Vpn system and router

Description: TECHNICAL FIELD [Detailed description of the invention]

【0001】

[Technical field to which the invention belongs]

The present invention relates to a VPN (Virtual Private Network) and routers constituting the VPN.

【0002】

[Conventional technology]

VPN is a service that provides users with an environment that makes them feel as if they are using the network privately while using a public network. In the conventional technology, as shown in FIG. 5, when a user configures a VPN between base 20 and base 23, a dedicated line 24 is borrowed from a network provider and connected between base 20 and base 23. It is common to configure a VPN. In this case, the leased line 24 is configured by routers 21 and 22 installed in IP network 1. In addition, routers 21 and 22 are set by the management system 2 of the network provider that manages the IP network 1.

【0003】

[Problems to be Solved by the Invention]

However, with such a conventional VPN, when changing the VPN topology or bandwidth, the VPN side cannot control the network of the network provider, so apply to the network provider and make the change from the management system of this network provider. There is a problem that it needs to be done and lacks responsiveness.

【0004】

The present invention has been made in such a background, and the VPN administrator can immediately change the VPN topology and the bandwidth in the network of the network provider, and further, the dedicated line can be used. Efficient operation allows you to charge a dedicated line only for what you actually use, and the network provider can effectively use the resources of the entire network, so the capital investment effect is large, and one router can be used. It is an object of the present invention to provide a VPN system, a router, a program, and a recording medium capable of efficiently operating the router by showing it as a separate router for each VPN.

【0005】

[Means for solving problems]

In the present invention, in one or a plurality of VPNs configured by using the IP networks of one or a plurality of network providers, a router is provided at a route in the IP network constituting the VPN, and the IP is referred to the router. It is characterized in that it is possible to set based on information including the network topology and transmission band related to the VPN and collect management information including communication traffic information and failure information from the means for managing the VPN as well as the means for managing the network.

【0006】

In this way, the management information is collected from the means for managing the VPN as well as the means for managing the IP network, and the means for managing the VPN changes the settings from the user regardless of the means for managing the IP network. Whether or not the request can be handled can be immediately determined from the management information collected. Then, based on this determination, if the request can be handled, the means for managing the VPN can immediately change the router settings in response to the request.

【0007】

In this way, since the means for managing the VPN can independently respond to the request, the setting change request from the user can be immediately realized. As a means for managing the IP network, the VPN system may be configured to provide support only when a request that cannot be handled by the means for managing the VPN alone occurs.

【0008】

In addition, in the router provided on the route that constitutes the VPN of the IP network used by one or more VPNs, one or more IP addresses are given, and each of the one or more IP addresses is assigned to the VPN. Individually correspond, one or more input / output ports are assigned to each of the VPN individually, and the setting and management of the VPN individually from the management system of the VPN using the IP address corresponding to the VPN individually. It is characterized by collecting information.

【0009】

This allows one real router to function as multiple virtual routers. This virtual router can increase or decrease the number of I / O ports or increase or decrease the processing capacity depending on the situation within the range that does not exceed the capacity of the actual router, which also immediately responds to the request. Make it easy to respond to.

【0010】

In this way, the VPN administrator can immediately change the VPN topology and bandwidth within the network of the network provider, and only the amount actually used by the efficient operation of the dedicated line. The network provider can effectively use the resources of the entire network, so the capital investment effect is large, and the router is made more efficient by showing one router as another router for each VPN. It can be operated well.

【0011】

That is, the first aspect of the present invention is a VPN system including a plurality of bases and a router, and the router is provided with means for setting a dedicated line for configuring a VPN between the plurality of bases. ..

【0012】

Here, a feature of the present invention is that a means for managing the VPN is provided, and the means for managing the VPN includes a means for collecting management information including communication traffic information and failure information regarding the VPN from the router. A means for receiving a request for changing the network topology and transmission band of the VPN from the base, and a means for determining whether or not the receiving means can respond to the received request based on the management information collected by the collecting means. When it is determined that the request can be handled by the means for determining the request, the router is provided with a means for setting the network topology and the transmission band of the VPN based on the request.

【0013】

N (N is a natural number) IP addresses are assigned to the router, and one or more input / output ports are assigned to one IP address to make the router as N virtual routers. It is desirable to divide the functions and allocate the virtual router as a router used to configure the VPN.

【0014】

Further, a means for managing the VPN is provided for each of a plurality of VPNs, and the collecting means is a means for limiting the collection of the management information regarding the own VPN and prohibiting the collection of the management information regarding the other VPN. Can also be provided.

【0015】

According to this, confidentiality in each private network can be ensured. Even in this case, the means for managing the IP network collects management information about all VPNs, and the means for managing individual VPNs can respond to requests only with the management information collected within the own VPN. When in trouble, you can configure your VPN system so that the means of managing your IP network supports the means of managing individual VPNs.

【0016】

The second aspect of the present invention is a router provided with a means for setting a dedicated line for configuring a VPN between a plurality of bases, and a feature of the present invention is that N IP addresses are assigned. By assigning one or more input / output ports to one IP address, the functions are divided as N virtual routers, and the virtual routers are assigned as routers used to configure the VPN. It is in the place where it is done.

【0017】

A third aspect of the present invention is to provide the information processing device with a plurality of bases and a router by installing the information processing device, and the router is used to form a VPN between the plurality of bases. It is a program that realizes a function corresponding to a device applied to a VPN system equipped with a means for setting a dedicated line.

【0018】

Here, a feature of the present invention is to realize a function of managing the VPN, and as the management function, a function of collecting management information including communication traffic information and failure information related to the VPN from the router. A function of accepting a request for changing the network topology and transmission band of the VPN from the base, and a function of determining whether or not the request accepted by this accepting function is feasible based on the management information collected by the collecting function. When it is determined that the request is feasible by this determination function, the function of setting the network topology and transmission band of the VPN based on the request for the router is realized.

【0019】

A function to manage the VPN for each of a plurality of VPNs is realized, and as a function to collect the VPN, a function to limit the collection of the management information related to the own VPN and prohibit the collection of the management information related to the other VPN is realized. You can also let it.

【0020】

A fourth aspect of the present invention is the information processing apparatus readable recording medium on which the program of the present invention is recorded. Since the program of the present invention is recorded on the recording medium of the present invention, the information processing apparatus can install the program of the present invention using the recording medium. Alternatively, the program of the present invention can be installed directly in the information processing apparatus from a server holding the program of the present invention via a network.

【0021】

As a result, the VPN administrator can immediately change the VPN topology and bandwidth within the network of the network provider by using an information processing device such as a computer device, and further, the efficiency of the dedicated line can be changed. The dedicated line charge can be charged only for the amount actually used by the operation, and the network provider can effectively use the resources of the entire network, so the capital investment effect is large, and one router can be used for each VPN. By showing it as a separate router, it is possible to realize a VPN system and router that can operate the router efficiently.

【0022】

BEST MODE FOR CARRYING OUT THE INVENTION

The VPN system according to the embodiment of the present invention will be described with reference to FIGS. 1 to 4. FIG. 1 is an overall configuration diagram of the VPN system of this embodiment. FIG. 2 is a diagram for explaining the topology change of the first embodiment. FIG. 3 is a configuration diagram of the router of this embodiment. FIG. 4 is a flowchart showing the operation of the VPN management system of the third embodiment.

【0023】

As shown in FIG. 1, this embodiment includes a plurality of bases 10-1, 10-2, 11-1, 11-2, 12-1, 12-2, and routers 3 to 7. 3 to 7 are VPN systems that set up a dedicated line for configuring a VPN between multiple bases 10-1, 10-2, 11-1, 11-2, 12-1, and 12-2.

【0024】

Here, the feature of this embodiment is that the management systems 10, 11 and 12 for managing the VPN are provided, and the management systems 10, 11 and 12 are the management including the communication traffic information and the failure information related to the VPN. Collects information from routers 3 to 7 and accepts requests to change the network topology and transmission band of the VPN from bases 10-1, 10-2, 11-1, 11-2, 12-1, and 12-2. , Judgment is made based on the management information collected whether or not this accepted request can be handled, and when it is judged that the request can be handled by this judgment, the network topology and transmission band of the VPN based on the request are determined by the router. It is in the place to set for 3 ~ 7.

【0025】

As shown in Fig. 3, N IP addresses are assigned to routers 3 to 7, and N routers 3 to 7 are assigned by assigning one or more input / output ports to one IP address. Virtual routers 3-1 to 3-3, 4-1, 5-1, 5-2, 6-1, 6-2, 7-1 are divided into functions, and the virtual routers 3-1 to 3-3, Allocate 4-1, 5-1 and 5-2, 6-1, 6-2 and 7-1 as routers used to configure the VPN.

【0026】

Further, as shown in FIG. 1, management systems 10, 11 and 12 for managing the VPN are provided for each of a plurality of VPNs, and when the management systems 10, 11 and 12 collect the management information, , It is also possible to limit the collection of the management information regarding the own VPN and prohibit the collection of the management information regarding the other VPN. In this way, when there are multiple VPNs, the management system of one VPN may be restricted so that it cannot collect management information about other VPNs.

【0027】

The management systems 2, 10, 11 and 12 of this embodiment can be realized by using a computer device which is an information processing device. That is, by installing it on a computer device, the computer device is provided with a plurality of bases 10-1, 10-2, 11-1, 11-2, 12-1, 12-2, and routers 3 to 7. , These routers 3 to 7 are VPN systems that set up a dedicated line to configure a VPN between multiple bases 10-1, 10-2, 11-1, 11-2, 12-1, 12-2. It is a program that realizes the function corresponding to the device applied to, and realizes the function corresponding to the management systems 10, 11 and 12 that manage the VPN, and as the function corresponding to the management systems 10, 11 and 12. , A function to collect management information including communication traffic information and failure information related to the VPN from routers 3 to 7, and from bases 10-1, 10-2, 11-1, 11-2, 12-1, 12-2 A function of accepting a request for changing the network topology and transmission band of the VPN, a function of determining whether or not the accepting function can respond to the accepted request, and a function of determining based on the management information collected by the collecting function. When it is determined that the request can be handled by the judgment function, a program that realizes the function of setting the network topology and transmission band of the VPN based on the request for the router is installed in the computer device. The computer device can be a device corresponding to the management systems 10, 11 and 12 of the first embodiment.

【0028】

Alternatively, as the collecting function, the computer device can be installed by installing a program in the computer device that realizes a function of collecting the management information related to the own VPN in a limited manner and prohibiting the collection of the management information related to another VPN. It can be an apparatus corresponding to the management systems 10, 11 and 12 of the third embodiment.

【0029】

Since the program of this embodiment is recorded on the recording medium of this embodiment, the computer device can install the program of this embodiment using this recording medium. Alternatively, the program of this embodiment can be installed directly from the server holding the program of this embodiment to the computer device via the network.

【0030】

This allows the VPN administrator to instantly change the VPN topology and bandwidth within the network of the network provider using a computer device, and the efficient operation of the dedicated line makes it practically possible. Only the amount used can be charged as a dedicated line, and the network provider can effectively use the resources of the entire network, so the capital investment effect is large, and one router can be seen as another router for each VPN. This makes it possible to realize a VPN system and router that can operate routers efficiently.

【0031】

Hereinafter, this embodiment will be described in more detail.

【0032】

(First Example) The first embodiment will be described with reference to FIGS. 1 and 2. In the first embodiment, the outline of the VPN system of the present embodiment will be described. In Figure 1, 1 is the IP network, 2 is the management system of the network provider that manages the IP network, 3, 4, 5, 6 and 7 are the physical routers managed by the network provider, 3-1, 3-2, 3 -3 is a VPN-A, VPN-B, VPN-C virtual router that uses router 3, 4-1 is a VPN-A virtual router that uses router 4, and 5-1 and 5-2 are VPN-5. VPN-B and VPN-C virtual routers used, 6-1 and 6-2 are VPN-A and VPN-B virtual routers using router 6, 7-1 is VPN-C using router 7. Virtual router, 10 is VPN-A management system, 10-1 and 10-2 are VPN-A bases, 11 is VPN-B management system, 11-1 and 11-2 are VPN-B bases, 12 Is a VPN-C management system, and 12-1 and 12-2 are VPN-C bases.

【0033】

As an example, when VPN-A applies for a 3Mb / s leased line between base 10-1 and base 10-2 to the network provider that manages IP network 1, the network provider goes from management system 2 to routers 3 and 4. , Set the band 3Mb / s, port number used, and IP address for 6 and form a dedicated line between routers 3, 4, and 6, and notify VPN-A of the result.

【0034】

After that, if VPN-A wants to change the bandwidth to 5Mb / s, the management system 10 can set the bandwidth to 5Mb / s for virtual routers 3-1, 4-1 and 6-1. In this way, if there is a bandwidth margin between routers 3, 4, and 6, it is easy for VPN-A itself to expand the bandwidth of VPN-A to 5 Mb / s.

【0035】

Management system 2 collects management information from each router to keep track of usage status, and can know that VPN-A has changed the bandwidth from 3Mb / s to 5Mb / s. If VPN-A needs to increase the bandwidth, and if there is not enough transmission line capacity between routers 3 and 4, change the topology and use it exclusively, as shown by the broken line in Fig. 2. A part of the line can be set between routers 3, 5 and 6 to secure the required bandwidth. Similarly, VPN-B and VPN-C can also change the bandwidth and topology from their own management systems 11 and 12, respectively, after forming a dedicated line on IP network 1.

【0036】

In the first embodiment, each management system 10, 11 and 12 grasps the management information of all VPNs, and each management system 10, 11 and 12 are all virtual routers 3-1 to 3-3 and 4-1. , 5-1 and 5-2, 6-1, 6-2 and 7-1 can be set.

【0037】

Therefore, the management system 2 in the first embodiment is configured to monitor the entire IP network and provide support only when an unforeseen situation that is difficult for each management system 10, 11 or 12 occurs. As a result, most of the actual operation of the VPN system can be performed by the management systems 10, 11 and 12.

【0038】

(Second Example) The second embodiment will be described with reference to FIG. In the second embodiment, the router of this embodiment will be described. P1 to P8 are input / output ports. This router has an IP address IP-A for VPN-A (for example, 128.19.254.7), an IP address IP-B for VPN-B (for example, 128.19.254.9), and an IP address IP- for VPN-C. C (eg 128.19.254.16) is assigned. VPN-A uses input port P1 and output port P5 for 2Gb / s, VPN-B uses input ports P2, P3, output ports P6, and P7 for 6Gb / s, and VPN-C uses input port. 1Gb / s is used using P4 and output port P8. The transmission capacity with the next node is secured for 10 Gb / s.

【0039】

If VPN-C changes the transmission band from 1Gb / s to 2Gb / s, VPN-C management system 12 sends an OSPF (Open Shortest Path First) packet with IP address IP-C to the virtual router. Instruct 3-3, 5-2, and 7-1 to expand the transmission band.

【0040】

Virtual routers 3-3, 5-2, and 7-1 determine that the packet is from the IP address IP-C to itself and is for VPN-C, interpret the contents of the packet, and 1Gb / s. Know that it is a request to increase the bandwidth of the minute. If it is possible to determine whether the request can be executed, increase it by 1 Gb / s, and return the execution result to the VPN-C management system 12 by OSPF packet with the source IP address as IP-C. Similarly, in VPN-A and B, instructions to the virtual router can be given by OSPF packets with the IP address as IP-A.

【0041】

In this way, by giving one router an IP address for VPN support, it is possible to control each VPN and not receive control from other VPNs, so one router can be used as a virtual router for each VPN. There is an advantage that you can show it.

【0042】

(Third Example) The third embodiment will be described with reference to FIG. In the third embodiment, the confidentiality between each VPN can be improved by limiting the collection of management information in the VPN to the management system of the VPN and prohibiting the collection of the management information of other VPNs. Even in this case, the management system 2 of the IP network collects the management information of all VPNs, and the management information 10, 11 and 12 of each VPN make a request only with the management information limited to the own VPN collected by itself. When it is difficult to deal with the above, configure the VPN system so that the IP network management system 2 supports the individual VPN management systems 10, 11 and 12.

【0043】

That is, in the third embodiment, as shown in FIG. 4, the request is accepted (step 1), and based on the management information collected in the own VPN, it is determined whether or not the request can be handled only by the own virtual router (step 1). Step 2) If it cannot be handled, request the IP network management system 2 to handle it (step 3). If it can be handled, take action to handle the request (step 4).

【0044】

In the example shown in Fig. 2, when VPN-A needs to increase the bandwidth, there is no margin in the transmission line capacity between routers 3 and 4, and the topology is changed so that part of the leased line is used by router 3. , 5 and 6 are set, but in such a case, the management system 10 can no longer respond to the request only by the self-virtual routers 3-1, 4-1 and 6-1, and the management system 2 To respond to the request.

【0045】

Therefore, the management system 2 in the third embodiment monitors the entire IP network and responds to the request in cooperation with the management systems 10, 11 and 12 in response to the request from the management systems 10, 11 and 12. It is composed of. As a result, compared to the first embodiment, the management system 2 is responsible for a part of the operation of the VPN system, but the confidentiality between the VPNs is improved and the management systems 10, 11 and 12 are separated from each other. If there is a conflict in the network topology and transmission band settings, this can be arbitrated by the management system 2.

【0046】

(Summary of Examples) In the VPN system of this example, the VPN administrator can easily change the bandwidth and topology from the VPN management systems 10, 11 and 12, so that the leased line can be operated efficiently. There is an advantage that the leased line charge can be set only for the amount actually used. In addition, the network provider can entrust the operation of the leased line to the management systems 10, 11 and 12 of each VPN, and the resources of the entire network are effectively used, so that there is an advantage that the capital investment effect is large.

【0047】

Also, by giving one router an IP address that supports VPN, it can be controlled for each VPN, and it is not controlled by other VPNs, so one router can be seen as a separate router for each VPN. There is an advantage that can be done.

【0048】

[Effect of the invention]

As described above, according to the present invention, the VPN administrator can immediately change the VPN topology and bandwidth within the network of the network provider. Furthermore, the VPN administrator can charge the leased line only for the amount actually used by the efficient operation of the leased line. In addition, since the resources of the entire network are effectively used, the network provider has a large capital investment effect, and can operate the router efficiently by showing one router as another router for each VPN.

[Simple explanation of drawings]

[Figure 1]

Overall configuration diagram of the VPN system of this embodiment.

[Figure 2]

The figure for demonstrating the topology change of 1st Example.

[Fig. 3]

The block diagram of the router of this embodiment.

[Fig. 4]

The flowchart which shows the operation of the VPN management system of 3rd Example.

[Fig. 5]

The figure which shows the VPN system configuration example by the prior art.

[Explanation of symbols]

1 IP network 2, 10, 11, 12 management system 3 ~ 7, 21, 22 routers 3-1 ~ 3-3, 4-1, 5-1, 5-2, 6-1, 6-2, 7-1 Virtual router 10-1, 10-2, 11-1, 11-2, 12-1, 12-2, 20, 23 bases 24 Leased line