application other than the designated application, in a form of communication according to the present invention, when generating a cut-through VC, the band in the direction from the slave communication terminal to the master communication terminal is set to “0”. It is characterized by the following.

(Means 7) Cut-through VC for means 5
As another method for preventing the execution of an application other than the specified application, in one mode of the communication terminal according to the present invention, data transferred on the cut-through VC
The transfer is directly performed to the designated application without passing through the P layer processing.

(Means 8) Further, in the present invention, the communication terminal on the master side may be cut-through VC by an unauthorized user.
When an attempt is made to generate an IP address, a means for notifying the ATM communication network of the detection is provided.

(Means 9) Further, the communication terminal according to the present invention is characterized in that the communication terminal has means for cutting a VC which has passed a predetermined time after the communication has been completed among the cut-through VCs.

(Means 10) Further, the communication terminal according to the present invention, if any of the VCs to be generated does not receive a call even after a lapse of a predetermined time from the time when it is requested to generate the VC, the communication terminal in the VC-TAG management table. It is characterized by having means for erasing the contents of the VC to be generated.

(Means 11) Further, the communication according to the present invention is
It is characterized in that the following steps are added to the communication procedure of the means 1 using a byte string (hereinafter, “password”) in which it is difficult for a third party to guess a value or repeatedly generate candidate values comprehensively.

1. Password notification step: The master communication terminal generates a password for each VC to be generated, and notifies the slave communication terminal of the password by IP communication prior to the execution of the cut-through VC generation step.

2. Password repetition step: Immediately after the cut-through VC generation step or immediately after the cut-through VC generation, the slave communication terminal repeats the notified password to the master communication terminal.

3. Password collation step: After the password repetition step, the master communication terminal verifies the password notified in the password notification step with the password repetition in the password repetition step, and cuts if the password does not match. The call rejection or disconnection of the through VC is performed.

One of the features of the configuration of the communication terminal according to the present invention that realizes the means 11 is that the master communication terminal has a means for generating a password for each VC to be generated, and the VC-TAG management table generates the password. Scheduled VC
Has a function of storing a password for

(Means 12) Further, in one form of communication according to the present invention, it is assumed that an encryption key unique to each slave communication terminal is made public, and that the master communication terminal has obtained it. In the password notifying step, the master communication terminal encrypts the password,
Instead of notifying the password as it is, an encrypted password is notified.

(Means 13) In the communication according to the present invention, in a form different from that described in the means 12, it is assumed that a decryption key unique to each slave-side communication terminal is disclosed, and that the master-side communication terminal Assuming that the password has been obtained, in the password repetition step, the slave communication terminal encrypts the password and sets the encrypted password instead of writing the password as it is.
The UP message is entered, and the master communication terminal decrypts the encrypted password in the SETUP and verifies the password.

Among the structural features of the communication terminal according to the present invention, those necessary for realizing the means 12 or 13 include:
The communication terminal has means for encrypting and decrypting data by a public key cryptosystem.

Next, the operation of the present invention will be described. By means 1, it becomes possible to generate only cut-through VCs that have been previously generated by an application on IP communication. This produces the following effects.

Solution to Problem 2: In an application for signing up for a cut-through VC, it is possible to take various measures to prevent unauthorized communication on the cut-through VC, such as user authentication. That is, it is possible to avoid the occurrence of system intrusion by an unauthorized user, which has been pointed out as problem 2 earlier.

Solution to Problem 3: It is possible to determine the amount of information to be transferred in an application for performing cut-through VC agreement, and to generate a cut-through VC only when transferring a large amount of information. Become. In other words, it is possible to avoid the occurrence of network congestion and an increase in the reaction speed of the application due to the generation of the cut-through VC for the communication with a small amount of information pointed out as the problem 3 earlier.

Further, if the problem 2 can be prevented from occurring on the cut-through VC as described above, the cut-through VC that directly connects the devices can be used even between devices that perform normal IP communication via the FireWall. Can be generated, and problem 6 is solved.

As described above, by means 1, problems 2, 3,
6, the communication using the high-speed data transfer by the ATM can be performed, and the problem 1 is solved.
Also, as described in the means 1, the ATM-SVC communication capability is confirmed between the communication terminals, and one or both of the communication terminals check the ATM-SVC communication capability.
If there is no TM-SVC communication capability, the application can be continued using only IP
Communication with a communication terminal having no M-SVC communication capability is performed at a conventional quality to ensure interconnectivity. That is, in the communication system according to the present invention, the problem of the NATM communication application that the number of interconnectable communication terminals is reduced does not occur.

Further, the caller-side communication terminal obtains the ATM address of the called-side communication terminal directly from the called-side communication terminal by means 2 to solve the problem 4.

Further, the effective communication speed achievable is predicted in consideration of the communication speed notified by the slave side communication terminal by means 3 and its own processing capacity and network environment, and the cut-through V
The band for C can be determined, and problem 5 is solved.

However, the following problems newly occur due to the means 1, 2, and 3.

Problem 7. Malicious user is another person's third
It becomes possible to perform a mischief by setting up a master-side device for notifying a user's ATM address.

Problem 8. As mentioned above, cut-through VC
Authenticating the user in an application that applies for the generation of the information can prevent unauthorized communication from occurring on the cut-through VC. However, one of the communication terminals is a server, and information is available to all people. If the server allows, it is difficult to effectively prevent unauthorized communication by user authentication. In this case, a malicious user uses the slave communication terminal to access the master communication terminal with an application that is unlikely to cause damage to the system, negotiates with the master communication terminal to generate a cut-through VC, and cuts. After the generation of the through-VC, an application that is not supposed at the time of applying for the generation of the cut-through VC may be executed, and the system may be damaged.

Problem 9. Malicious users exhaustively V
There is a possibility of repeatedly trying to generate a cut-through VC with a certain communication terminal while generating a candidate value of C-TAG.
As a result, the cut-through VC generation agreement step was performed in a certain slave communication terminal and a certain master communication terminal, but the same operation was performed by a malicious user before the execution of the cut-through VC generation step by the slave communication terminal. There is a risk that a call using the VC-TAG may occur and a cut-through VC may be generated between communication terminals that have not signed up for generation.

Problem 10. If an unauthorized user repeatedly attempts to generate a cut-through VC while being rejected using the slave communication terminal, the master communication terminal and the AT
The load on the call processing system of the M communication network increases.

Problem 11. If VCs are kept for a long time even after communication is completed on the cut-through VC, the number of VCs that are kept at the same time increases.

Problem 12. Due to an unexpected failure of the communication terminal, a situation may occur in which the cut-through VC generation step is not executed after the execution of the VC-TAG notification step. In this case, the entry of the VC to be generated exists in the VC-TAG management table for a long time, and the occurrence rate of the problem 9 increases.

The server operates independently of human operations, but the client operates in many cases by human operations. Therefore, the means 4 recognizes the occurrence of the mischief pointed out as the problem 7 by the human, and It is possible to end the continuation of damage caused by mischief.

By means 5, an application to be executed on the cut-through VC before the cut-through VC is generated is agreed between the terminals. Applications other than those designated before the cut-through VC are generated are executed on the cut-through VC. To prevent Thereby, communication on the cut-through VC can be limited to a specific purpose. For example, if the purpose is to transfer public information on the cut-through VC, an application capable of restricting the user's authority so that private information cannot be obtained is designated as the designated application, Unauthorized communication can be prevented. As described above, the problem 5 is solved by the means 5.

Means 6 and 7 are specific means for preventing an application other than the designated application from being executed on the cut-through VC in the means 5.

Since many applications that are likely to be used illegally and have a high possibility of damaging the system require bidirectional communication, an application that is likely to cause the problem 8 by the means 6 is executed on the cut-through VC. Can be prevented.

Since many applications are started by sending a TCP connection setting request packet to a listening port number unique to the application, it is impossible for an unauthorized user to start an application other than the designated application by means 7. Becomes
An application other than the designated application is prevented from being executed on the cut-through VC.

The means 8 allows the ATM communication network to establish an illegal SE.
It is possible to take measures such as suspending the processing of the call setting request from the communication terminal that has issued the TUP message for a while, and solve the problem 10.

By means 9, the cut-through VC for which the application has already been completed is cut off after holding for a predetermined time,
Solve problem 11.

By means 10, information on the VC to be generated, for which the cut-through VC generation step is not executed after the execution of the VC-TAG notification step due to an unexpected failure of the communication terminal or the like, has passed from the VC-TAG management table for a certain period of time. Thereafter, the data is automatically deleted, and the problem 12 is solved.

Means 11 uses a byte string for which it is difficult to generate candidate values comprehensively in addition to the VC-TAG as a byte string to be collated at the time of an incoming call, so that a cut-through VC is not negotiated. Problem 9 is solved by making it difficult for three communication terminals to generate a cut-through VC.

However, the above method has the following problems.

Problem 13. There is a possibility that a malicious user may intercept the IP communication notifying the password and try to generate an illegal cut-through VC.

However, by means 12 or 13
Only the legitimate slave communication terminal can correctly repeat the password, and the problem 13 is solved.

That is, a first aspect of the present invention is a communication device. The feature of the present invention resides in that both a means for performing IP communication and a means for performing ATM communication are provided. Means for setting a cut-through VC with the partner device by executing communication, and matching the line setting conditions, and a cut-through VC between the partner device according to the agreement.
Means for setting the cut-through VC with the partner apparatus, and means for determining whether or not the cut-through VC has previously been set for the set conditions. Means for rejecting the execution of the communication if the result of the determination is negative.

Thus, an ATM with high security can be obtained.
Data transfer can be performed by communication. At this time,
By rejecting communication using cut-through VCs other than the conditions for which the agreement was made prior to the ATM communication, security can be further improved.

When the communication device that presents the cut-through VC setting conditions is the main terminal and the other communication device is the slave terminal, the cut-through VC is set based on the cut-through VC. It is preferable that the slave terminal include means for making a setting request to the ATM communication network.

The means for making an agreement includes a means for setting whether a cut-through VC is set between the terminals and confirming whether or not communication is possible. If the communication is not possible, the data transfer is executed by IP communication. It is desirable to provide a means for performing this. As a result, data transfer can be performed to a partner terminal having only means for performing IP communication as before.

It is preferable that the setting conditions include an application executable on the cut-through VC, communication conditions, an identifier, and an ATM address.

At this time, it is desirable that the communication conditions include an effective communication speed of the LAN to which the main terminal belongs, a load condition thereof, and a maximum possible communication speed.

It is desirable to have means for limiting the applications permitted to be executed on the cut-through VC with the partner terminal set based on the agreement, and making it impossible to execute the unauthorized applications. As a result, execution of unnecessary applications becomes impossible, and access by a third party attempting fraud can be avoided.

After the cut-through VC is set between the terminal and the communication partner terminal, it is desirable to include means for making it impossible to perform IP communication using the cut-through VC.

When a request to execute communication using a cut-through VC not previously agreed is detected as a result of the determination as to whether or not the cut-through VC has been agreed beforehand, this fact is monitored on the network. It is desirable to include means for notifying the means. By notifying the monitoring means on the network of the existence of the third party who attempts the fraud, the monitoring means can cope with this.

It is desirable to include a means for automatically cutting the cut-through VC used for the data transfer after a predetermined time has elapsed from the completion of the data transfer. As a result, unnecessary cut-through VCs can be promptly disconnected, and access by a third party who attempts an illegal operation can be avoided.

It is desirable to have means for erasing the set conditions when the cut-through VC is not set after a predetermined time from the execution of the agreement. As a result, it is possible to prevent the setting of the cut-through VC based on the above-mentioned conditions from being performed by a third party who tries to be fraudulent.

It is desirable to have means for confirming the validity of the partner terminal by using a password. At this time, it is desirable to include means for confirming the validity of the partner terminal with a password every time data transfer is started. As described above, by using a password together with the identifier, the security of communication can be improved.

It is desirable to have means for encrypting the password and means for decrypting the encrypted password. At this time, the encrypting means may include a means for encrypting the password using a public key unique to the terminal to which the password is transmitted.

It is also possible to adopt a configuration in which the main terminal is a server and the slave terminal is a client. At this time, the server desirably includes means for setting the communication band from the client to the server to "0" for the client when starting the ATM communication. As a result, it is possible to avoid access from a third party who attempts to cheat the server.

It is also possible to provide a means for writing a part of the setting condition elements determined by the above-mentioned agreement into a cut-through VC setting request message for the ATM communication network. Some of the setting condition elements are, for example, an identifier and / or a password for the cut-through VC.

A second aspect of the present invention is that an ATM communication network that performs communication by transmitting and receiving cells on a connection set by an ATM signaling procedure, and that performs communication by sequentially relaying IP packets based on the Internet protocol. IP-AT comprising an IP routing network for performing communication and a plurality of communication terminals connected to these two communication networks
It is an M hybrid communication network.

Here, the feature of the present invention resides in that the communication terminal is adapted to perform a data transfer via the ATM communication network by communication via the IP routing network, and Therefore, the cut-through V
C for performing data transfer and rejecting communication using cut-through VCs other than the conditions signed by the IP communication.

[0102]

Embodiments of the present invention will be described with reference to FIG. FIG. 1 is a diagram showing an overall configuration of an embodiment of the present invention and a main block configuration of a communication terminal.

As shown in FIG. 1, the present invention includes both IP communication units 2M and 2S, which are means for performing IP communication, and ATM-SVC communication units 1M, 1S, which are means for performing ATM communication, and performs communication. By executing IP communication with the partner device, setting a cut-through VC between the partner device and the line setting conditions, and setting a cut-through VC with the partner device according to the agreement. Further, for communication performed by setting a cut-through VC with the partner device, the cut-through VC
It is provided with communication control units 7M and 7S which are means for determining whether or not C has been set in advance for the setting conditions and rejecting the execution of the communication if the result of the determination is negative. .

Here, regarding the agreement of the cut-through VC setting, the communication device that presents the cut-through VC setting condition is the master communication terminal 10 and the other communication device is the slave communication terminal 20. I do.
At this time, cut-through VC based on the agreement
The slave communication terminal 20 makes a setting request to the ATM communication network 50.

The present invention also relates to an ATM communication network 50 that performs communication by transmitting and receiving cells on a connection set by the ATM signaling procedure, and an IP that performs communication by sequentially relaying IP packets based on the Internet protocol. This is an IP-ATM hybrid communication network including a routing network 70 and a plurality of communication terminals 10 and 20 connected to these two communication networks.

Here, the feature of the present invention is that the communication terminals 10 and 20 make a request to perform data transfer via the ATM communication network 50 by communication via the IP routing network 70. Cut-through V
The communication control units 7M and 7S are means for performing data transfer using the cut-through VC which is C and rejecting communication using the cut-through VC other than the conditions agreed by the IP communication. The identifier described above corresponds to VC-TAG in the embodiment of the present invention.

[0107]

DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS (Configuration of Terminal in Embodiment) As an embodiment of the present invention, a WWW client and a WWW server having an extended function of the IP-ATM hybrid communication system according to the present invention will be described. WWW (World Wide Web) is a system that enables users to obtain files (hereinafter collectively referred to as Web resources) such as characters, data, video, and audio on servers scattered over an IP router network. System.

A communication terminal for acquiring information is called a WWW client, and a communication terminal for delivering information is called a WWW server. The WWW client displays an image called a Web page on a screen. Information (server address, file name) indicating the location of a Web resource called a URL is embedded in the Web page, and the user can access the Web resource.
When a certain part of the page is selected with a mouse or the like, the WWW client accesses the WWW server indicated by the URL embedded in that part, and the WWW server
Obtain the file indicated by L. A typical protocol used for information transfer from the WWW server to the WWW client at this time is HTTP (Hyper Text Transfer Protocol).
otocol) is used.

Communication terminals 10 and 20 shown in FIG. 1 are WWW servers, and communication terminal 20 is a WWW server.
It can be said that it is a W client. At this time,
The WWW server (hereinafter, referred to as a server) according to the present embodiment includes an ATM-SVC communication unit 1M, an IP communication unit 2M, and a VC-T.
An AG management module 8M and a communication control unit 7M as a server application module,
Client (hereinafter referred to as client) is ATM-
It is composed of an SVC communication unit 1S, an IP communication unit 2S, a VC-TAG management module 8S, and a communication control unit 7S which is a client application module. VC-
The TAG management module 8S has a VC-TAG management table 5S, and the VC-TAG management module 8M has a VC-TAG management table 5S.
TAG allocator 6 and VC-TAG management table 5M
Having.

The ATM-SVC communication units 1M and 1S
A cut-through VC is set or released by the TM signaling procedure, and information is transmitted and received using the set cut-through VC. Further, the communication control unit 7S as a client application and the communication control unit 7M as a server application perform cut-through VC generation agreement, and perform communication using the HTTP protocol extended according to the present invention.

The server is in a state of waiting for a request from a client immediately after starting the execution, and the client is also in a state of waiting for a request from the user immediately after starting the execution. A user having a client selects a location on a Web page, and as a result, information is transferred from the server to the client. The information transfer is completed, and both the client and the server return to the original state in a series of operations of the system. Yes, during which the system goes through the following phases: (1) ATM-SVC communication capability (cut-through extension function)
(2) Judgment of necessity of cut-through VC generation (3) Agreement for generation of cut-through VC (4) Start of cut-through VC generation (client side) (5) Acceptance of cut-through VC generation (6) Cut-through Execution of application on VC (7) Release of cut-through VC Hereinafter, details of this embodiment in each phase will be described.

(Confirmation of ATM-SVC communication capability (cut-through extension function)) When the user selects a certain place in the Web page, the communication control unit 7S identifies the server to be accessed from the URL embedded in that part. Then I
The P communication unit 2S sets a TCP / IP connection for performing HTTP communication with the server application of the server.

FIGS. 2 to 5 show message formats. 6 to 22 are flowcharts of each step. As shown in FIG. 6 (step 1),
The communication control unit 7M inquires of the communication control unit 7S whether the server to be accessed now supports the extension according to the present invention (hereinafter, hybrid extension). FIG. 2A shows an inquiry message sent from the client to the server at this time. The server analyzes the received message, and if it supports the hybrid extension, returns the message shown in FIG. 2 (2) -a as a reply to the inquiry message. If the user is not compatible with the hybrid extension or does not want to use the extension system for some reason, a message shown in FIG. 2 (2) -b indicating that the extension function cannot be used is returned.

FIG. 2 (2) -a When a message is returned, it indicates that both the server and the client support the hybrid extension. Therefore, the message sent from the client to the server is based on the hybrid extension. Message is used. Fig. 2 (2)-
If b is received, the client understands that the server does not support the hybrid extension, and communicates with the server using a conventional HTTP message without extension according to the present invention to acquire Web resources. According to the above procedure, the ATM-SV is established between the communication terminals 10 and 20.
Confirming whether or not it has C communication capability has been achieved.

(Judgment of Necessity of Generating Cut-through VC)
Next, the communication control unit 7S transmits a message (GET message) requesting the communication control unit 7M to transfer the Web resource requested by the user to the client side. It is necessary to determine whether to use a TCP connection already established on the conventional IP routing network to transfer Web resources, or to generate a new cut-through VC and use it.

In this embodiment, the size of data transferred to the client is used as a criterion for determination. That is,
As shown in FIG. 7 (step 2) and FIG. 8 (step 3), a condition for switching to cut-through VC by adding information called “Cut-Through-Control” to the GET message is presented. In the example shown here, if the size of the data transferred to the client is larger than the value indicated by th_size, a cut-through VC is generated. The server determines whether or not the client generates a cut-through VC according to the criterion indicated by Cut-Through-Control, and returns a message as shown in FIG. 2 (4) as a response to GET.

At this stage, the server can also start a user authentication procedure with the client to authenticate the user. FIG. 2D is an example in which the server proposes to generate a cut-through VC as a result of the determination. According to the above-described procedure, a determination process of generating a cut-through VC only when the amount of information to be transferred is large is achieved.

(Contract of Cut-Through VC Generation) As shown in FIG. 9 (step 4), when a cut-through VC is generated between the server and the client, the information necessary for generating the cut-through VC You have to interact. The procedure for generating the cut-through VC is started from the client side. For this purpose, the client must obtain information such as the ATM address of the server side. Further, it is necessary to negotiate the type, band, and the like of the generated cut-through VC with the server. The above information can be obtained when the client sends a cut-through VC to the server.
Message that indicates that a CUT-THROUGH SE
TUP "), for which the server sends a response message to the client.

FIG. 2 shows an example of the CUT-THROUGH SETUP message.
See (5). Examples of information included in this message include "client ATM address", "type of cut-through VC to be generated", and the like. The ATM address of the client is the HTTP currently performed on the server side.
A series of message exchanges (hereinafter referred to as sessions)
Used to identify Also, the server notifies the server of the type of cut-through VC that can be generated on the client side and inquires whether the server can accept the cut-through VC.

The server receiving this message first determines whether or not the server can accept the cut-through VC presented by the client. The server may be able to accept the request, but may reject the condition presented by the client if it is difficult to accept the request physically, such as when the line is busy. In this case, a message indicating rejection is returned to the client. The client, having received the rejection message, waits for an appropriate time if possible, generates a message according to FIG. 2 (5) again, and transmits it to the server. In this manner, the negotiation of the cut-through VC using the message shown in FIG.

As shown in FIG. 10 (step 5), when the server receives the cut-through VC presented by the client, the communication control unit 7M sends the cut-through VC to the ATM-SVC communication unit 1M as shown in FIG. (Hereinafter referred to as “session registration notification”), and the information of the cut-through VC to be generated (the ATM address of the client, the type of the cut-through VC to be generated, the identifier of the server, etc.) is managed by the VC-TAG. Notify module 8.

As shown in FIG. 11 (step 6), the VC receiving the session registration notification from the communication control unit 7M
-The TAG management module 8M uses the new V-tag so that it does not overlap with the VC-TAG already assigned and currently valid.
The C-TAG is selected and assigned to the newly registered cut-through VC for the session. Further VC-T
A new entry is created in the AG management table 5M, the session information notified to the entry and the assigned VC-TAG are stored, and the cut-through V of the entry is stored.
The state of C is assumed to be “to be generated”. Then, the VC-TAG management module 8M sends a response message (FIG. 3 (7)) to the communication control unit 7M, and notifies the communication control unit 7M of the allocated VC-TAG.

With the registration of the session, the server is ready to call the cut-through VC. As shown in FIG. 12 (step 7), the server sends the message shown in FIG. 2 (8) to the client as a response message to FIG. 2 (5), and sends information necessary for generating the cut-through VC to the client. Inform Fig. 2 (8)
Indicates that the information notified to the client side at this time is “server ATM address”, “VC-TAG”,
There is an effective communication speed on the server side. The server sends cut-through VC to the client by the above communication procedure.
The notification of the ATM address and the effective communication speed required for the generation of the data has been achieved.

The effective communication speed and other communication conditions are as follows.
It is generated by the communication condition presentation unit 3 of the communication terminal 10. The communication conditions are stored in the communication condition confirmation unit 4 of the communication terminal 20.
Confirmed by

(Start of Generation of Cut-Through VC) The communication control unit 7M that has obtained information necessary for generating a cut-through VC
Transmits the SVC setting REQ. Shown in FIG. 3 (9) to the ATM-SVC communication unit 1M to generate the cut-through VC as shown in FIG.
TM address, cut-through VC band, SE when calling
Notify the VC-TAG to be entered in the TUP message.

As shown in FIG. 14 (step 9), the AT
The M-SVC communication unit 1S specifies the notified ATM address of the server as the Called Party Number, specifies the notified band as the requested band, and further notifies the notified VC-TAG.
And sends a SETUP message to the ATM communication network. The following four methods can be considered as a method of writing the VC-TAG in the SETUP message.

[0127] 1. The Broadband High Layer Information information element is used.

[0128] 2. Use User-User Data.

3. It is added to the SEL part of the ATM address.

[0130] 4. GIT (Generic Identifier Transpor
t) Use information elements.

Here, V is added to SETUP using the method of 3.
Embed C-TAG. VC-TAG embedded S
ETUP goes through one or more ATM switches on the way,
It is sent to the ATM-SVC communication unit 1M of the server.

(Reception of Cut-Through VC) As shown in FIG. 15 (step 10-1), the server-side ATM-SV
Upon receiving the SETUP, the C communication unit 1M receives the SETUP
To check whether P has been issued through a regular procedure between the communication control unit 7S and the communication control unit 7M, VC
FIG. 2 (11) VC-TAG inquiry REQ is transmitted to the TAG management table 5M, and the VC-TAG and the Call Reference Value entered in the received SETUP message are transmitted.
e, Notify VPI / VCI.

As shown in FIG. 16 (step 11), if the corresponding VC-TAG exists in the VC-TAG management table 5M and its state is to be generated, the received SE
The TUP message is valid. In this case,
The VC-TAG management table 5M stores CallRe in the entry indicated by the VC-TAG in the VC-TAG management table 5M.
Information such as ference value and VPI / VCI value is added, the state is changed to “in use”, and the VC-TAG inquiry RESP shown in FIG. 3 (12) is returned to the ATM-SVC communication unit 1M to notify that the call is accepted. I do. FIG. 3 (12) contains the identifier of the application (logical port number for receiving a message from the VC-TAG management table 5M or the ATM-SVC communication unit 1M: hereinafter, port). Also,
If the corresponding VC-TAG is stored in the VC-TAG management table 5M,
Does not exist, the SETUP that has arrived is not issued through a regular procedure between the communication control unit 7S and the communication control unit 7M. In such a case, the VC-TAG management table 5M stores "-" as the application identifier.
1 "" and specify the VC-TAG inquiry RES in Fig. 2 (12).
Returns P and informs ATM-SVC communication unit 1M that call is rejected.
Notify.

As shown in FIG. 17 (step 12), FIG.
If the application identifier is "-1", the TM-SVC communication unit 1S sends the ATM communication network 50 the data shown in FIG.
Issues RELEASE COMPLETE message. At this time, the value of the Cause value in the RELEASE COMPLETE message indicating that an access from an unauthorized user has been detected (100 0010 = "Invalid
Access Detected ") is newly defined and this value is used.
In this case, the call originated by the client-side ATM-SVC communication unit 1M is rejected. If the application identifier is other than "-1", the ATM-S
The VC communication unit 1S connects the ATM communication network 50 with the CONN.
Issue ECT. At the same time, the ATM-SVC communication unit 1S transmits the call notification of FIG. 3 (13) to the communication control unit 7S, and notifies the VPI / VCI of the cut-through VC that has been called.

As shown in FIG. 18 (step 13), the communication control unit 7S that has received the incoming call notification in FIG. 3 (13) newly generates a logical port (hereinafter referred to as a socket) for transmitting and receiving information and is notified. The information sent by the cut-through VC of the VPI / VCI is transmitted to the logical port so as to be transmitted to the logical port.
Set to S (this setting is called bind).

According to the above-described procedure, the server calls only the cut-through VC for which the server has previously generated a request, and for the cut-through VC that has been called, the information transferred on the VC is transferred only to the application specified in advance. To be done, the received SETU
When the P message is invalid, the fact is notified to the ATM communication network 50.

As shown in FIG. 19 (Step 10-2), the ATM-SVC communication unit 1M on the server side
By sending ONNECT, A on the client side
The TM-SVC communication unit 1 </ b> S
NECT will be received. The ATM-SVC communication unit 1S on the client side receiving the CONNECT,
Call Reference Valu obtained by CONNECT
e, information such as a VPI / VCI value and information such as a VC-TAG information, an application identifier, a state of a VC, and a state transition time are written in a VC-TAG registration REQ, and transmitted to the VC-TAG management table 5S. .

As shown in FIG. 20 (step 14), V
The VC-TAG management table 5S that has received the C-TAG registration REQ creates a new entry in the VC-TAG management table 5S, writes the notified VC-TAG information, and changes the state of the cut-through VC of the entry to “in use”. ". Then, the VC-TAG registration RESP is returned.

As shown in FIG. 21 (step 15), V
The ATM-SVC communication unit 1S having received the C-TAG registration RESP transmits a response message (SVC setting RESP) to the SVC setting request to the communication control unit 7S,
The communication control unit 7S is notified of the generated VPI / VCI of the call. In addition, the communication control unit 7S is notified of information on the SVC to be bound.

As shown in FIG. 22 (step 16), A
Communication control unit 7S receiving TM-SVC communication RESP
Generates a socket in the same manner as the server, and sets (binds) the OS so that the information transferred by the notified VPI / VCI VC is transmitted to the generated socket.
I do. FIG. 23 is a sequence diagram showing the procedure of FIGS.

(Execution of Application on Cut-Through VC) FIGS. 24 and 25 are diagrams for explaining the procedure for exchanging HTTP messages using the cut-through VC. When the SVC binding is completed in both the communication control unit 7M and the communication control unit 7S, the cut-through V
It is possible to exchange HTTP messages using C. As shown in FIGS. 24 and 25, the communication control unit 7S
Requests transfer of Web resource selected by user
(a) Send GET-REQ to the communication control unit 7M. GE
Upon receiving the T-REQ, the communication control unit 7M includes the contents of the Web resource requested by the user (b) GET-R
It returns with an ESP message.

(Release of cut-through VC) As shown in FIG. 26 (step 17), when there is no message exchange between the communication control unit 7M and the communication control unit 7S for a certain period of time, and the communication control unit 7S specifies Cut-through V
When the end of C is declared, a procedure for releasing the cut-through VC is started. The following two processes must be performed when the cut-through VC is released.

1. Information about cut-through VC
-Delete from the TAG management module.

2. Release of cut-through VC.

[0145] Of these, the latter is the RELE from the client.
This is done by issuing an ASE message. The former needs to be performed by both the communication control unit 7M and the communication control unit 7S. In order to delete the information on the cut-through VC in the communication control unit 7M, the registration must be deleted from the communication control unit 7S to the communication control unit 7M. I have to ask. The procedure for executing the above two processes will be described in detail below.

When it is decided to release the cut-through VC, as shown in FIG. 27 (step 18), first, the communication control section 7S first sets the VC-T of the cut-through VC to be released.
FIG. 4 (17) CUT-THROUGH TEAR-DOWN-REQ in which the AG is entered is sent to the communication control unit 7M.

[0147] The communication control unit 7M deletes information on the corresponding session in the VC-TAG management table 5S in two stages. In the first stage, that is, at the stage of receiving the message in FIG. 4 (17), only the state of the cut-through VC to be released is changed from “in use” to “released”. The erasing is actually performed after the cut-through VC is released.

As shown in FIG. 28 (step 19), the communication control unit 7M receiving the CUT-THROUGH TEAR-DOWN-REQ in FIG. 4 (17) includes the VC-TAG notified in FIG. 4 (17). FIG. 5 (18) The VC-TAG erase start REQ is transmitted to the VC-TAG management table 5M. Figure 5 (18) V
The C-TAG management module 8M changes the state of the corresponding cut-through VC in the VC-TAG management table 5M to "released", and returns (19) the VC-TAG deletion start RESP to the communication control unit 7M.

By the above operation, preparation for release of the cut-through VC on the server side is completed. As shown in FIG. 29 (step 20), the communication control unit 7M receiving the message of FIG. 5 (19) transmits the message of FIG. 4 (17) CUT-THROUGH TEAR-DO.
Figure 4 (20) CUT-THROUGH TEAR-D as a response to WN-REQ
OWN-RESP is returned to the communication control unit 7S.

As shown in FIG. 30 (step 21), the communication control unit 7S receiving the CUT-THROUGH TEAR-DOWN-RESP in FIG. 4 (20) cuts through the cut-through to be actually released in order to actually release the cut-through VC. The SVC release REQ including the VC-TAG of the VC is transmitted to the ATM-SVC communication unit 1S (FIG. 5 (21)).

As shown in FIG. 31 (step 22), the ATM-SVC communication unit 1S having received the SVC release REQ in FIG. 5 (21) first executes the VC- FIG. 5 (22) VC-
The TAG erase start REQ is set to the VC-TAG management module 8
Transmit to S.

As shown in FIG. 32 (step 23), FIG. 5 (22) VC-TAG receiving VC-TAG deletion start REQ
The TAG management module 8S changes the state of the corresponding VC-TAG from “in use” to “released”, and includes the Call Reference Value of the cut-through VC to be released (FIG. 5 (23)).
The VC-TAG erasure start RESP is returned to the ATM-SVC communication unit 1S.

As shown in FIG. 33 (step 24-1), the ATM-SVC communication unit 1S sends a RELEASE message for cut-through VC release using the Call Reference Value passed by the message in FIG. Generated and transmitted to the ATM communication network 50.

When the client sends a RELEASE message to the ATM communication network 50, the server sends A
The RELEASE message arrives from the TM communication network 50.

As shown in FIG. 34 (step 25), the ATM-SVC communication unit 1M on the server side
When the RELEASE message is received from 0, the Call Reference Value in the received RELEASE message
Into the VC-TAG erase instruction REQ in FIG.
FIG. 5 (25): The VC-TAG erase instruction REQ is transmitted to the VC-TAG management module 8M.

As shown in FIG. 35 (step 26), V
The C-TAG management module 8M receives the given Call Refer.
search for the corresponding VC-TAG from the ence value,
TAG information is deleted, and (26) VC-TAG deletion instruction RE
Return "SP deletion completed" to SP.

As shown in FIG. 36 (step 27), the ATM-SVC communication unit 1 receiving the message of FIG.
M is Fig. 5 (24) -2 RELEASE COMPLETE
ATM-SVC on the client side by creating a message
It is transmitted to the communication unit 1S.

As shown in FIGS. 37 to 40 (step 24-2, step 28, step 29, step 30), the message shown in FIG.
The erasure of the SVC is completed when it reaches the SVC communication unit 1S.

FIG. 3 (7): Even if a certain period of time has passed since the notification of the new VC-TAG assignment RESP, the VC-TAG inquiry REQ
Is not received, the VC-TAG management module 8M transmits the cut-through V in the VC-TAG management table 5M.
Delete the entry for C. FIG. 41 is a sequence diagram showing the procedure of FIGS.

The client and server extended according to the present invention described above have the following advantages.

1. Information is transferred to a device that does not support the expansion according to the present invention by the conventional procedure, and the interconnectivity with the conventional client and server is completely ensured.

[0162] 2. As long as both communication terminals 10 and 20 support this extension, a cut-through VC can be generated. As a result, the problem that the cut-through VC cannot be generated unless the router on the IP communication path has the NHRP function does not occur, which occurs in the method of generating the cut-through VC using the NHRP.

3. A cut-through VC can be generated only when a large amount of information needs to be distributed.

[0164] 4. A cut-through VC generation agreement is made in advance through IP communication, and the agreed cut-through VC
It is possible to call only C, and cut-through VC
By authenticating a user when making a contract for generation, it is possible to generate a cut-through VC only with a user who has been authenticated in advance. In a method of generating a cut-through VC by NHRP, generation of a cut-through VC cannot be agreed in advance. For this reason, when receiving a call through the cut-through VC, it is impossible to recognize the other party connected by the cut-through VC and make a call acceptance determination.

5. As described above, it is possible to make a cut-through VC acceptance determination after recognizing the other party connected by the cut-through VC. Therefore, it is possible to generate the cut-through VC across the FireWall, and to concentrate the load on the FireWall. Can be avoided.

(Embodiment of Implementing Client Function Extended by the Present Invention in HTTP Proxy) FIG. 42 shows an embodiment in which the above client function is implemented in an HTTP proxy. The communication procedure between the HTTP proxy and the server is the same as described above. In this embodiment, an IP-AT according to the present invention is provided between an HTTP proxy and a server extended according to the present invention.
Information transfer by the M hybrid communication network is performed. In this mode, the load is concentrated on the FW as in the past, but compared with the conventional method of generating a cut-through VC using NHRP, the router on the intermediate route has an NHR.
The problem that the ATM address cannot be exchanged between the devices without providing the P function is solved. In addition, communication terminals without ATM communication functions can also access the AT via a proxy server.
The use of high-speed information transfer by M is realized.

In the embodiment using the password, the VC-TAG management table 5M on the server side generates a password at the same time as the selection of the VC-TAG in step 6 after receiving the new session ID allocation REQ. Is stored in the VC-TAG management table 5M, and the communication control unit 7M sends it to the communication control unit 7S (FIG. 2 (8)).
Include the generated password in SETUP-RESP. Then, when transmitting the SETUP message in FIG. 3 (10), the communication control unit 7S writes the password notified by the SETUP-RESP into an information element called User-to-User IE. Then, the server receiving the SETUP-RESP changes the password in the SETUP-RESP to the VC-TA.
Check with the password in the G management table 5M.

In another embodiment using the public encryption method, the password is encrypted with the public encryption key of the client when the password is notified by SETUP-RESP in FIG. In another embodiment using a public encryption method, the password is encrypted when the password is included in the SETUP message in FIG. 3 (10), and the password received by the server is decrypted by the public decryption key of the client.

In another embodiment according to the present invention, when the client sends the SETUP message shown in FIG.
CellR in the Forward direction (direction from the calling side to the called side) of the ATM Traffic Descriptor information element in the TUP message
Specify ate as 0.

[0170]

As described above, according to the present invention,
It is possible to realize a communication application that generates a cut-through VC as far as possible and secures high-speed information transfer by ATM, while securing mutual connectivity with a conventional IP communication terminal having no ATM communication capability. In addition, only the cut-through VC for which the generation of the cut-through VC has been previously arranged can be called, an unauthorized application can be prevented from being executed even after the cut-through VC is generated, and the security of the system can be secured.

Further, it becomes possible to generate a cut-through VC across a FireWall, and it is possible to avoid a load concentration on the FireWall. Also, cut-through VCs are generated only when necessary, such as when transferring a large amount of information,
A cut-through VC is generated for communication with a small amount of transfer information, thereby preventing a reduction in communication efficiency.
Further, it is possible to set the band of the cut-through VC by estimating the achievable effective communication speed according to the capability of the communication terminal and the network environment. Further, even when the router on the route does not provide the NHRP function, communication using cut-through VC becomes possible.

[Brief description of the drawings]

FIG. 1 is a diagram showing an overall configuration of an embodiment of the present invention and a main block configuration of a communication terminal.

FIG. 2 is a diagram showing a message format.

FIG. 3 is a diagram showing a message format.

FIG. 4 is a diagram showing a message format.

FIG. 5 is a diagram showing a message format.

FIG. 6 is a flowchart of step 1.

FIG. 7 is a flowchart of step 2;

FIG. 8 is a flowchart of step 3;

FIG. 9 is a flowchart of step 4;

FIG. 10 is a flowchart of step 5;

FIG. 11 is a flowchart of step 6;

FIG. 12 is a flowchart of step 7;

FIG. 13 is a flowchart of step 8;

FIG. 14 is a flowchart of step 9;

FIG. 15 is a flowchart of step 10-1.

FIG. 16 is a flowchart of step 11;

FIG. 17 is a flowchart of step 12.

FIG. 18 is a flowchart of step 13;

FIG. 19 is a flowchart of step 10-2.

FIG. 20 is a flowchart of step 14;

FIG. 21 is a flowchart of step 15;

FIG. 22 is a flowchart of step 16;

FIG. 23 is a sequence diagram showing the procedure of FIGS. 6 to 22;

FIG. 24 is a diagram for explaining a procedure for exchanging HTTP messages using cut-through VC.

FIG. 25 is an exemplary view for explaining a procedure for exchanging HTTP messages using cut-through VC.

FIG. 26 is a flowchart of step 17;

FIG. 27 is a flowchart of step 18.

FIG. 28 is a flowchart of step 19;

FIG. 29 is a flowchart of step 20.

FIG. 30 is a flowchart of step 21.

FIG. 31 is a flowchart of step 22;

FIG. 32 is a flowchart of step 23.

FIG. 33 is a flowchart of step 24-1.

FIG. 34 is a flowchart of step 25;

FIG. 35 is a flowchart of step S26.

FIG. 36 is a flowchart of step 27.

FIG. 37 is a flowchart of step 24-2.

FIG. 38 is a flowchart of step 28;

FIG. 39 is a flowchart of step 29.

FIG. 40 is a flowchart of step 30.

FIG. 41 is a sequence diagram showing the procedure of FIGS. 26 to 40;

FIG. 42 is a diagram showing an embodiment in which a client function is implemented in an HTTP proxy.

FIG. 43 is a view for explaining an IP interface;

FIG. 44 is a view for explaining ATM-SVC generation using NHRP.

FIG. 45 is a view for explaining the principle of FireWall.

FIG. 46 is a view for explaining a problem (problem 3);

FIG. 47 is a view for explaining a problem (problem 4.) of NHRP.

FIG. 48 is a view for explaining a problem (problem 5).

FIG. 49 is a view showing a problem (problem 6.).

FIG. 50 is a diagram showing a problem (load concentration).

[Explanation of symbols]

 1M, 1S ATM-SVC communication unit 2M, 2S IP communication unit 3 Communication condition presentation unit 4 Communication condition confirmation unit 5M, 5S VC-TAG management table 6 VC-TAG allocation unit 7M, 7S Communication control unit 8M, 8S VC-TAG Management module 10, 20 Communication terminal 50 ATM communication network 70 IP routing network

Claims (19)

[Claims] 1. An apparatus comprising: a means for performing IP communication and a means for performing ATM communication; and setting up an ATM logical line between the communication partner device and the communication partner device by executing IP communication. Means for setting setting conditions, and means for setting an ATM logical line with the partner device in accordance with the setting; and for setting up an ATM logical line with the partner device for communication performed by the ATM. A communication device comprising: means for determining whether or not a logical line has been subjected to the setting conditions beforehand; and means for rejecting execution of the communication if the result of the determination is negative. . 2. A method according to claim 1, wherein the communication device that presents the conditions for setting the ATM logical line is a main terminal and the other communication device is a slave terminal. 2. A communication apparatus according to claim 1, further comprising means for making a request for setting a line by said slave terminal to said ATM communication network. 3. The means for making an agreement includes means for setting whether an ATM logical line is set up between the terminals and confirming whether or not communication is possible, and when the communication is not possible, transferring data by IP communication. 2. The communication device according to claim 1, further comprising: means for executing. 4. The communication device according to claim 1, wherein the setting condition includes an application executable on an ATM logical line, a communication condition, an identifier, and an ATM address. 5. The communication device according to claim 2, wherein the communication condition includes a maximum communication speed achievable by the main terminal. 6. A means for restricting an application permitted to be executed on an ATM logical line with a counterpart terminal set based on the agreement and disabling execution of an unauthorized application. 5. The communication device according to 4. 7. The communication according to claim 6, further comprising means for making it impossible to perform IP communication using the ATM logical line after the ATM logical line has been set up with a communication partner terminal. apparatus. 8. When a request to execute communication using an ATM logical line not previously agreed is detected as a result of the determination as to whether or not the ATM logical line has been previously agreed, this fact is notified on the network. 2. The communication apparatus according to claim 1, further comprising means for notifying said monitoring means. 9. The communication apparatus according to claim 1, further comprising means for automatically disconnecting the ATM logical line used for the data transfer after a predetermined time has elapsed from the completion of the data transfer. 10. The system according to claim 1, further comprising means for erasing the set conditions when the setting of the ATM logical line is not performed after a predetermined time has elapsed since the execution of the agreement.
The communication device as described. 11. The communication apparatus according to claim 2, further comprising means for confirming the validity of the partner terminal by using a password. 12. A method according to claim 11, further comprising means for confirming the validity of the partner terminal by using a password every time data transfer is started.
The communication device as described. 13. The communication apparatus according to claim 11, further comprising: means for encrypting a password; and means for decrypting the encrypted password. 14. The communication apparatus according to claim 13, wherein said encrypting means includes means for encrypting the password using a public key unique to a terminal to which the password is transmitted. 15. The communication device according to claim 2, wherein the main terminal is a server that distributes information, and the slave terminal is a client that acquires information. 16. The communication apparatus according to claim 15, wherein the server includes means for setting a communication band from the client to the server to “0” for the client when starting the ATM communication. 17. The communication apparatus according to claim 4, further comprising means for writing a part of the setting conditions of the setting conditions determined by the agreement in an ATM logical line setting request message for the ATM communication network. 18. The element of the part of the setting condition may be A
The communication device according to claim 17, wherein the communication device is an identifier and / or a password for a TM logical line. 19. An ATM communication network for performing communication by transmitting and receiving cells on a connection set by an ATM signaling procedure, and an I / F for performing communication by sequentially relaying IP packets based on the Internet protocol.
In an IP-ATM hybrid communication network including a P-routing network and a plurality of communication terminals connected to the two communication networks, the communication terminal communicates via the IP routing network via the ATM communication network. Means for requesting to perform data transfer, and means for performing data transfer on the ATM logical line in accordance with the request and rejecting communication on the ATM logical line other than the conditions agreed upon by the IP communication. Characteristic IP-ATM hybrid communication network.