KR101712922B1 - Virtual Private Network System of Dynamic Tunnel End Type, Manager Apparatus and Virtual Router for the same - Google Patents

Abstract

The present invention relates to a virtual private network system with a dynamic tunnel end type and a virtual router and a manager apparatus therefor. A tunnel end table including several pieces of tunnel end information is provided to a terminal and a virtual router so that a single virtual router can use a plurality of tunnel ends. The tunnel end dynamically selected according to a predetermined rule to dynamically change a tunneling attribute. Therefore, since the tunneling attribute changes dynamically for each VPN communication, external hacking is difficult compared with a general VPN system, and so, the security of data transmission and reception can be improved.

Description

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to a virtual private network system and a virtual router and a manager apparatus therefor,

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to a virtual private network (hereinafter referred to as 'VPN'), more specifically, a dynamic private network system with a dynamic tunnel end system and a manager apparatus therefor.

In the case of a general communication system, the client terminal is composed of a service providing server and a communication network connecting the client terminal and the service providing server.

Also, in order to provide various communication services such as finance, home automation, etc., it is necessary to connect to a plurality of service providing servers by using one terminal, and the communication network should also be appropriately separated for the multiple access.

On the other hand, a VPN is used so that a public communication network such as the Internet can be used as a dedicated line.

These VPNs can be implemented by placing separate gateways or routers between two end devices that are connected to each other, and tunneling, which is a system that provides a special communication scheme and encryption technique between a gateway or a router or between an end device and a gateway Tunneling < / RTI >

At this time, the tunneling encapsulates the packet of the lower layer communication protocol into the upper layer communication protocol, which means that communication is made between two points on the communication network.

That is, the devices at both ends, that is, both ends of the tunnel, which can not distinguish an ordinary packet from an encapsulated packet on a communication network, can unencapsulate the original packet.

It is called 'tunnel' because it can create invisible path between two equipments of public communication network such as the Internet, and the end of this tunnel can be defined as Tunnel End.

In the conventional VPN system, a virtual router defined in a gateway interworking with one or more servers is used as one independent tunnel end.

Accordingly, in the VPN system, in order to communicate between the terminal and the specific server, a tunnel must be formed between the virtual router (VR) linked with the server and the corresponding virtual router becomes the tunnel end.

In this state, the terminal generates a packet having a data structure including HoA, which is a home address defined by a general 5-tuple, and transmits a separate care-of address (CoA) for data transmission / Address) to the virtual router.

In the virtual router, the data transmission is performed by removing the CoA and then forwarding the packet to the corresponding server.

In this general VPN communication, at least one virtual router (VR) is defined in the gateway, and each virtual router can configure only one address as a tunnel end.
For example, Korean Unexamined Patent Application Publication No. 2006-0037556 discloses a configuration for forming tunneling between a user node and one tunnel end point.
That is, according to the related art, the virtual router can configure one tunnel end defined by only one public IP address and one port, and as a result, one address is used between virtual routers of one specific terminal Only tunnels could be formed.

delete

Therefore, even if the VPN system is used, the data transmitted / received between a specific terminal and a server goes through a certain tunnel end and is vulnerable to hacking.

That is, once tunneling is established between the terminal and the server in the existing VPN, the destination address (Dest. Address), the port number (Port No.), etc. defining the tunnel end are always used unchanged, Even if CoA is used, there is a disadvantage that the tunnel end address is kept constant and hacking is easy.

Accordingly, the present invention proposes a method for dynamically changing tunnel end information between a specific terminal and a virtual router in a VPN system in which a virtual router has a plurality of tunnel ends to enable a plurality of tunneling with a specific terminal.

It is an object of embodiments of the present invention to provide a VPN system capable of setting a plurality of tunnel ends in a single virtual router.

It is another object of the present invention to provide a VPN system capable of setting a plurality of tunnels between a single virtual router and a terminal and dynamically changing a tunnel end of a virtual router connected to a specific terminal.

Another object of the present invention is to provide a dynamic tunnel end table (DTE table) which shows a setting order of a plurality of tunnel ends of each virtual router defined in a gateway, And the virtual router provides a manager device for a VPN system that dynamically sets a plurality of tunneling dynamically with the terminal agent using the DTE table.

According to an aspect of the present invention, there is provided a tunnel including a tunnel defined by at least two public IP addresses, one public IP address selected from two or more port numbers, and one port number, And a manager device for generating a tunnel end table including a plurality of tunnel end information that can be set by the virtual router and delivering the tunnel end table to the terminal and the virtual router, The tunnel end table storing the tunnel end table and dynamically changing the tunnel end of the tunneling connected to the terminal based on the tunnel end table at predetermined intervals.

According to another embodiment of the present invention, there is provided a virtual router connected to a terminal by tunneling to perform VPN communication with the terminal, wherein the virtual router includes one public IP address selected from two or more public IP addresses and two or more port numbers, A plurality of tunnel ends defined by one port number can be set and a tunnel end table including a plurality of tunnel end information that can be set by the virtual router from an external manager device is received and stored, And a tunneling end of the tunneling connected to the terminal is dynamically changed at predetermined intervals.

According to another embodiment of the present invention, there is provided a manager apparatus connected to a terminal and a virtual router to control the terminal and the virtual router, wherein the virtual router includes at least two public IP addresses and one public IP Address and one port number, and the manager device generates a tunnel end table including a plurality of tunnel end information that can be set by the virtual router, and transmits the tunnel end table to the terminal and the virtual router And to dynamically change the tunnel end of the tunneling connected between the virtual router and the virtual router based on the tunnel end table by the virtual router and the terminal.

1 shows an example of a typical VPN communication network.
2 shows an example of a data structure of a packet transmitted and received between a terminal and a server in the VPN as shown in FIG.
3 shows an example of a general network address translation (NAT) communication network.
FIG. 4 shows the overall configuration of a VPN system according to an embodiment of the present invention.
5 illustrates a process of setting up a dynamic tunnel end (DTE) in a VPN system according to an embodiment of the present invention.
FIG. 6 is a diagram illustrating an apparatus registration and a tunnel end change process performed between a manager device and a gateway (virtual router) in a VPN system according to an embodiment of the present invention.
7 shows a detailed configuration of a manager device used in a VPN system according to an embodiment of the present invention.

Hereinafter, some embodiments of the present invention will be described in detail with reference to exemplary drawings. In the drawings, like reference numerals are used to denote like elements throughout the drawings, even if they are shown on different drawings. In the following description of the present invention, a detailed description of known functions and configurations incorporated herein will be omitted when it may make the subject matter of the present invention rather unclear.

In describing the components of the present invention, terms such as first, second, A, B, (a), and (b) may be used. These terms are intended to distinguish the components from other components, and the terms do not limit the nature, order, order, or number of the components. When a component is described as being "connected", "coupled", or "connected" to another component, the component may be directly connected or connected to the other component, Quot; intervening "or that each component may be" connected, "" coupled, "or " connected" through other components.

1 shows an example of a typical VPN communication network.

2 shows an example of a data structure of a packet transmitted and received between a terminal and a server in the VPN as shown in FIG.

1, a general VPN system includes a terminal 10, a gateway 20 including a plurality of virtual routers 22, and a plurality of servers 30 interworking with a gateway.

In this VPN system, in order to transmit a packet to a specific server, an agent installed in the terminal 10 adds an inner header, which is a 5-tuple packet, to the payload, .

At this time, as shown in FIG. 2A, the inner header includes a protocol, its own source address and source port number, and a destination address (Dest. Addr. ) And a destination port number (Dest. Port No.), and these inner headers can be expressed as HoA (Home Address).

The terminal agent generates an extension packet by adding an extension header or an outer header to the basic packet structure. The outer header includes a protocol, a source address of the terminal agent, and a source port number A destination address and a destination port number which are the address and port number of the virtual router 22 as a destination.

At this time, an extension header or an outer header can be expressed as a CoA (Care of Address).

Meanwhile, a dedicated communication path tunnel is formed between the terminal and the virtual router, and the terminal transmits the extension packet to the virtual router in the gateway through the tunnel.

Then, the corresponding virtual router removes the CoA from the extension packet, and then transmits the basic packet including only the payload and HoA to the server, thereby completing the packet transmission.

In the present specification, a VPN (Virtual Private Network) is an abbreviation of a virtual private network, which means a communication service providing a special communication system to use the Internet network as a private line.

That is, after a client and a specific server are connected to each other using a general-purpose communication network, both the communication devices have the same effect as dedicated communication using a predetermined communication protocol (protocol).

For such a VPN, a certain VPN program or terminal agent must be installed on the terminal (client) side. When the terminal agent is executed, the gateway or the server recognizes the data by processing the data with the predetermined protocol and transmitting the data to the gateway and the server .

In this case, a communication channel formed between a terminal and a server side similar to a dedicated line can be referred to as a VPN. In particular, a communication channel formed between a terminal and a virtual router can be expressed as a tunnel. A protocol for establishing tunneling between a terminal and a virtual router can use Point-to-Point Tunneling Protocol (PPTP) or Layer 2 Tunneling Protocol (L2TP) through a public network.

In this VPN system, an entity that enables VPN communication between a terminal and a server can be defined as a virtual router (VR), and a physical unit including a plurality of virtual routers can be defined as a gateway (G / W) have.

That is, as shown in FIG. 1, a plurality of virtual routers 22 are included in the gateway 20, and one or more servers 30 or server farms are linked to each of the virtual routers.

At this time, each virtual router is identified by using one public IP address and one port, and the public IP address and the port number of the virtual router can be expressed by the tunnel end information.

In the conventional VPN system as shown in FIG. 1, each virtual router can set only one tunnel between a specific terminal and itself.

For example, as shown in FIG. 1, the terminal 10 forms a first tunnel T1 with the virtual router 1 and forms a second tunnel T2 with the virtual router 2. At this time, the virtual router- And the tunnel end can be identified as tunnel end information defined by the IP address and the port number of the corresponding virtual router.

An example in which the terminal 10 performs VPN communication with the server 1 30 will be described as follows.

In the existing VPN system, only a single tunnel T1 (40) defined as one tunnel end between the terminal 10 and the virtual router 1 (VR1) is formed.

Using the tunnel T1, the terminal generates an extension packet 52 including a CoA and transmits it to the corresponding virtual router 22, and the virtual router removes the CoA from the basic packet 54 to the corresponding server .

At this time, as shown in FIG. 2A, the HoA or the inner header of the transmitted packet includes a protocol, a source address and a source port number, which are the IP address and port number of the terminal, And a destination address (Dest.addr.) And a destination port number (Port No.) which are the IP address and port number of the server 1. The CoA or extension header includes a protocol, A source address and a source port number which are a port number and a destination address and a destination port number which are an IP address and a port number of the virtual router 1 (VR1) No.).

At this time, the virtual router side tunnel end of the tunnel 1 can be defined as VR1 (IP, PortNo), which is the IP address and port number of the virtual router 1.

In the general VPN system as shown in FIG. 1, the virtual router can configure one tunnel end defined by only one public IP address and one port. As a result, one terminal Only tunnels could be formed.

Therefore, even if the VPN system is used, the data transmitted / received between a specific terminal and a server goes through a certain tunnel end and is vulnerable to hacking.

That is, in the VPN system as shown in FIG. 1, once tunneling is established between the terminal and the server, the destination address (Dest.Address), the port number (Port No.) Therefore, even if CoA is used, there is a disadvantage that hacking is easy because the address of the tunnel end is kept constant.

3 shows an example of a general network address translation (NAT) communication network.

The NAT system refers to the network address translator system used to translate private IP addresses into public IP addresses.

The NAT communication system includes an external terminal 60, a public communication network 62 such as the Internet, and a plurality of corresponding terminals 80 connected to the address translator 70 and the address translator.

The external terminal 60 generates and transmits a basic packet as shown in FIG. 2A using one of the corresponding terminals to be received or the public IP address of the address translator.

The address translator 70 converts the destination address (Dest.addr) included in the inner header or the HoA of the basic packet into a private IP address or a floating IP address assigned to the corresponding terminal from the public IP address, And may be expressed in other terms such as a router.

Using this NAT communication system, it is possible to save a public IP by converting a limited public IP into a plurality of internal private IPs, and by using an internal private IP, it is possible to increase the security against external intrusion, Is easy to manage.

However, in such a NAT system, there is a disadvantage that the corresponding terminal can not be an independent authorized communication entity because the corresponding terminal itself does not have a public IP address.

That is, since the corresponding terminal is assigned a private IP address under the control of the address translator in association with the address translator, but the public IP address is not assigned to each corresponding terminal, It can not be recognized as a communication node, and each corresponding terminal can be used only in conjunction with an address converter.

Therefore, the terminal connected to the address translator in the NAT system is limited to the client terminal such as the personal PC and the mobile terminal, and the server device can not be implemented as the NAT system.

In the embodiment of the present invention, the disadvantage of the general VPN system as shown in FIG. 1 or the NAT system as shown in FIG. 3 is solved, a plurality of tunnel ends can be defined in a single virtual router, A dynamic tunnel end table is generated as a dynamic information for dynamic information and stored in a virtual router and a terminal, and tunnel ending is performed by extracting tunnel end information included in a dynamic tunnel end table according to a certain rule.

According to the present invention, since a tunnel for VPN communication between a specific terminal and a specific virtual router is dynamically changed, the risk of external intrusion such as hacking or packet outflow is reduced, and the virtual router and the corresponding terminal connected thereto are registered with a public IP address It can be applied to server-client systems as well.

FIG. 4 shows the overall configuration of a VPN system according to an embodiment of the present invention.

4, a VPN system according to an embodiment of the present invention includes a gateway 200 including a terminal 100, at least one virtual router (VR) 210 connected to the terminal through tunneling, And a manager device 300 connected to the terminal and the virtual router to control the tunneling setting between the terminal and the virtual router.

The terminal 100 used in the present invention may be any communication means such as a general mobile communication terminal, a PC, a server computer, and the like, and an agent, which is software for performing the VPN communication function according to the present invention, is installed in the terminal.

The terminal agent receives the tunnel end table information generated for each virtual router from the manager device and stores the tunnel end table information in the dynamic tunnel end DB 110 inside the terminal. And a function of setting tunneling with the corresponding virtual router according to the selected tunnel end.

The gateway 200 according to the present invention means a communication node including one or more virtual routers 210, and may be expressed in other terms such as a home gateway and a router.

Each virtual router (VR) 210 included in the gateway is a communication node located between a terminal and a server (farm), and is a device that mediates VPN communication between a terminal and a server (farm) by tunneling with the terminal do.

The VPN communication system can be constructed using the communication protocol software that Linux-based MPLS L3 VPN technology uses to provide IPVPN services in routers or Ethernet switches. This L3 VPN technology can provide multi-protocol label switching (MPLS) virtual private network (VPN) services in an IP network environment based on standards defined by the Internet Engineering Task Force (IETF).

According to another aspect of the present invention, a virtual router includes a plurality of public IP addresses and a plurality of port numbers, one public IP address selected from a plurality of public IP addresses, and one port VPN tunneling can be established with the terminal using the number.

In other words, since the general virtual router shown in FIG. 1 has one public IP address and one port number, only one tunnel end can be established between the terminal and itself, each of the virtual routers according to the present embodiment has a plurality of And has a public IP address and a plurality of port numbers of the public IP address and the port number of the selected public IP address and port number.

At this time, one public IP address selected from a plurality of public IP addresses and one port number selected from a plurality of port numbers may be defined as tunnel end or tunnel end information.

Also, the tunnel end constitutes one of the attributes of tunneling formed between the virtual router and the terminal. Even if the tunnel end is changed, the tunneling between the virtual router and the terminal remains the same. However, Only the attribute is changed.

For example, if the virtual router 1 (VR1) has a total of i (i> 1) public IPs and a total of j (j> 1) port numbers, the tunnel end information that can be generated to the virtual router 1 Total i * j pieces.

That is, the virtual router 1 can set i * j tunnel ends in one tunneling between the network including the terminal and itself.

For example, the tunnel end information TE (IP 1, port number 2) is one of attributes of the tunneling set by the virtual router 1.

Each of the virtual routers 210 includes a dynamic tunnel end DB 220 for storing tunnel end table information received from the manager device.

That is, the virtual router 210 according to the present invention can set a plurality of tunnel ends defined by one public IP address and one port number selected from two or more public IP addresses and two or more port numbers, And a tunnel end table including a plurality of tunnel end information that can be set by the virtual router.

In addition, the virtual router 210 has a function of dynamically changing the tunnel end of the tunneling connected to the terminal based on the tunnel end table received from the manager device at predetermined intervals to change the attribute of the tunneling formed between the terminals.

In this specification, the tunnel end table information means a set of a plurality of tunnel end information which are generated for each virtual router and can be set by the corresponding virtual router.

If the public IP address and the port number held by the virtual router are Ii and j, respectively, the tunnel end table information in which the tunnel end information defined by i * j is configured in the form of a table may be the tunnel end table information.

The virtual router 210 may select one of a plurality of tunnel end information included in the tunnel end table received at predetermined intervals and then change the tunneling property with the terminal according to the selected tunnel end information.

In addition, the virtual router 210 may further receive rule information for selecting one of a plurality of tunnel end information included in the tunnel end table from the manager device. In accordance with the rule information received at this time, It is possible to dynamically select one of a plurality of tunnel end information included in the tunnel end table to change the tunneling attribute.

At this time, a rule for changing the tunnel end information and changing the tunneling can be performed by a sequential scheme (first rule), a random scheme (second rule), a hybrid scheme (a third rule and a fourth rule) , Which will be described in more detail below.

Of course, the rule information for changing the tunnel end information and changing the tunneling does not necessarily need to be received from the manager device.

Meanwhile, the tunneling change between the virtual router and the MS according to the present invention may be performed every time a packet is transmitted, or a predetermined number of packet transmission / reception may be satisfied, or may be performed every predetermined period.

For example, if the first rule of the sequential scheme is applied based on FIG. 4, the first tunnel end information included in the tunnel end table (for example, a public IP address 1 and the port number 1), and transmits the packet through the tunneling having the first tunneling attribute set between the terminal and the virtual router 1. In the second packet transmission or the next number of times / Which has a second tunneling attribute set between the terminal and the virtual router 1 according to second tunnel end information (e.g., public IP address 1 and port number 2) Lt; / RTI >

At this time, the packet transmitted to the virtual router by the terminal includes an IP address (Dest. Addr.) And a port number (Port No) of the corresponding virtual router defined by the selected tunnel end information in addition to the payload and the HoA, Lt; RTI ID = 0.0 > CoA. ≪ / RTI >

Of course, at this time, the inner header or HoA of the basic packet includes a protocol, a source address and a source port number of the terminal, a destination of the server to receive the packet, Address (Dest.addr.) And destination port number (Dest.Port No.).

That is, the terminal extracts specific tunnel end information from the stored tunnel end table according to the rule information, and then assigns the public IP address and the port number of the virtual router included in the selected tunnel end information to the destination address (Dest. Addr. And the destination port number (Dest. Port No).

The generated outer header or CoA is further added to the outside of the basic packet header (HoA) to generate an extended packet, and then transmitted to the virtual router through tunneling.

In the present embodiment, the protocol included in the HoA and the CoA may be UDP (User Datagram Protocol), but the present invention is not limited thereto.

The virtual router 210 receives the extension packet through tunneling set to the tunnel end selected by the same rule as the terminal, removes the CoA, and then transmits the basic packet to the destination server.

Each of the virtual routers 210 can request the manager device to update the tunnel end table information at predetermined intervals using the number of times of receiving the packet, the packet receiving capacity, or the elapsed time information after the tunneling setting, have.

More specifically, when the number of received packets from the terminal exceeds the threshold number of times or the duration after the tunneling setting exceeds the threshold time, the virtual router 210 generates a tunnel end table update request signal and transmits the tunnel end table update request signal to the manager device. The tunnel end table can be received from the manager device and stored.

The subsequent tunneling setting to the terminal is performed by newly updated tunnel end table and rule information.

The manager device 300 used in the present invention is a device connected to a terminal and a virtual router to control a terminal and a virtual router and generates a tunnel end table including a plurality of tunnel end information that can be set by a virtual router, To the virtual router.

The manager device 300 may further include a function of authenticating a terminal and a function of registering an initial device of a gateway or a virtual router, in addition to a function of generating and transmitting tunnel end table information. Will be described in more detail.

More specifically, the manager device 300 generates a tunnel end table, which is a list of a plurality of tunnel end information that the virtual router can set for each virtual router according to equipment registration of the virtual router or the gateway including the virtual router, To the virtual router.

In addition, when the tunnel end table update request is transmitted from the terminal or the virtual router, or when the preset tunnel end table update condition is satisfied, the manager device 300 generates a new tunnel end table for each virtual router, Lt; / RTI >

The manager device 300 further has a function of generating rule information, which is information on a rule for dynamically selecting one of a plurality of tunnel end information included in the tunnel end table, and transmitting the generated rule information to the terminal and the virtual router .

The terminal and the virtual router select one tunnel end of the plurality of tunnel ends included in the previously stored tunnel end table for each virtual router according to a rule defined in the rule information, You can change the properties of tunneling between routers.

Of course, the rule for selecting one of the plurality of tunnel end information included in the tunnel end table may be determined in advance so that the terminal and the virtual router can apply the rule. In this case, The tunnel end information selection process for tunneling change may be performed according to a predetermined rule.

Hereinafter, a rule for selecting one of a plurality of tunnel end information included in the tunnel end table will be described.

As a method of selecting one of the plurality of tunnel end information included in the tunnel end table, a sequential scheme (first rule), a random scheme (second rule), a hybrid scheme (a third rule and a fourth rule) , But the present invention is not limited thereto.

The first rule, which is a sequential scheme, sequentially selects and applies a plurality of tunnel end information included in the tunnel end table in a forward direction or a reverse direction.

For example, if the tunnel end table includes a total of i * j tunnel ends from (IP_1, PortNo_1) to (IP_i, PortNo_j), the first packet transmission or the first n packet transmission or the first At the time of transmission, through tunneling formed by a first tunneling attribute defined as a first tunnel end (IP_1, PortNo_1) of the table, and communicates through a second packet transmission or a packet transmission of n to 2n packets or a packet transmission , The tunneling having the second tunneling attribute defined by the second tunnel end (IP_1, PortNo_2) of the table is used.

According to the first rule of the sequential method, the system overhead is small because the first time the tunnel end table is referred to in the first data transmission / reception process, but the security may be weak when the tunnel end table is exposed.

Second, the second rule, which is a random method, is to randomly select and apply a plurality of tunnel end information included in the tunnel end table.

 At this time, when the second rule is applied, the rule information includes table version information (Table Version) indicating the version of the tunnel end table, virtual router number (VR No) which is the identifier of the virtual router, tunnel end information , And tunnel end selection information (n {IP, PortNo}) indicating the tunnel end.

The rule information is generated by the manager device 300 and transmitted to the terminal and the virtual router so that the two nodes can apply the same rule. However, the rule information is transmitted by including the rule information in the header of the packet, The tunnel end information may be selected according to the rule information.

That is, since the terminal and the virtual router receive and store the same tunnel end table from the manager device, using the rule information transmitted from the manager device or the transmitting side, the terminal and the virtual router select the same tunnel end according to the same rule You can do it.

According to the second rule of the random method, there is an advantage in that the security is maintained as long as the rule is unknown even if the tunnel end table is exposed. However, since the tunnel end table must be referred to each time of data transmission / reception, can do.

Third, the third rule, which is a hybrid method, is a method of applying a sequential scheme using one public IP address, and moving to another tunnel end of the tunnel end table by a predetermined skip parameter and selecting the third rule.

In the case of applying the third rule, the rule information includes table version information (Table Version) indicating the version of the tunnel end table, virtual router number (VR No) as an identifier of the virtual router, one public IP address information , Tunnel end skip information (n {skip point or skip count}) indicating the tunnel end information to be selected next, and the like.

For example, the tunnel end table includes a total of i * j tunnel ends from (IP_1, PortNo_1) to (IP_i, PortNo_j), and IP = 1, which is a public IP address included in the rule information according to the third rule, If the tunnel end skip information n {skip point or skip count} = 2 {3}, n = 2 tunnel ends (IP_1, PortNo_1), (IP_1, PortNo_2) are sequentially selected and skip count = 3 (IP_1, PortNo_5) to select and use the tunnel end.

According to the fourth rule, which is another mixing method, the sequential method is applied until a predetermined number of times, and the selected skip parameter is moved to another tunnel end of the tunnel end table and is selected.

In the case of applying the fourth rule, the rule information includes table version information (Table Version) indicating the version of the tunnel end table, virtual router number (VR No) which is the identifier of the virtual router, tunnel end And skip information (n {IP, skip point or skip count}).

For example, when the tunnel end skip information n {IP, skip point or skip count} included in the rule information according to the fourth rule is 2 {2, 3}, n = 2 tunnel ends (IP_1, PortNo_1) (IP_1, PortNo_2), and then selects a second public IP address (IP_2) and a tunnel end (IP_2, PortNo_3) defined by the skip point = 3 from the second public IP address.

By using the third rule and the fourth rule of the mixing method, the disadvantages of the sequential method and the random method can be compensated.

In other words, since the reference is only made when the tunnel end skip condition is satisfied without referring to the tunnel end table every time, the system overhead can be reduced and the weakening of the security of the sequential system can be compensated by the tunnel end skip condition.

The tunnel end selection rule can be changed according to a certain policy according to a certain policy, and the changed rule information must be transmitted to the terminal and the virtual router.

In this case, in case that the rule information is changed in synchronization with all of the transmitting and receiving sides, the immediately preceding rule version can be recognized for a certain period of time when the rule information is changed.

For example, if the rule information is changed, the sender sends the data to the tunnel end selected by the rule to be changed. However, if the previous version rule is applied at the receiver side, .

Of course, in this case, if the rule of the other party is not changed even after a lapse of a predetermined time, the reception of data from the corresponding party can be rejected.

As described above, according to the embodiment of the present invention, it is possible to provide a tunnel end table including a plurality of tunnel end information to a terminal and a virtual router so that a single virtual router can set a plurality of tunnel ends, By selecting the tunnel end dynamically, the tunneling property is changed.

Therefore, unlike the conventional VPN system as shown in FIG. 1, since the tunneling attribute is dynamically changed for each VPN communication, external hacking is difficult and the security of data transmission and reception can be improved.

In addition, in the conventional network address translation (NAT) system, a device interworking with a router is limited to a client terminal that does not have a public IP address. In contrast, according to the present invention, a device interworking with a virtual router becomes a server having a public IP address This is advantageous for server-client communication.

That is, in the existing NAT system, the partner terminal connected to the router or the address translator does not have a public IP address and thus can not be an independent communication entity. However, in the present invention, the server is connected to the virtual router, There is an advantage to be able to do.

5 illustrates a process of setting up a dynamic tunnel end (DTE) in a VPN system according to an embodiment of the present invention.

The gateway or the virtual router performs a device registration process to the manager device (S510)

This equipment registration process is performed to allow the manager device to identify the gateway or the virtual router and then provide basic information for generating the tunnel end table information for the virtual router.

In the device registration process, the gateway provides its own available resource information (the number of public IP addresses, etc.) to the manager device, and the manager information includes information (VR information) about the number of virtual routers operated by the gateway, The process of generating the star tunnel end table information can be performed.

This equipment registration process will be described in more detail with reference to FIG.

When the device registration is completed, the manager device authenticates the terminal after receiving the terminal authentication request from the terminal (S520)

When the terminal authentication and the equipment registration process of the gateway (virtual router) are completed, the manager apparatus generates a VR (DTE Table) which is tunnel end table information including a plurality of tunnel end information that can be set between the terminal and the virtual router (S530)

Of course, in this process, rule information for selecting one of a plurality of tunnel end information included in the tunnel end table can be generated together.

Next, the manager device transmits the generated virtual router-specific tunnel end table information VR (DTE Table) to the authenticated terminal and the corresponding virtual router (gateway), and the terminal and the virtual router transmit the received tunnel end table information VR Table) to the tunnel end DB (S535, S540)

After that, the terminal and the virtual router change the tunneling property using the newly selected tunnel end at predetermined intervals using the defined rule and the tunnel end table. Data transmission / reception by VPN is performed through tunneling defined as the changed tunnel end (S550)

The virtual router monitors whether the update condition of the tunnel end table is satisfied (S555). If the update condition of the tunnel end table is satisfied, the virtual router transmits a tunnel end table regeneration request to the manager device (S560)

In this case, the update condition of the tunnel end table may be a case where the time elapsed since the current tunneling setting is maintained is equal to or longer than the threshold time, or a case where the number of receipt of the packet received in the current tunneling becomes more than a threshold number, It is not.

In response to a request for regenerating the tunnel end table of the virtual router, the manager device generates a new tunnel end table and transmits the new tunnel end table back to the corresponding terminal and the virtual router to update the existing tunnel end table (S575, S580).

FIG. 6 is a diagram illustrating an apparatus registration and a tunnel end change process performed between a manager device and a gateway (virtual router) in a VPN system according to an embodiment of the present invention.

6, the gateway to operate the virtual router transmits a device registration request including its own identification information (G / W ID) and CoA information as its public IP address information to the manager device (S610)

Accordingly, the manager device stores the gateway information, generates virtual router information (VR information) to be operated by the gateway, and transmits the virtual router information (VR information) to the gateway (S615, S620)

The virtual router information (VR information) may include the number of virtual routers that the gateway can operate, information about the server (farm) linked to each virtual router, and the like.

That is, the manager device determines the function of each gateway for routing a plurality of servers (farms) and the number of virtual routers possessed.

Accordingly, when there are a plurality of gateways and servers (farms), the manager device performs the system configuration for the VPN communication between them, thereby effectively coping with changes in system components.

Next, the gateway transmits available resource information such as the number of public IP addresses and the number of ports held by the gateway to the manager device (S625)

In step S615, the manager apparatus generates a tunnel end table for each virtual router using the virtual router information (VR information) generated by the manager apparatus and the available resource information received from the gateway in step S615.

If there are two virtual routers to be handled by the gateway registered with the equipment and six public IP addresses and j ports among the available resource information transmitted from the gateway, the manager device sends virtual router 1 (VR1) and virtual It is possible to assign the public IP addresses 1 to 3 for the virtual router 1 (VR1) and the public IP addresses 4 to 6 for the virtual router 2 (VR2).

In this case, the manager apparatus transmits a total of 3 * j tunnel ends of TE (IP_1, PortNo_1), TE (IP_1, PortNo_2), ..., TE (IP_3, PortNo_j) which are tunnel end information for the virtual router 1 And transmits the tunnel end table VR1 (TE Table) to the virtual router 1 (VR1) and the terminal (S635)

Of course, it is possible to further generate rule information for selecting one of a plurality of tunnel end information included in the tunnel end table in the process of generating the tunnel end table for each virtual router or before and after the tunnel end table, and transmit the generated rule information to the terminal and the virtual router.

The rule information does not necessarily have to be generated by the manager device, but may be generated by another device as long as the terminal and the virtual router can identify the same rule information, or may be stored in advance in the terminal and the virtual router .

The virtual router receiving the tunnel end table information stores tunnel end table information and / or rule information in the tunnel end DB (S640)

In this case, since the same virtual router-specific tunnel end table and / or rule information is provided to the terminal, the virtual router forms tunneling according to one tunnel end selected from the tunnel end table according to rule information, and then transmits / receives data. S645)

Of course, the tunnel end information selected for the tunneling setting is dynamically changed according to a predetermined interval, so that data is transmitted / received through tunneling defined between different terminals and virtual routers at regular intervals.

7 shows a detailed configuration of a manager device used in a VPN system according to an embodiment of the present invention.

The manager apparatus according to the present invention includes a device registration / authentication unit 320, a VR management unit 330 for generating and delivering virtual router information at the request of the gateway, a tunnel end table for each virtual router, And a DTE DB 310 for storing a tunnel end table for all the virtual routers to be managed and the like.

The DTE table updating unit 350 may further include a DTE table updating unit 350 for generating and providing a new tunnel end table at a predetermined interval according to requests from the virtual router or the terminal.

After receiving the device registration request of the gateway and the authentication request of the terminal, the device registration / authentication unit 320 stores the information about the gateway to perform the device registration process, and authenticates the legitimate terminal using the ID of the terminal .

The VR management unit 330 generates virtual router information (VR information) to be operated by the gateway requesting device registration and transmits the generated virtual router information to the gateway. At this time, the virtual router information (VR information) The number of virtual routers available, and information about the server (farm) associated with each virtual router.

In this manner, the VR management unit 330 functions to set and manage the functions of each gateway and the number of virtual routers possessed for routing a plurality of servers (farms).

The DTE table management unit 340 determines a public IP address and a port number to be used by each virtual router based on the available resource information provided by the gateway and generates a tunnel end table including a plurality of tunnel end information for each virtual router And transmits the generated information to the terminal and the corresponding virtual router.

The DTE table management unit 340 may further generate rule information for dynamically selecting one of a plurality of tunnel end information included in the tunnel end table and transmit the generated rule information to the terminal and the virtual router have.

In addition, the DTE table management unit 340 stores the tunnel end table and / or rule information for each virtual router in the DTE DB 310.

The DTE table update unit 350 generates a new tunnel end table for the corresponding virtual router and transmits the generated tunnel end table to the terminal and the corresponding virtual router when a certain update condition is satisfied or a table regeneration request is transmitted from the terminal or the virtual router .

According to the present invention as described above, it is possible to provide a tunnel end table including a plurality of tunnel end information to a terminal and a virtual router so that a single virtual router can establish a plurality of tunneling settings, End dynamically to change the tunneling attributes dynamically.

Therefore, since the tunneling attribute changes dynamically for each VPN communication, external hacking is difficult compared with the general VPN system as shown in FIG. 1, and therefore, security of data transmission and reception can be improved.

In addition, in the conventional network address translation (NAT) system, a device interworking with a router is limited to a client terminal that does not have a public IP address. According to the present invention, a device interworking with a virtual router becomes a server having a public IP address This is advantageous for server-client communication.

It will be apparent to those skilled in the art that various modifications and variations can be made in the present invention without departing from the spirit or scope of the present invention as defined by the appended claims. , Separation, substitution, and alteration of the invention will be apparent to those skilled in the art. Therefore, the embodiments disclosed in the present invention are intended to illustrate rather than limit the scope of the present invention, and the scope of the technical idea of the present invention is not limited by these embodiments. The scope of protection of the present invention should be construed according to the following claims, and all technical ideas within the scope of equivalents should be construed as falling within the scope of the present invention.

100: terminal (agent) 110, 220: DTE table DB
200: Gateway 210: Virtual Router (VR)
300: manager device 310: DTE DB
330: VR management unit 340: DTE table management unit
400: Server Farm 410: Server

Claims (11)

A virtual router capable of establishing a plurality of tunnel ends which are defined by one public IP address and one port number selected from among two or more public IP addresses and two or more port numbers,
A manager device for generating a tunnel end table including a plurality of tunnel end information that can be set by the virtual router and delivering the tunnel end table to the terminal and the virtual router;
/ RTI >
Wherein the virtual router stores the tunnel end table and changes the tunneling property by dynamically changing the tunnel end of the tunneling connected to the terminal based on the tunnel end table at a predetermined interval,
The manager apparatus generates rule information for selecting one of a plurality of tunnel end information included in the tunnel end table and transmits the generated rule information to the terminal or the virtual router,
Wherein the virtual router dynamically selects one of a plurality of tunnel end information included in the tunnel end table at predetermined intervals according to the rule information to change an attribute of the tunneling,
The rule information includes first rule information for sequentially selecting a plurality of tunnel end information included in a tunnel end table, second rule information for randomly selecting one of a plurality of tunnel end information included in the tunnel end table, Third rule information for selecting the tunnel end information to sequentially change the port number from one public IP address to skip from the preset port to another port number, and sequentially changing the public IP address and the port number, And fourth rule information for selecting tunnel end information to skip to another public IP address and a different port number at a location of the virtual private network system. delete The method according to claim 1,
The virtual router generates a tunnel end table update request signal and transmits the tunnel end table update request signal to the manager device when the number of packet reception times is more than a threshold number of times or the duration after setting tunneling is longer than the threshold time, To the terminal and the virtual router. delete delete delete 1. A virtual router connected to a terminal by tunneling and performing VPN communication with the terminal,
The virtual router can set a plurality of tunnel ends defined by one public IP address and one port number selected from two or more public IP addresses and two or more port numbers,
Receiving and storing a tunnel end table including a plurality of tunnel end information that can be set by the virtual router from an external manager device,
And changing a tunneling end of the tunneling connected to the terminal based on the tunnel end table at a predetermined interval,
Wherein the virtual router further receives rule information for selecting one of a plurality of tunnel end information included in the tunnel end table from the manager apparatus,
And dynamically selecting one of a plurality of tunnel end information included in the tunnel end table at predetermined intervals according to the received rule information to change an attribute of the tunneling,
The virtual router generates a tunnel end table update request signal and transmits the tunnel end table update request signal to the manager device when the number of received packets from the terminal exceeds the threshold number of times or the duration after the tunneling change exceeds the threshold time, From the manager device, and stores the received virtual router. delete delete 1. A manager device connected to a terminal and a virtual router for controlling the terminal and a virtual router,
The virtual router may set a plurality of tunnel ends defined by one public IP address and one port number selected from two or more public IP addresses and two or more port numbers,
Wherein the manager device generates a tunnel end table including a plurality of tunnel end information that can be set by the virtual router and transfers the tunnel end table to the terminal and the virtual router so as to allow the virtual router and the terminal to transmit the tunnel end table based on the tunnel end table The tunnel end which is an attribute of tunneling connected between the terminal and the virtual router is dynamically changed at a predetermined interval,
The manager apparatus generates rule information for selecting one of a plurality of tunnel end information included in the tunnel end table and transmits the generated rule information to the terminal or the virtual router,
The manager device generates a new tunnel end table according to a tunnel end table update request signal transmitted from the virtual router when the number of packet transmission / reception times through the tunneling is greater than or equal to a threshold number of times, or the duration after tunneling is greater than or equal to a threshold time To the terminal and the virtual router. 1. A manager device connected to a terminal and a virtual router for controlling the terminal and a virtual router,
The virtual router may set a plurality of tunnel ends defined by one public IP address and one port number selected from two or more public IP addresses and two or more port numbers,
Wherein the manager device generates a tunnel end table including a plurality of tunnel end information that can be set by the virtual router and transfers the tunnel end table to the terminal and the virtual router so as to allow the virtual router and the terminal to transmit the tunnel end table based on the tunnel end table The tunnel end which is an attribute of tunneling connected between the terminal and the virtual router is dynamically changed at a predetermined interval,
The manager apparatus generates rule information for selecting one of a plurality of tunnel end information included in the tunnel end table and transmits the generated rule information to the terminal or the virtual router,
The rule information includes first rule information for sequentially selecting a plurality of tunnel end information included in a tunnel end table, second rule information for randomly selecting one of a plurality of tunnel end information included in the tunnel end table, Third rule information for selecting the tunnel end information to sequentially change the port number from one public IP address to skip from the preset port to another port number, and sequentially changing the public IP address and the port number, And fourth rule information for selecting tunnel end information to skip to another public IP address and a different port number from the location.

Images