KR20050002345A - Leyer 3 switch having interceptive function of using fixed internet protocol address and method therefor - Google Patents

Abstract

The present invention relates to a technique for blocking traffic using a static IP in a Layer 3 switch of a network using a Dynamic Host Configuration Protocol (DHCP) Internet Protocol (IP) assignment scheme.

To this end, the present invention transmits the packet to a corresponding output port when a packet having a transmission history is transmitted, and if the packet having no transmission history is transmitted, whether the packet is a packet using an IP address allocated from a DHCP server. After confirming, if the packet is identified as a packet using the IP address allocated from the DHCP server, the transmission history of the packet is stored in the L3 table, and then the packet is output to the corresponding output port. As a result, if the packet is not identified as a packet using the IP address allocated from the DHCP server, the packet is discarded after storing the discarding history of the packet in the L3 table.

Description

Layer 3 switch having a fixed IP blocking function and a method of blocking a fixed IP using the same {{Leyer 3 switch having interceptive function of using fixed internet protocol address and method therefor}

The present invention relates to a layer 3 switch having a static IP usage blocking function and a static IP usage blocking method using the same, and more specifically, to a layer 3 switch of a network using a DHCP (Dynamic Host Configuration Protocol) IP (Internet Protocol) allocation scheme. The present invention relates to a technique for blocking traffic using a static IP in a.

Among the IP allocation methods of the high speed access service currently in commercial service, the DHCP allocation method, which is a dynamic IP address allocation method, is used for more efficient IP address allocation to high speed access providers and subscribers. DHCP method is also used among IP allocation methods in local area network environment.

In this method, the subscriber station automatically requests an IP address when booting. When the request message is sent to a high-speed access provider or a DHCP server in a company, the DHCP server assigns an IP address to the subscriber station. The assigned IP address is used for normal network service.

As shown in FIG. 1, when a subscriber station requests IP allocation to a DHCP server in a network environment using DHCP (S2), the DHCP server allocates an IP to the subscriber station during a lease time (S4). . Preferably, when a DHCP server is requested to allocate an IP address from a subscriber station, the DHCP server allocates an arbitrary IP address in an IP band and then sends an ARP Request message for the IP address to check whether the IP address is used in the network. If it is transmitted by broadcast and there is no response within a specific time, it is determined that the IP address is not used in the network, and the IP address is allocated to the subscriber station that has requested the IP address assignment.

The subscriber station assigned the IP address can use the Internet service using the assigned IP address. When the DHCP server is requested to renew the use of the IP from the subscriber station (Yes in S8), the subscriber station is sent to the subscriber station. If the allocated IP is kept as it is, and the extension of the IP usage is not requested from the subscriber station (No in S8), the lease time is checked for expiration, and when the lease time expires, the IP allocated to the subscriber station is recovered and another Allow the subscriber station to use the IP.

On the other hand, in the DHCP method of allocating an IP address, when a malicious user arbitrarily sets and uses an IP address in the IP band managed by a DHCP server as a fixed IP, a normal DHCP user collides with the IP address assigned by the DHCP server. It will interfere with communication. In addition, when confirming whether the DHCP server uses an IP address to be allocated through an ARP Request message, if a terminal using a fixed IP intentionally responds, the IP cannot be allocated to a bona fide subscriber terminal. For this reason, the number of IP bands used by normal DHCP IP users decreases, and the DHCP server not only needs more IP resources, but also increases the load on the network traffic due to the characteristics of general fixed IP users (eg, server operation). Occurs.

On the other hand, a Layer 3 switch that performs routing using an IP address in the Layer 3 layer cannot use a fixed IP in the IP band because the subscriber cannot be assigned an IP address from a DHCP server or arbitrarily used as a static IP in the IP band. Even in the case of traffic, packet forwarding is normally performed.

Referring to the flowchart shown in FIG. 2, the packet transmission procedure of the layer 3 switch will be briefly described.

When a packet is received from a specific port, the layer 3 switch processes the layer 1 portion of the packet (S20), and then processes the layer 2 and layer 3 portions. If the destination IP exists in the routing table, the corresponding packet is received. Determines that the packet should be forwarded (Yes in S26), and determines whether the called IP exists in the L3 table of the L3 switching chip (S30).

As a result of the determination, if the destination IP of the packet is present in the L3 table of the L3 switching chip (Yes in S30), the packet information is stored in the L3 table of the switching chip such as source IP, destination IP, and corresponding output port. Transmission is made (S32).

Since the received packet is stored in the L3 table of the switching chip, the corresponding IP packet is transmitted directly from the switching chip to the output port in hardware.

For reference, the routing table stores route information on the destination IP, and the L3 table stores the originating / receiving IP address and MAC address for hardware switching. In addition, the switching chip of the layer 3 switch performs a function of quickly transmitting the packet by hardware switching the packet input to the port.

On the other hand, if the destination IP does not exist in the routing table as a result of the determination in step S26, the layer 3 switch discards the packet.

As described above, since the Layer 3 switch transmits the packet to the destination IP without judging the validity of the IP address, there is a problem in that it cannot block traffic that is intentionally occupied by the fixed IP address.

Accordingly, the present invention has been made to solve the above-mentioned conventional problems, and an object thereof is to block traffic using an IP address not assigned by DHCP in a Layer 3 switch of a network using the DHCP IP allocation method. .

1 is a flowchart for explaining an IP address management procedure of a conventional DHCP server.

2 is a flowchart illustrating a packet transmission and reception procedure of a conventional layer 3 switch.

Figure 3 is a block diagram of a layer 3 switch having a static IP use blocking function according to an embodiment of the present invention.

4 is a flowchart for explaining a method for blocking static IP using a layer 3 switch according to an embodiment of the present invention.

5 is a flowchart illustrating an IP address management procedure of a DHCP server according to an embodiment of the present invention.

Layer 3 switch having a fixed IP use blocking function of the present invention to achieve the above object, if it is confirmed that there is a transmission history by checking the transmission history of the source IP address and the destination IP address of the input packet, Switching chip for switching in hardware to transmit to the output port corresponding to the destination IP address; If the forwarding history of the packet is not confirmed as a result of the checking in the switching chip, it is determined whether the packet is a packet using the IP address allocated from the DHCP server, and only the packet using the IP address assigned from the DHCP server is output. Switching control unit for transmitting to; And a DHCP server managing a dynamic IP address resource allocated to a terminal of a directly connected network.

In the fixed IP use blocking method using the layer 3 switch of the present invention for achieving the above object, in the fixed IP use blocking method in a network using a DHCP IP allocation method, a packet having a transmission history is transmitted. A first step of transmitting the packet to an output port; A second step of confirming whether the packet is a packet using an IP address allocated from a DHCP server when a packet having no transmission history is transmitted; A third step of, if the packet is identified as a packet using an IP address allocated from the DHCP server, storing the transmission history of the packet in an L3 table and then outputting the packet to a corresponding output port; And if the packet is not identified as a packet using an IP address allocated from the DHCP server, storing the packet discard history in an L3 table, and then discarding the packet. do.

Hereinafter, with reference to the accompanying drawings will be described an embodiment of the present invention in more detail.

As shown in FIG. 3, the Layer 3 switch having the fixed IP use blocking function according to an embodiment of the present invention is hardware switched to the packet input through the port unit 40 using the L3 table 12. By using the switching chip 10 to allow the packet to be transmitted quickly, and the static IP that is not assigned from the DHCP server 50 for the packet transmitted from the switching chip 10 in conjunction with the DHCP server 50 The switching controller 20 performs a function of blocking a transmitted packet, a routing table 30 storing routing information for network configuration, and a switching chip connected to the switching chip 10 to switch a predetermined packet input through an input port. And a port unit 40 for transmitting a predetermined packet output from the switching chip 10 to the output port, and a network directly connected under the control of the switching control unit 20. Performing a dynamic IP assignment, etc. for the number of terminals and a DHCP server 50 that manages the IP address resources.

Preferably, the L3 table 12 provided in the switching chip 10 may include a field for storing the source IP address, a field for storing the destination IP address, a field for storing the destination MAC address, as shown in Table 1. And a field for storing number information on the output port, and a field for storing state information according to forwarding.

<Table 1> Example of field configuration of L3 table 12

From IP Address Incoming IP Address Incoming Mac Address Output port number Forwarding Result 100.10.10.10 20.20.20.20 00: 21: 33: 12: 34: 56 3 send 100.10.10.11 31.1.1.21 08: 38: 45: 33: 54: 76 2 send 100.10.10.12 31.1.1.21 Disposal 100.10.10.12 40.1.1.41 Disposal 31.1.1.21 100.10.10.11 A: 33: 23 4 send 20.20.20.20 100.10.10.10 A4: 51: 21: 4A: 11: 20 4 send 45.41.55.62 100.10.10.12 Disposal 121.12.3.67 100.10.10.12 Disposal

In addition, as shown in Table 2, the routing table 30 of the present invention includes a field for storing incoming network information, a field for storing subnetting information, a field for storing routing types, and a field for storing output port number information. And the like.

<Table 2> Example of field configuration of routing table 30

Incoming network sudnetmask Routing type Output port number 100.10.0.0 255.255.255.0 Direct Conneted 4 20.20.0.0 255.255.0.0 OSPF 3 31.1.0.0 255.255.0.0 OSPF 2 0.0.0.0 0.0.0.0 Default route 2

"Direct Conneted" of the routing type presented in <Table 2> means that it belongs to the network directly connected to the Layer 3 switch, "OSPF" means network found through OSPF routing protocol, and "Default route" Used when none of the cases in the routing table.

Subsequently, a fixed IP usage blocking method using a layer 3 switch according to an embodiment of the present invention will be described in detail with reference to the flowcharts shown in FIGS. 4 and 5.

4 is a flowchart illustrating a packet transmission and reception procedure applied to a method for blocking fixed IP use using a layer 3 switch according to an embodiment of the present invention.

When a predetermined packet is received from the port unit 40 (S2), the switching chip 10 determines whether the originating IP and the destination IP exist in the L3 table 12 (S4), and the determination result shows the L3 table 12. If it is determined that the originating IP and the destination IP exist (Yes in S4), the forwarding result value for the corresponding packet is queried in the forwarding state field of the L3 table 12 (S6), and the forwarding result value is forwarded. ), The packet is transmitted to the output port specified in the L3 table 12 (S20).

On the other hand, if the originating IP and the destination IP do not exist in the L3 table 12 as a result of the determination in step S4 (No in S4), the packet is transmitted to the switching control unit 20, the switching control unit 20 receiving the packet ) Determines whether a route for the destination IP of the packet exists in the routing table 30 (S10).

As a result of the determination, if there is no route for the destination IP of the packet in the routing table 30 (No in S10), the packet is regarded as an abnormal packet and dropped (S30), If a route for the destination IP of the packet exists in the table 30 (Yes in S10), the packet is directly connected to the corresponding layer 3 switch using a value stored in the routing type field of the routing table 30 ( If it is determined that the packet is transmitted from the terminal of the Direct Connected (S12), and it is determined that the packet is transmitted from the terminal in a state directly connected to the layer 3 switch (YES in S12), the DHCP server 50 to the terminal Request the IP allocation information for (S14).

By the request, when the IP allocation information for the terminal is transmitted from the DHCP server 50, the switching controller 20 is the IP address and MAC address extracted from the actually transmitted packet and the IP address included in the IP allocation information and By comparing with the MAC address to determine whether they match (S16), if they match (Yes in S16), the source IP address, the destination IP address, and the output port is stored in the L3 table 12 of the switching chip 10, After storing the forwarding result as forwarding (S18), the packet is transmitted to the corresponding output port (S20).

However, as a result of the determination in step S16, if the IP address and MAC address extracted from the actually transmitted packet are not matched with each other by comparing the IP address and MAC address included in the IP allocation information (No in S16), the switching chip 10 The source IP address and the destination IP address are stored in the L3 table 12), and the forwarding result value is stored as Drop (S28), and then the packet is discarded (S30).

As a result of the determination in step S12, if the packet is not transmitted from the terminal of the network directly connected to the layer 3 switch (No in S12), the destination IP address of the packet is changed to the layer 3 switch using the routing table 30. It is determined whether it corresponds to a network directly connected to the network (S22), and if the destination IP address of the packet is a network directly connected to the layer 3 switch (for example, 100.10.0.0) (Yes in S22), the terminal to the DHCP server 50 Request IP allocation information for (incoming) (S14).

In response to the request, when the IP allocation information for the terminal (incoming) is transmitted from the DHCP server 50, the switching controller 20 includes the IP address and MAC address extracted from the actually transmitted packet in the IP allocation information. It compares the IP address and MAC address to determine whether they match (S26), and if they match (Yes in S26), the source IP address, the destination IP address, and the output port are entered in the L3 table 12 of the switching chip 10. After storing and storing the forwarding result value as forwarding (S18), the packet is transmitted to the corresponding output port (S20).

However, if the destination IP address and MAC address extracted from the actually transmitted packet are not matched with each other by comparing the IP address and MAC address included in the IP allocation information (No in S16), the L3 table 12 of the switching chip 10 C) store the source IP address and the destination IP address, store the forwarding margin value as Drop (S28), and discard the packet (S30).

When the packet is transmitted from the network directly connected to the layer 3 switch through the above-described process, the source IP address and the MAC address attached to the header of the packet are extracted, and then the source IP address and the MAC address are assigned to the DHCP server 50. It determines whether or not to match the one assigned by), and transmits the packet to the output port only when it matches.

Further, when a packet is transmitted from an external network, the destination IP address attached to the header of the packet is extracted, and it is determined whether the destination IP address matches that assigned by the DHCP server 50, and only if the packet is matched. Send the packet to the output port.

Through this process, the packet transmitted from the terminal using the unassigned IP address from the DHCP server or the packet transmitted to the terminal using the unassigned IP address is discarded, and the data of the terminal using the fixed IP address arbitrarily by the user. The communication can be interrupted.

Hereinafter, an IP address management procedure applied to a method of blocking fixed IP use using a layer 3 switch according to an embodiment of the present invention will be described in detail with reference to the flowchart shown in FIG. 5.

When an Internet connection is requested from any terminal of the network directly connected to the layer 3 switch, the switching controller 20 requests an IP address allocation from the DHCP server 50 (S50), and the DHCP server 50 leases time to the terminal. The IP address is allocated during the lease time (S52).

The terminal assigned the IP address is able to use the Internet service using the assigned IP address (S54), the DHCP server 50 is requested to renew the IP use (renew) from the subscriber station (Yes in S56) If the IP address assigned to the subscriber station is maintained as it is, and the extension of the IP usage is not requested from the subscriber station (No in S8), the lease time is checked for expiration, and when the lease time expires, the IP assigned to the subscriber station is expired. The address is retrieved (S60).

Subsequently, the DHCP server 50 notifies the switching control unit 20 of the retrieved IP address (S62), and the switching control unit 20 searches the L3 table 10 (S64) in the record of the L3 table 10. The IP address and the record recovered by the originating IP address are deleted (S68).

By the operation as shown in FIG. 5, only the information on the terminal currently assigned an IP address by the DHCP server is stored in the L3 table 10.

According to the present invention as described above, by using the static IP address in the Layer 3 switch, by discarding the packet transmitted from the terminal using the Internet, by limiting the Internet use of the terminal using the static IP address, Can be used efficiently and can provide the best Internet access services to bona fide subscribers.

On the other hand, the present invention is not limited to the above-described embodiment, but can be modified and modified within the scope not departing from the gist of the present invention, such modifications and changes should be regarded as belonging to the following claims. will be.

Claims (7)

A switching chip which checks the transmission history of the source IP address and the destination IP address of the input packet and transmits the packet to an output port corresponding to the destination IP address by hardware switching; If the forwarding history of the packet is not confirmed as a result of the checking in the switching chip, it is determined whether the packet is a packet using the IP address allocated from the DHCP server, and only the packet using the IP address assigned from the DHCP server is output. Switching control unit for transmitting to; And Layer 3 switch having a static IP use blocking function, characterized in that configured to include a DHCP server for managing the dynamic IP address resources allocated to the terminal of the directly connected network. The method of claim 1, The switching chip, Layer 3 switch having a fixed IP use blocking function, characterized in that the L3 table for storing the forwarding result of the packet for each source IP address and destination IP address. The method of claim 2, The switching control unit, As a result of confirming whether to use the IP address allocated from the DHCP server for the packet whose transmission history is not confirmed, if the packet is identified as a packet using the IP address allocated from the DHCP server, the originating / receiving IP of the packet is confirmed. Storing forwarding results as forwarding while storing address information in the L3 table, If the packet is not identified as a packet using the IP address allocated from the DHCP server, the forwarding result is discarded while storing the incoming / outgoing IP address information of the packet in the L3 table. Layer 3 switches with static IP blocking. The method of claim 2, The switching control unit, If the packet is transmitted from a terminal belonging to a network directly connected to the layer 3 switch, the IP server requests IP allocation information for the originating IP address of the packet and the IP allocation information transmitted from the DHCP server is From IP address and If the originating MAC matches, the packet is determined to be a packet using an IP address allocated from the DHCP server. If the packet is not transmitted from a terminal belonging to a network directly connected to the layer 3 switch, the IP server requests IP allocation information for the destination IP address of the packet, and the IP allocation information transmitted from the DHCP server is transmitted. Destination IP address and And a layer 3 switch having a fixed IP use blocking function, wherein the packet is determined to be a packet using an IP address allocated from the DHCP server. The method of claim 2, The switching control unit, And a notification of the number of specific IP addresses from the DHCP server, deleting the record having the IP address as the originating IP address from the L3 table. In the method of blocking the use of static IP in a network using the DHCP IP allocation method, A first step of transmitting the packet to a corresponding output port when a packet having a transmission history is transmitted; A second step of confirming whether the packet is a packet using an IP address allocated from a DHCP server when a packet having no transmission history is transmitted; A third step of, if the packet is identified as a packet using an IP address allocated from the DHCP server, storing the transmission history of the packet in an L3 table and then outputting the packet to a corresponding output port; And And if the packet is not identified as a packet using the IP address allocated from the DHCP server, storing the packet discard history in the L3 table and then discarding the packet. How to block using static IP using Layer 3 switches. The method of claim 6, The second process, If the packet is transmitted from a terminal directly connected to the layer 3 switch of the packet, the DHCP server requests IP allocation information for the source IP address of the packet, and the IP allocation information transmitted from the DHCP server corresponds to the source IP address of the packet. A first step of determining the packet as a packet using an IP address allocated from the DHCP server if it matches the originating MAC; And If the packet is not transmitted from a terminal belonging to a network directly connected to the layer 3 switch, the IP server requests IP allocation information for the destination IP address of the packet, and the IP allocation information transmitted from the DHCP server is The destination IP address and And a second step of determining the packet as a packet using the IP address allocated from the DHCP server if it matches.