In-residence communication device and filtering method

Abstract

An HGW (110) is provided with: a WANI / F unit (112) that receives a packet; and an IPv6 packet filter function unit (125) that performs address analysis of the packet and routing of the packet, and performs MAC filtering, which is filtering of the destination MAC address of the routed packet, on the basis of the IP packet filter rule.

Description

Technical Field

[0001] The present disclosure relates to an in-home communication device and a filtering method. Background Art

[0002] Due to the problem of IP address exhaustion in IPv4 (Internet Protocol version 4), IPv6 has been used in recent years.

[0003] In IPv6, it is difficult to implement filtering determination by specifying the IP (Internet Protocol) address of a terminal accommodated in a home communication device, which is generally performed as a packet filtering process in a home communication device in the conventional IPv4.

[0004] The main reasons for this are the following (a) and (b). (a) The IPv6 address assigned to the terminal on the LAN (Local Area Network) side becomes an address that is a part of the prefix of the global IPv6 (Internet Protocol version 6) address distributed from the communication network operator through the IPv6 prefix delegation action. Therefore, the prefix part of the IPv6 address of the terminal on the LAN side depends on the address distributed by the communication network operator, and the prefix part of the IPv6 address cannot be freely determined in advance. In addition, since the subnet length of the prefix part is also specified by the communication operator, the subnet length of the suffix part of the terminal on the LAN side also depends on the subnet length of the prefix part. (b) In IPv6, a terminal on the LAN side belongs to a plurality of networks, and generally performs an address setting operation such as multi-homing in which a terminal address is generated from a plurality of prefixes distributed from each network.

[0005] Considering the above situation, if the address distributed from the communication network operator and redistributed to the terminal on the LAN side in the IPv6 prefix allocation action is not confirmed, the packet filtering based on the IPv6 address designation cannot be implemented. In addition, in the IPv6 multi-homing action, if the terminal is connected to a new IPv6 network after the packet filter is formed and a new prefix is ​​distributed, the packet filter does not follow the new address.

[0006] In this regard, it is not necessary to specify the IP address in filtering, and a method of specifying the target terminal using the MAC (Media Access Control) address of the LAN side terminal known to the communication device in the house can also be considered. When the terminal is specified by the MAC address, the problem caused by the difficulty of specifying the IPv6 address in advance as mentioned above is eliminated.

[0007] Here, for example, when the in-home communication device uses Linux as an OS (Operating System), a filtering mechanism called iptables in Linux is used as a packet filter. In Linux's iptables, a filter specification based on a transmission source MAC address is provided.

[0008] Therefore, when a packet is transmitted from a LAN to a WAN (Wide Area Network), by using this function to specify the transmission source MAC address, it is possible to filter packets received from a terminal on the LAN side.

[0009] In this regard, Patent Document 1 discloses a method of configuring a load balancer as a configuration example using filtering based on a MAC address and iptables. Prior art literature Patent Literature

[0010] Patent Document 1: Japanese Patent Application Publication No. 2019-176323 Summary of the invention Technical problem to be solved by the invention

[0011] However, when receiving packets from the WAN side to the LAN side, it is not easy to filter the destination LAN side terminal using the MAC address. The reason is that in order to perform filtering using the MAC address, the in-home communication device needs to perform the following steps 1 to 3.

[0012] Step 1: The in-home communication device routes packets from the WAN side to the LAN side, and determines a destination I / F (InterFace: interface) for the destination IP address. Step 2: The in-home communication device allocates a destination MAC address corresponding to the destination IP address in the determined destination I / F. Here, if necessary, the in-home communication device needs to perform IPv4 ARP (Address Resolution Protocol) resolution or IPv6 neighbor resolution, and the packet is retained during this period. Step 3: In-home communication devices are filtered using their destination MAC address.

[0013] However, the current iptables does not include the filtering mechanism described above. The main reason for this is believed to be the following (c) to (e). (c) The destination MAC address is necessary only for an I / F that communicates using a layer 2 address such as an Ethernet I / F. It is not necessary when the destination is an I / F that does not require a layer 2 address such as a PPP I / F (Point-to-Point Protocol I / F). (d) When the destination I / F requires a layer 2 address, it is not suitable to perform processing in layer 3 such as an IP packet filter. (e) Therefore, in the Layer 3 processing, only common processing that is unrelated to the Layer 2 category of the destination I / F is performed, and in the final stage of sending from the destination I / F, a flexible and scalable IP stack structure is required to maintain the hierarchical structure of the communication layer as a structure for resolving the destination MAC address required for Layer 2 sending.

[0014] On the other hand, due to the processing order of steps 1 to 3 described above, in the previously executed layer 3 IP packet filter stage, the destination MAC address executed later is in an unresolved state, so the destination MAC address of the LAN side terminal cannot be specified.

[0015] As described above, in a residential communication device, although there is an advantage that by specifying the LAN side IPv6 terminal with a MAC address, the LAN side terminal can be specified independently of the IPv6 prefix distributed from the communication network. However, when receiving packets from the WAN side to the LAN side, there is a problem in implementing filtering of the LAN side terminal using the destination MAC address. Therefore, filtering of the LAN side terminal independently of the IPv6 prefix distributed from the communication network cannot be implemented.

[0016] Therefore, an object of one or more aspects of the present disclosure is to enable filtering in communications of a terminal on the LAN side without relying on an IPv6 prefix distributed from a communication network. Technical means for solving technical problems

[0017] A residential communication device according to one embodiment of the present invention is characterized in that it includes: a receiving interface for receiving packets; a forwarding unit for performing address resolution of the packets and routing the packets; and an extended function unit for performing filtering of the destination MAC (Media Access Control) address of the routed packets, i.e., MAC filtering, according to the rules of the IP (Internet Protocol) packet filter.

[0018] A filtering method involved in one embodiment of the present invention is characterized in that packets are received, packets are routed, address resolution of the packets is performed after the routing according to the rules of the IP (Internet Protocol) packet filter, and filtering of the destination MAC (Media Access Control) address of the packet resolved by the address resolution, i.e., MAC filtering, is performed. Effects of the Invention

[0019] According to one or more aspects of the present disclosure, filtering can be implemented in communications of a terminal on the LAN side without relying on an IPv6 prefix distributed from a communication network. BRIEF DESCRIPTION OF THE DRAWINGS

[0020] Figure 1 This is a block diagram schematically showing the configuration of a communication system including an HGW which is a home communication device according to the first to third embodiments. Figure 2 This is a block diagram schematically showing the structure of the IPv6 packet filter function unit in Implementation Example 1. Figure 3 This is a schematic diagram showing an example of a screen image for LAN-side filter setting. Figure 4 This is a diagram showing an example of an entry input screen image for inputting an entry of the LAN-side filter. Figure 5 This is a schematic diagram showing an example of a screen image for WAN-side filter setting. Figure 6 This is a diagram showing an example of an entry input screen image for inputting an entry of the WAN-side filter. Figure 7 (A) and (B) are block diagrams showing hardware configuration examples. Figure 8 This is a flowchart schematically showing the packet filtering action inside Linux. Fig. 9 It is a schematic diagram showing a first extended example of a packet filtering action used in Linux. Fig.10 is a diagram showing a first extended example of a packet filter action for Linux internals. Fig.11 This is a block diagram showing in a simplified manner the IP packet filter processing and the destination MAC analysis processing in the first embodiment. Fig.12 is a flow chart showing DSTMAC target processing. Fig.13 is a block diagram schematically illustrating an example implementation of queuing processing for a DSTMAC target. Fig.14 This is a flowchart showing the processing performed by the routed-dst-mac processing unit. Fig.15 This is a block diagram schematically showing the structure of the IPv6 packet filter function unit in Implementation Example 2. Fig.16 It is a schematic diagram showing a third expanded example of the packet filter action used inside Linux. Fig.17 This is a block diagram showing in a simplified manner the IP packet filter processing and the destination MAC analysis processing in the second embodiment. Fig.18 This is a flowchart showing the operation of the DSTMAC processing unit when packet retention during destination MAC analysis is implemented in NFQUEUE in the second embodiment. Fig.19 This is a block diagram schematically showing the structure of the IPv6 packet filter function unit in Implementation Example 3. DETAILED DESCRIPTION

[0021] Implementation method 1. Figure 1 This is a block diagram schematically showing the configuration of a communication system 100 including an HGW (Home Gateway) 110 which is an in-home communication device according to the first embodiment. The communication system 100 includes a plurality of terminals 101A, 101B, 101C, . . . , a subscriber access server 102 , a first ISP (Internet Service Provider) system 103A, a second ISP system 103B, and an HGW 110 . Here, when there is no need to particularly distinguish each of the plurality of terminals 101A, 101B, 101C, . . . , each of the plurality of terminals 101A, 101B, 101C, . . . is referred to as a terminal 101 .

[0022] The terminal 101 and the HGW 110 are connected to a LAN 104, and the HGW 110 and the subscriber access server 102 are connected to a subscriber communication network 105 such as the Internet.

[0023] The terminal 101 accesses the subscriber communication network 105 via the HGW 110 . The subscriber access server 102 is a server that the terminal 101 accesses in order to access the subscriber communication network 105 . The first ISP system 103A is a system of an operator that provides a first Internet service, and the second ISP system 103B is a system of an operator that provides a second Internet service. Here, it is assumed that the first Internet service and the second Internet service are different.

[0024] The HGW 110 includes a LAN I / F unit 111 , a WAN I / F unit 112 , and a network processing unit 120 . The LAN I / F unit 111 is a communication interface on the LAN side for performing communication via the LAN 104 . The WAN I / F unit 112 is a communication interface on the WAN side for communicating via the subscriber communication network 105 as a WAN. Here, the LAN I / F unit 111 or the WAN I / F unit 112 functions as a reception I / F for receiving packets, and the LAN I / F unit 111 or the WAN I / F unit 112 also functions as a transmission I / F for transmitting packets.

[0025] The network processing unit 120 controls processing in the HGW 110. For example, the network processing unit 120 controls relay processing of outputting packets from the subscriber communication network 105 to the LAN 104 and outputting packets from the LAN 104 to the subscriber communication network 105. Here, it is assumed that the network processing unit 120 supports IPv6.

[0026] The network processing section 120 includes a PPPoEv6 client function section 121 , a DHCPv6 client function section 122 , a DHCPv6 server function section 123 , an IPv6 router advertisement server function section 124 , and an IPv6 packet filter function section 125 .

[0027] The PPPoEv6 client function unit 121 performs communication via the subscriber communication network 105 by using PPPoE (Point-to-Point Protocol over Ethernet), which is an Internet connection service of IPv6, via the WAN I / F unit 112 .

[0028] The DHCPv6 client function unit 122 acquires an IPv6 IP address from a DHCP (Dynamic Host Configuration Protocol) server (not shown) included in the first ISP system 103A or the second ISP system 103B via the WAN I / F unit 112 .

[0029] The DHCPv6 server function unit 123 functions as an IP address distribution unit that distributes an IP address to the terminal 101 . For example, the DHCPv6 server function unit 123 distributes IPv6 IP address information to the terminal 101 via the LAN I / F unit 111. Specifically, the DHCPv6 server function unit 123 distributes the IP address included in the IPv6 address field corresponding to the IPv6 prefix acquired from the first ISP system 103A or the second ISP system 103B connected to the subscriber communication network 105 to the terminal 101.

[0030] The IPv6 router advertisement server function unit 124 automatically sets an IPv6 IP address via the LAN I / F unit 111 . For example, the IPv6 router advertisement server function unit 124 functions as an IP address broadcast unit that enables the terminal 101 to generate an IP address by broadcasting the IPv6 address band corresponding to the IPv6 prefix acquired from the first ISP system 103A or the second ISP system 103B connected to the subscriber communication network 105 to the terminal 101.

[0031] The IPv6 packet filter function unit 125 controls and performs filtering of packets received from the LAN 104 side by the LAN I / F unit 111 and packets received from the subscriber communication network 105 side by the WAN I / F unit 112 .

[0032] Figure 2 2 is a block diagram schematically showing the structure of the IPv6 packet filtering function unit 125 . As shown in the figure, the IPv6 packet filter function section 125 includes an S / W (Software) forwarding setting control section 130 and an S / W forwarding processing section 140 .

[0033] The S / W forwarding setting control unit 130 receives input of settings for filtering packets from the LAN 104 side, i.e., LAN side filtering settings, or settings for filtering packets from the WAN, i.e., the subscriber communication network 105 side, i.e., WAN side filtering settings, from other computers or other information processing devices through connection units such as USB (Universal Serial Bus) (not shown) by performing GUI settings from any terminal 101 via the LANI / F unit 111, or reading configuration settings (not shown) from other computers or other information processing devices, and causes the S / W forwarding processing unit 140 to perform filtering based on the LAN side filtering settings or the WAN side filtering settings.

[0034] The S / W forwarding setting control unit 130 includes an ipv6 packet filter GUI (Graphical User Interface) processing unit 131 and an ipv6tables rule expansion AP (application) execution unit 132 .

[0035] The ipv6 packet filter GUI processing unit 131 causes the above-mentioned terminal 101 or information processing device (not shown) to display a screen image of a GUI for LAN side filter setting or WAN side filter setting, and receives input of LAN side filter setting or WAN side filter setting from the operator via the screen image.

[0036] Figure 3 This is a schematic diagram showing an example of a screen image for LAN-side filter setting. like Figure 3 As shown, the LAN filter setting screen image 113 includes a packet filter target I / F selection area 113a, a packet filter direction selection area 113b, and a packet filter item list display area 113c.

[0037] As shown in the packet filter object I / F selection area 113a and the packet filter direction selection area 113b, Figure 2 The LAN-side filter setting screen image 113 is a setting screen image for starting a connection in the direction from the LAN 104 to the subscriber communication network 105, which is a WAN, exchanged with "PPPoE1".

[0038] The entry list display area 113c is an area for setting filters for packets forwarded from the LAN 104 to the user communication network 105. As described later, the entry list display area 113c is an area for displaying filter settings input by an operator. One entry corresponding to one row of the entry list display area 113c shows one filter.

[0039] For example, the entry list display area 113c includes an entry number column 113c#1, a source address display column 113c#2, a destination address display column 113c#3, a protocol type display column 113c#4, a source port number display column 113c#5, a destination port number display column 113c#6, and an entry action display column 113c#7.

[0040] The entry number column 113c#1 displays the entry number as identification information for identifying the entry. The transmission source address display column 113c#2 displays the designated address when the transmission source address is designated as the filter on the LAN 104 side. The destination address display column 113c#3 displays the designated address when the address of the destination is designated as the filter on the LAN 104 side. The protocol type display column 113c#4 displays the designated protocol when a protocol is designated as a filter on the LAN 104 side. The transmission source port number display column 113c#5 displays the designated port when the transmission source port is designated as the filter on the LAN 104 side. The destination port number display column 113c#6 displays the designated port when a destination port is designated as a filter on the LAN 104 side. The entry action display column 113c#7 displays the action as a filter on the LAN 104 side.

[0041] Figure 4 This is a diagram showing an example of an entry input screen image for inputting an entry of the LAN-side filter. Figure 4 The entry input screen image 114 shown is an input Figure 3 This is the screen image for the entry number "3". The entry input screen image 114 includes a title field 114a, a transmission source address designation field 114b, a destination address designation field 114c, a protocol designation field 114d, a transmission source port number designation field 114e, a destination port number designation field 114f, and an action designation field 114g. The start value input column 114h and the end value input column 114i are columns for input when specifying a range in the transmission source address specification column 114b, the destination address specification column 114c, the transmission source port number specification column 114e, or the destination port number specification column 114f.

[0042] Here, the transmission source address designation column 114b can designate the object to be filtered using the transmission source address based on the "IP address range", "IP subnet" and "MAC address", and in this case, the transmission source MAC address is designated.

[0043] In addition, the destination address designation column 114c can also designate an object to be filtered using the destination address based on "IP address range", "IP subnet" and "MAC address", and here, the IP subnet is designated.

[0044] The packet filter may also specify a protocol, a source port number, a destination port number, etc. However, since these are not items involved in this embodiment but are generally specified items, their description is omitted. Finally, in the action designation column 114g, either "through" or "cut" can be selected, and "through" is selected here. By conducting Figure 4 Input shown, set Figure 3 Filter for entry number "3".

[0045] Figure 5 This is a schematic diagram showing an example of a screen image for WAN-side filter setting. like Figure 5 As shown, the WAN-side filter setting screen image 115 includes a packet filter target I / F selection area 115a, a packet filter direction selection area 115b, and a packet filter item list display area 115c.

[0046] As shown in the packet filter object I / F selection area 115a and the packet filter direction selection area 115b, Figure 5 The WAN-side filter setting screen image 115 is a setting screen image for starting a connection in a direction from the WAN, that is, the subscriber communication network 105 to the LAN 104, which is exchanged with "PPPoE1".

[0047] The entry list display area 115c is an area for setting filters for packets forwarded from the subscriber communication network 105 to the LAN 104. As described later, the entry list display area 115c is an area for displaying filter settings input by an operator. One entry corresponding to one row of the entry list display area 115c shows one filter.

[0048] For example, the entry list display area 115c includes an entry number column 115c#1, a source address display column 115c#2, a destination address display column 115c#3, a protocol type display column 115c#4, a source port number display column 115c#5, a destination port number display column 115c#6, and an entry action display column 115c#7.

[0049] The entry number column 115c#1 displays the entry number as identification information for identifying the entry. The transmission source address display column 115c#2 displays the designated address when the transmission source address is designated as a filter on the subscriber communication network 105 side. The destination address display column 115c#3 displays the designated address when the destination address is designated as the filter on the subscriber communication network 105 side. The protocol type display column 115c#4 displays the designated protocol when a protocol is designated as a filter on the subscriber communication network 105 side. The transmission source port number display column 115c#5 displays the designated port when the transmission source port is designated as the filter on the subscriber communication network 105 side. The destination port number display column 115c#6 displays the designated port when a destination port is designated as a filter on the subscriber communication network 105 side. The entry action display column 115c#7 displays the action of the filter on the subscriber communication network 105 side.

[0050] Figure 6 This is a diagram showing an example of an entry input screen image for inputting an entry of the WAN-side filter. Figure 6 The entry input screen image 116 shown is an input Figure 5 This is the screen image when the entry number is "1". The entry input screen image 116 includes a title field 116a, a transmission source address designation field 116b, a destination address designation field 116c, a protocol designation field 116d, a transmission source port number designation field 116e, a destination port number designation field 116f, and an action designation field 116g. The start value input column 116h and the end value input column 116i are columns for input when specifying a range in the transmission source address specification column 116b, the destination address specification column 116c, the transmission source port number specification column 116e, or the destination port number specification column 116f.

[0051] Here, the transmission source address designation column 116b can designate the object to be filtered using the transmission source address based on the "IP address range", "IP subnet" and "MAC address", and in this case, the IP subnet is designated.

[0052] In addition, the destination address designation column 116c can also designate an object to be filtered using the destination address based on "IP address range", "IP subnet" and "MAC address", and here, the MAC address is designated.

[0053] The packet filter may also specify a protocol, a source port number, a destination port number, etc. However, since these are not items involved in this embodiment but are generally specified items, their description is omitted. Finally, in the action designation column 116g, either "through" or "cut" can be selected, and "through" is selected here. By conducting Figure 6 Input shown, set Figure 5 Filter for entry number "1".

[0054] Return to Figure 2 The ipv6tables rule expansion AP execution unit 132 sets the LAN side filtering setting or WAN side filtering setting received by the ipv6 packet filter GUI processing unit 131 to the ip6tables main body unit 141 described later of the S / W forwarding processing unit 140, and performs filtering according to the filtering setting.

[0055] The S / W forwarding processing unit 140 filters packets on the LAN side received by the LAN I / F unit 111 or packets on the WAN side received by the WAN I / F unit 112 , and forwards these packets. The S / W forwarding processing unit 140 includes an ip6tables main body unit 141 , a S / W packet forwarding processing unit 142 , and an ip6tables extension unit 143 .

[0056] The ip6tables main unit 141 sets, manages, and checks a table of IPv6 packet filter rules of the Linux kernel, and performs filtering using the table. The ip6tables main unit 141 includes a pre-routing execution unit 141a, a forwarding execution unit 141b, and a post-routing execution unit 141c. The processing of these functional units is the processing of the packet filter usually performed in Linux, which is described in detail in the following documents, etc., so the description is omitted here. Reference: Iptables Tutorial 1.2.2, "Retrieved on December 16, 2021", URL: <https: / www.frozentux.net / iptables-tutorial / iptables-tutorial.html>

[0057] exist Figure 3In the LAN filter setting screen image 113 shown in FIG. 1 , when an IP address is specified in the source address display column 113c#2 or the destination address display column 113c#3, or when Figure 5 In the WAN side filter setting screen image 115 shown, when an IP address is specified in the source address display column 115c#2 or the destination address display column 115c#3, the ip6tables main unit 141 functions as a filter execution unit that executes filtering using the IP address, namely, IP filtering.

[0058] The S / W packet forwarding processing unit 142 forwards a packet on the LAN side received by the LAN I / F unit 111 or a packet on the WAN side received by the WAN I / F unit 112 . The S / W packet forwarding processing unit 142 includes a path analysis unit 142a and a destination MAC analysis unit 142b. The processing in these functional units is also a packet forwarding processing normally performed in Linux, so detailed description is omitted.

[0059] The above-mentioned ip6tables main body 141 and S / W packet forwarding processing unit 142 constitute a forwarding unit that performs address resolution of packets and routes the packets.

[0060] The ip6tables extension unit 143 functions as an extension function unit that performs MAC filtering, that is, filtering of the destination MAC address of the routed packet using the ip6tables main body unit 141 and the S / W packet forwarding processing unit 142 according to the rules of the IP packet filter. The rule here is to perform address resolution of the packet after routing, and perform MAC filtering using the destination MAC address resolved by the address resolution. Therefore, the ip6tables extension unit 143 causes the destination MAC resolution unit 142b to perform address resolution according to the rule, and performs MAC filtering using the resolved MAC address. In particular, in implementation mode 1, the WAN I / F unit 112 serving as a receiving I / F receives a packet from the subscriber communication network 105, the ip6tables main unit 141 and the S / W packet forwarding processing unit 142 route the packet to the LAN 104, and the ip6tables extension unit 143 does not use the IP address of the terminal 101 connected to the LAN 104, but is able to perform MAC filtering on the destination MAC address that specifies the MAC address of the terminal 101.

[0061] For example, the ip6tables extension unit 143 performs filtering based on the destination MAC address in the destination MAC resolution determination chain PPOE1_WAN_TO_LAN_rule1 in which the processing in the ip6tables main body 141 is extended, according to an instruction from the ip6tables main body 141 . The ip6tables extension unit 143 includes a DSTMAC processing unit 143a and a routed-dst-mac processing unit 143b.

[0062] The DSTMAC processing unit 143a supplies the received packet through the evaluation rule of the DSTMAC target, which is activated to perform processing for resolving the destination MAC address from the destination IP address and for which destination MAC filtering is to be performed, to the routed-dst-mac processing unit 143b.

[0063] The routed-dst-mac processing unit 143b performs a match determination between the destination MAC address of the packet from the DSTMAC processing unit 143a and the destination MAC address resolved from the destination IP address.

[0064] In iptables, there are also existing extended actions as shown in the following documents. Reference: Netfilter Extensions HOWTO, "Retrieved on December 16, 2021", URL: https: / / www.netfilter.org / documentation / HOWTO / netfilter-extensions-HOWT O.html>

[0065] A part or all of the network processing unit 120 as described above may be Figure 7 As shown in (A), it can be composed of a memory 10 and a processor 11 such as a CPU (Central Processing Unit) that executes the program stored in the memory 10. Such a program can be provided via a network or recorded on a recording medium. In other words, such a program can be provided as a program product, for example.

[0066] In addition, part or all of the network processing unit 120 may be Figure 7As shown in (B), the processing circuit 12 may be composed of a single circuit, a composite circuit, a programmed processor, a parallel programmed processor, an ASIC (Application Specific Integrated Circuit) or an FPGA (Field Programmable Gate Array). As described above, the network processing unit 120 may be composed of a processing circuit network.

[0067] The LAN I / F unit 111 can be realized by a communication interface such as a NIC (Network Interface Card) connectable to the LAN 104 . In addition, the WAN I / F unit 112 can be implemented by a communication interface such as a NIC that can be connected to the subscriber communication network 105.

[0068] Next, the following describes how to implement the packet filter processing in Linux, which is often used as the OS of the home communication control device. Figure 3 and Figure 5 The GUI setting method is shown. Figure 8 This is a flowchart schematically showing the packet filter operation inside Linux.

[0069] First, the LAN I / F unit 111 or the WAN I / F unit 112 receives a packet ( S10 ). The received packet is sent to the S / W transfer processing unit 140 .

[0070] The pre-routing execution unit 141a of the S / W forwarding processing unit 140 executes three predetermined filtering processes based on ip6tables, and provides the packet to the path analysis unit 142a (S11).

[0071] Next, the path analyzing unit 142a performs a routing table search based on the destination of the packet (S12). Then, the path analysis unit 142a determines whether the result of the routing table search in step S12 is sent to the own device, that is, HGW 110 (S13). When the destination of the packet is not HGW 110 but an external device ("No" in S13), the process proceeds to step S14, and when the destination of the packet is HGW 110 ("Yes" in S13), the process proceeds to step S19.

[0072] In step S14, the packet is supplied to the forwarding execution unit 141b, and two predetermined filtering processes are executed. Then, the packet is supplied to the post-routing execution unit 141c.

[0073] After executing two predetermined filtering processes, the post-routing execution unit 141 c executes an output I / F transmission process ( S15 ). In the output I / F sending process, the post-routing execution unit 141c determines whether the sending destination of the packet is an Ether type I / F (S16). If the sending destination of the packet is an Ether type I / F ("Yes" in S16), the process proceeds to step S17, and if the sending destination of the packet is not an Ether type I / F ("No" in S16), the process proceeds to step S18.

[0074] In step S17, the destination MAC resolution unit 142b performs destination MAC resolution on the destination IP address. Then, the process proceeds to step S18. In step S18, the packet is provided to the LAN I / F unit 111 or the WAN I / F unit 112 according to the destination, and is transmitted from the LAN I / F unit 111 or the WAN I / F unit 112.

[0075] On the other hand, in step S13, for a packet determined to be destined for HGW 110, in step S19, the INPUT unit 126 (see Fig.11 ) performs two filtering processes. Then, the application is provided to the HGW 110 (S20).

[0076] When the application of the HGW 110 transmits a packet ( S21 ), the path analysis unit 142a searches the routing table for the packet ( S22 ). Then, the OUTPUT section 127 (see Fig.11 ) performs two predetermined filtering processes on the packet (S23). Then, the packet is sent to the post-routing execution unit 141c, and the processes of steps S15 to S18 are performed in the same manner as above.

[0077] Next, Figure 3 The following is an explanation of the expansion of the LAN filter settings shown in like Fig. 9 As shown, Figure 3 The LAN-side filter settings shown are expanded to packet filter actions within Linux.

[0078] First, the LAN side filter setting is a filter corresponding to the PPPoE packet from the LAN to the ISP1, so a corresponding chain 30, PPPoE1_LAN_TO_WAN, is generated. Here, a chain refers to a block obtained by summarizing various evaluation rules.

[0079] Next, in the chain PPPoE1_LAN_TO_WAN, the input I / F specifies the I / F equivalent to the LAN (here eth0), and the output I / F specifies the I / F equivalent to PPPoE (here ppp1000), so that the forwarding packets with the corresponding input and output I / Fs pass through rule 31.

[0080] Next, in the link PPPoE1_LAN_TO_WAN, the following rules are recorded as follows: Figure 3 The evaluation rules corresponding to item numbers 1 to 3 of the LAN-side filtering setting are shown.

[0081] Here, for the use of Figure 3 The filtering setting of the source MAC address shown in the entry number 3 of already has the source MAC address designation "-m mac-src-mac" in the existing iptables judgment condition, so it is directly constructed as the designated rule 34.

[0082] Then, if Fig.10 As shown, Figure 5 The WAN-side filtering settings shown are expanded to packet filter actions within Linux.

[0083] First, the WAN-side filter setting is a filter corresponding to packets from PPPoE of ISP1 to LAN, so a chain 40 corresponding thereto, PPPoE1_WAN_TO_LAN, is generated.

[0084] In the first embodiment, when there is a setting for specifying a destination MAC filter in the GUI filtering, a chain 41 corresponding to the setting, PPPoE1_WAN_TO_LAN_rule1, is generated.

[0085] Next, in the chain PPPoE1_WAN_TO_LAN, the input I / F specifies the I / F equivalent to LAN (here eth0), and the output I / F specifies the I / F equivalent to PPPoE (here ppp1000), so as to form rule 42 in such a way that forwarding packets having corresponding input and output I / Fs pass.

[0086] Next, in the link PPPoE1_WAN_TO_LAN, record Figure 5 The entry numbers 1 and 2 of the WAN side filter setting shown here correspond to the evaluation rules 43 and 44. Here, the entry number 1 which specifies the destination MAC address in the filter condition is shown in the rule 43.

[0087] In rule 43, the filter settings other than the destination MAC address are directly expanded into the settings of the filter conditions of rule 43. On the other hand, the filter setting of the destination MAC address is configured to be transferred to the chains 45 and 46 of the evaluation destination MAC resolution determination chain PPPoE1_WAN_TO_LAN_rule1.

[0088] Chains 45 and 46 show two extended operations configured as iptables to implement filtering of the destination MAC address in the destination MAC resolution determination chain PPPoE1_WAN_TO_LAN_rule1.

[0089] Chain 45 is an evaluation rule that generates a new target DSTMAC for starting a process of resolving a destination MAC address from a destination IP address and causes a packet to be subjected to destination MAC filtering to pass through the DSTMAC target.

[0090] Chain 46 is the following evaluation rule: that is, in the extended matching module mac used for MAC address determination of iptables, a new option -routed-dst-mac is generated to perform a matching determination with the destination MAC address obtained by parsing the destination IP address, and the destination MAC address filtering condition can be specified in the new option -routed-dst-mac. Here, the conventional extended matching module mac and option -mac-source for matching the transmission source MAC address are described in the following document. Reference: iptables-extensions, "Retrieved December 16, 2021", URL: <https:linuxjm.osdn.jp / html / iptables / man8 / iptables-extensions.8.html>

[0091] Next, use Fig.11 The operation of the DSTMAC processing unit 143a, which is an extended operation in the first embodiment, and the operation of the routed-dst-mac processing unit 143b, which is a new option of an extended matching module for MAC address determination that performs matching determination of a destination MAC address, will be described.

[0092] Fig.11 Simplified representation Figure 8 The IP packet filtering process and destination MAC resolution process are shown. exist Fig.11 In the example, the actions in the DSTMAC processing unit 143a and the actions in the routed-dst-mac processing unit 143b are specified by the rules under the FORWARD chain.

[0093] Here, as the target action of the rule, when the DSTMAC target action is specified by the DSTMAC processing unit 143a, the DSTMAC processing unit 143a takes the destination I / F of the packet obtained in the path resolution 60 performed by the path resolution unit 142a as the object, and performs a destination MAC address resolution request 50 from the destination IP address of the packet to the destination MAC resolution unit 142b.

[0094] When the destination MAC analysis unit 142b already holds the destination MAC address for the destination IP address and a destination MAC address resolution completion response is synchronously returned from the destination MAC analysis unit 142b, the DSTMAC processing unit 143a immediately returns from the DSTMAC target action and evaluates the next rule.

[0095] On the other hand, when the destination MAC resolution unit 142b does not maintain the destination MAC address for the destination IP address and a destination MAC address resolution response is returned from the destination MAC resolution unit 142b, the DSTMAC processing unit 143a queues the packet, interrupts the rule evaluation, and waits until an asynchronous destination MAC address resolution response 51 is received from the destination MAC resolution unit 142b.

[0096] Thereafter, when receiving the asynchronous destination MAC address resolution response 51 from the destination MAC resolution unit 142 b , the DSTMAC processing unit 143 a returns from the DSTMAC target action and performs the next rule evaluation.

[0097] Next, when the extended filtering action based on the destination MAC address performed by the routed-dst-mac processing unit 143b is specified, the routed-dst-mac processing unit 143b takes the destination I / F of the packet obtained by the path resolution 61 performed by the path resolution unit 142a as the object, and requests the destination MAC address retrieval 52 from the destination IP address of the packet to the destination MAC resolution unit 142b.

[0098] When the destination MAC analysis unit 142b holds the destination MAC address and responds to the destination MAC address, the routed-dst-mac processing unit 143b further compares it with the destination MAC address filtering condition passed as a parameter of the extended filtering action. As a result of the comparison, if the two match, the routed-dst-mac processing unit 143b determines that the extended filtering condition is satisfied.

[0099] On the other hand, when the destination MAC parsing unit 142b does not maintain the destination MAC address and responds with an unknown destination MAC address, or when the responded destination MAC address does not match the destination MAC address filtering condition passed as a parameter of the extended filtering action, the routed-dst-mac processing unit 143b determines that the extended filtering condition is not met.

[0100] If the DSTMAC processing unit 143a and the routed-dst-mac processing unit 143b are provided to perform such an extended operation, Figure 5 The filter shown in item number 1 can be Fig.10 This can be achieved by expanding iptables rules 43, 45, and 46.

[0101] Next, the contents of the DSTMAC target processing in the first embodiment are described. Fig.12 2 is a flowchart showing the DSTMAC target processing performed by the DSTMAC processing unit 143a. exist Fig.12 In the timing of evaluating the rules describing the DSTMAC target of the received packet, internal processing of the DSTMAC target is requested from the iptables side.

[0102] When the DSTMAC target processing is requested (S70), the DSTMAC processing unit 143a first checks the type of the destination I / F of the packet and determines whether the type is an Ether type (S71). If the type is not an Ether type (No in S71), since it is not necessary to resolve the destination MAC address, the processing immediately transfers to step S79, the DSTMAC target processing ends, and transfers to the evaluation of the next rule. On the other hand, if the type is an Ether type (Yes in S71), the processing proceeds to step S72.

[0103] In step S72, the DSTMAC processing unit 143a makes a request to the destination MAC analysis unit 142b to resolve the destination MAC address. Fig.11 The path resolution 60 is executed regularly, and the action is only performed on the packets forwarded to other I / Fs. Therefore, the DSTMAC action here can only be used in the chain after the path resolution 60, such as FORWARD or POSTOUTING.

[0104] Next, the DSTMAC processing unit 143a determines whether a destination MAC resolution completion response is returned from the destination MAC resolution unit 142b (S73). If a destination MAC resolution completion response is returned ("Yes" in S73), since the destination MAC resolution is completed, the process immediately transfers to step S79, the DSTMAC target processing is terminated, and the process transfers to the next rule evaluation. On the other hand, when a destination MAC analysis-in-progress response is returned (No in S73), the process proceeds to step S74.

[0105] In step S74, the DSTMAC processing unit 143a checks the number of packets queued in the DSTMAC processing unit 143a and determines whether the number of packets is greater than a threshold value. If the number of packets is greater than the threshold value ("Yes" in S74), the process proceeds to step S75, and the DSTMAC processing unit 143a discards the packet because the destination MAC resolution is invalid. On the other hand, if the number of packets is less than the threshold value ("No" in S74), the process proceeds to step S76.

[0106] In step S76, the DSTMAC processing unit 143a queues the packet.

[0107] Thereafter, the DSTMAC processing unit 143a determines whether a destination MAC analysis result response is returned from the destination MAC analysis unit 142b (S77). If a destination MAC analysis result response is received (Yes in S77), the process proceeds to step S78.

[0108] In step S78, the DSTMAC processing unit 143a takes the packet out of the queue. Then, the process proceeds to step S79.

[0109] In step S79, the DSTMAC processing unit 143a ends the DSTMAC target processing and moves to the evaluation of the next rule.

[0110] Next, use Fig.13 illustrate Fig.12 An embodiment of queuing processing for the DSTMAC target is described in . First, when the ip6tables main body 141 sends a DSTMAC processing request 80 to the DSTMAC processing unit 143a, the DSTMAC processing unit 143a confirms whether the destination IP address of the packet exists in the destination MAC resolution IP list 85. If the destination IP address of the packet exists in the destination MAC resolution-processing IP list 85, the DSTMAC processing unit 143a pairs the packet for which the DSTMAC processing request 80 has been made with the target DSTMAC rule, and queues the packets in the order in which they arrived for each destination IP.

[0111] If the destination IP address of the packet does not exist in the IP list 85 in the destination MAC resolution, the DSTMAC processing unit 143 a calls the destination MAC resolution unit 142 b according to the destination MAC address resolution request 82 .

[0112] The destination MAC analysis unit 142 b responds to the destination MAC address resolution response 83 as a synchronization response, indicating that the resolution has been completed or that the resolution is in progress. When the destination MAC address resolution response indicates that the resolution is completed, the DSTMAC processing unit 143a responds to the ip6tables main body unit 141 as DSTMAC end 84, and moves to the next rule evaluation.

[0113] When the destination MAC address resolution response 83 indicates that the address is being resolved, the DSTMAC processing unit 143 a generates a destination MAC resolution-undergoing IP list 85 for each destination IP, and does not repeatedly request destination MAC resolution.

[0114] Then, the DSTMAC processing unit 143a pairs the packet to which the DSTMAC processing request 80 is applied with the target DSTMAC rule, generates a destination MAC resolution-undergoing packet list 81 for each destination IP address, and queues the packets in the order in which they arrive for each destination IP.

[0115] In this case, when the DSTMAC processing unit 143a receives an asynchronous destination MAC resolution result response 86 from the destination MAC resolution unit 142b, the DSTMAC processing unit 143a responds as a DSTMAC processing end 84 to all packets in the retained packet list corresponding to the destination IP of the destination MAC resolution result response 86 received from the destination MAC resolution packet list 81, and transfers to the next rule evaluation.

[0116] The process of resuming after queuing only the packets being processed in the packet filter has been implemented in the QUEUE object, so if this process is referred to, the above-mentioned process can be implemented.

[0117] Next, the processing contents performed by the routed-dst-mac processing unit 143b as the extended matching module for MAC address determination in the first embodiment will be described. Fig.14It is a flowchart showing the processing performed by the routed-dst-mac processing unit 143b. Here, according to Fig.11 In the example, only the rules of the extended matching module for MAC address determination are used, and the routed-dst-mac processing unit 143b inquires the destination MAC analysis unit 142b whether there is a destination MAC address corresponding to the destination IP address of the packet.

[0118] First, if the destination MAC determination process of the extended MAC module is requested to the routed-dst-mac processing unit 143b (S90), the routed-dst-mac processing unit 143b investigates the type of the destination I / F of the packet and determines whether the type is an Ether type (S91). If the type is not an Ether type ("No" in S91), since the destination MAC address resolution is invalid, the process immediately transfers to step S95, the destination MAC determination process is set as a mismatch and ends, and transfers to the evaluation of the next rule.

[0119] On the other hand, if the type is Ether type (Yes in S91), the routed-dst-mac processing unit 143b requests the destination MAC analysis unit 142b to check the destination MAC (S92). Fig.11 The processing shown by label 52 in .

[0120] Then, the routed-dst-mac processing unit 143b determines whether the destination MAC address exists based on the response from the destination MAC analysis unit 142b (S93). If the destination MAC address does not exist ("No" in S93), the process immediately transfers to step S95, sets the destination MAC determination process as mismatched and ends, and transfers to the evaluation of the next rule.

[0121] On the other hand, if the destination MAC address exists (YES in S93 ), the process proceeds to step S94 . In step S94, the routed-dst-mac processing unit 143b determines whether the destination MAC address matches the MAC address of the determination condition. If they do not match ("No" in S94), the process transfers to step S95, and if they match ("Yes" in S94), the process transfers to step S96.

[0122] In step S95, the routed-dst-mac processing unit 143b terminates the destination MAC determination process as mismatching and moves to the evaluation of the next rule. On the other hand, in step S96, the routed-dst-mac processing unit 143b determines that the destination MAC determination process matches and ends the process, and moves on to the evaluation of the next rule.

[0123] As described above, using the DSTMAC target action and the destination MAC determination processing of the extended MAC module described above, as shown in FIG. Fig.10 The rules 43, 45, and 46 shown are combined to form Figure 3 The filtering including the destination MAC address in the filter condition shown in item number 1 of can be realized as the desired action.

[0124] As described above, in the HGW 110 involved in the first embodiment, since it is configured to be able to resolve the destination MAC address for the destination IP address at any timing during the packet filter evaluation after the routing table search, and to evaluate the subsequent packet filter based on the resolved destination MAC address, it is also possible to specify the connection from the terminal 101 on the LAN side in the direction from the LAN 104 to the WAN, that is, the subscriber communication network 105, or to specify the connection from the WAN, that is, the subscriber communication network 105 to the LAN 104 in the transmission source MAC address. As a result, it is possible to perform packet filtering designation that is not affected by changes in the IP address assigned to the terminal 101 on the LAN 104 side.

[0125] In addition, since the resolution of the destination MAC address is specified as the target of the packet filter, the packet filter conditions other than the destination MAC address can be set as in rule 43, and in rule 45, only the destination MAC address is requested to perform the conditional evaluation, as in rule 46, for packets that require the destination MAC filtering. With this configuration, the destination MAC resolution process is not performed on packets that do not require the destination MAC filtering, thereby reducing the processing load.

[0126] In the above description, the IPv6 address in which the address of the terminal 101 on the LAN 104 side is changed by the prefix assigned from the ISP network is mainly described as an example, but Embodiment 1 is also applicable when the terminal 101 on the LAN 104 side has an IPv4 address.

[0127] Implementation method 2. In the first embodiment, a DSTARP target is newly generated, a request for destination MAC address resolution and a packet holding during destination MAC resolution are performed, but the configuration method for performing such operations is not limited to this.

[0128] In Embodiment 2, a configuration example is shown in which packets during destination MAC resolution are stored in the existing QUEUE object, and a DSTARP application that receives a notification from the NFQUEUE object requests destination MAC address resolution. The operation of the NFQUEUE object is described in the following document. Reference: iptables-extensions, "Retrieved December 16, 2021", URL: <https: / / linuxjm.osdn.jp / html / iptables / man8 / iptables-extensions.8.html>

[0129] like Figure 1 As shown, the communication system 200 including the HGW 210 which is the in-home communication device according to the second embodiment includes a plurality of terminals 101 , a subscriber access server 102 , a first ISP system 103A, a second ISP system 103B, and the HGW 210 .

[0130] The terminal 101, the subscriber access server 102, the first ISP system 103A and the second ISP system 103B of the communication system 200 in the second embodiment are the same as the terminal 101, the subscriber access server 102, the first ISP system 103A and the second ISP system 103B of the communication system 100 in the first embodiment.

[0131] The HGW 210 includes a LAN I / F unit 111 , a WAN I / F unit 112 , and a network processing unit 220 . The LAN I / F unit 111 and the WAN I / F unit 112 of the HGW 210 according to the second embodiment are the same as the LAN I / F unit 111 and the WAN I / F unit 112 of the HGW 110 according to the first embodiment.

[0132] The network processing unit 220 controls processing in the HGW 210. For example, the network processing unit 220 controls relay processing of outputting packets from the subscriber communication network 105 to the LAN 104 and outputting packets from the LAN 104 to the subscriber communication network 105. Here, it is assumed that the network processing unit 220 supports IPv6.

[0133] The network processing section 220 includes a PPPoEv6 client function section 121 , a DHCPv6 client function section 122 , a DHCPv6 server function section 123 , an IPv6 router advertisement server function section 124 , and an IPv6 packet filter function section 225 . The PPPoEv6 client function unit 121, DHCPv6 client function unit 122, DHCPv6 server function unit 123 and IPv6 Router Advertisement server function unit 124 of the network processing unit 220 in Implementation Example 2 are the same as the PPPoEv6 client function unit 121, DHCPv6 client function unit 122, DHCPv6 server function unit 123 and IPv6 Router Advertisement server function unit 124 of the network processing unit 120 in Implementation Example 1.

[0134] The IPv6 packet filter function unit 225 performs filtering of packets received from the LAN 104 side by the LAN I / F unit 111 and packets received from the subscriber communication network 105 side by the WAN I / F unit 112 .

[0135] Fig.15 This is a block diagram schematically showing the structure of the IPv6 packet filter function unit 225 in the second embodiment. The IPv6 packet filter function section 225 includes a S / W forwarding setting control section 130 and a S / W forwarding processing section 240 . The S / W forwarding setting control section 130 of the IPv6 packet filter function section 225 in the second embodiment is the same as the S / W forwarding setting control section 130 of the IPv6 packet filter function section 125 in the first embodiment.

[0136] The S / W forwarding processing unit 240 filters packets on the LAN side received by the LAN I / F unit 111 or packets on the WAN side received by the WAN I / F unit 112 , and forwards these packets. The S / W forwarding processing unit 240 includes an ip6tables main body unit 141 , a S / W packet forwarding processing unit 142 , an ip6tables extension unit 243 and a NFQUEUE processing unit 244 . The ip6tables main body 141 and the S / W packet forwarding processing unit 142 of the S / W forwarding processing unit 240 in the second embodiment are the same as the ip6tables main body 141 and the S / W packet forwarding processing unit 142 of the S / W forwarding processing unit 140 in the first embodiment.

[0137] For example, the ip6tables extension unit 243 performs filtering based on the destination MAC address in the destination MAC resolution determination chain PPOE1_WAN_TO_LAN_rule1 in which the processing in the ip6tables main body 141 is extended, according to an instruction from the ip6tables main body 141 . The ip6tables extension unit 243 includes a DSTMAC processing unit 243a and a routed-dst-mac processing unit 143b. The routed-dst-mac processing unit 143b of the ip6tables extension unit 243 in the second embodiment is the same as the routed-dst-mac processing unit 143b of the ip6tables extension unit 143 in the first embodiment.

[0138] The DSTMAC processing unit 243a supplies the received packet through the evaluation rule of the DSTMAC target, which is activated to perform processing for resolving the destination MAC address from the destination IP address and for which destination MAC filtering is to be performed, to the routed-dst-mac processing unit 143b. In the second embodiment, the DSTMAC processing unit 243 a does not hold or retransmit the received packet, but the NFQUEUE processing unit 244 performs these processes.

[0139] The NFQUEUE processing unit 244 performs retention and retransmission on the received packets. For example, the NFQUEUE processing unit 244 temporarily stores the packets before the address resolution is performed in a memory (not shown) functioning as a temporary storage unit. The memory may be Figure 7 The memory 10 shown in (A) may also be provided separately from the memory 10.

[0140] As described above, in implementation mode 2, the ip6tables extension unit 243 requests address resolution of the packet from the destination MAC resolution unit 142b when the packet is temporarily stored in the temporary storage unit via the NFQUEUE processing unit 244, and after performing the address resolution of the packet, performs MAC filtering using the MAC address resolved by the address resolution.

[0141] In implementation mode 2, Fig.16 As shown, Figure 5 The WAN-side filtering settings shown are expanded to packet filtering actions within Linux. Fig.16 The expansion shown is Fig.10 The expansion shown is roughly the same, but Fig.10 Rule 45 in the expansion shown is changed to rule 47.

[0142] Rule 47 expands the action for starting destination MAC resolution in the existing extended target NFQUEUE of iptables, and specifies the I / F number of the LAN side I / F, i.e., ifindex, in the parameter -queue-num.

[0143] Next, use Fig.17, describing the action of destination MAC address resolution when the NFQUEUE is used to implement the retention of packets in the destination MAC resolution in Implementation 2.

[0144] Fig.17 The IP packet filter process and the destination MAC resolution process are simplified. In the second embodiment, according to the specification of the rule 47 for requesting the destination MAC address resolution, the NFQUEUE processing unit 244 that executes the NFQUEUE object instead of the DSTMAC object operates.

[0145] Specifically, the NFQUEUE processing unit 244 reserves the packet and transmits the NFQUEUE reserved packet notification 53 to the DSTMAC processing unit 243a that executes the DSTMAC application on the user space.

[0146] The DSTMAC processing unit 243a analyzes the destination IP address of the notified hold packet, and if the destination MAC address of the destination IP address is being analyzed, it sends a destination MAC address analysis request 50 to the destination MAC analysis unit 142b.

[0147] After the destination MAC address is resolved, the destination MAC resolution unit 142b responds to the DSTMAC processing unit 243a with a destination MAC address resolution response 51. The DSTMAC processing unit 243a then sends a NFQUEUE reserved packet response 54 to the NFQUEUE processing unit 244 for all NFQUEUE reserved packet notifications 53 corresponding to the corresponding destination IP address.

[0148] The NFQUEUE processing unit 244 that has received the NFQUEUE reserve packet response 54 discards the packet or restarts the next rule evaluation based on the notification from the DSTMAC processing unit 243a.

[0149] Fig.18 This is a flowchart showing the operation of the DSTMAC processing unit 243a when the packet holding during the destination MAC analysis is realized in the NFQUEUE in the second embodiment.

[0150] When the DSTMAC processing unit 243a is notified of the packet held by the NFQUEUE processing unit 244 (S100), first, the DSTMAC processing unit 243a acquires the I / F number of the destination I / F from the held packet queue number (S101).

[0151] Then, the DSTMAC processing unit 243a confirms the type of the destination I / F and determines whether the type of the destination I / F is an Ether type (S102). If the type of the destination I / F is not an Ether type (S102 is "No"), the processing proceeds to step S103. If the type of the destination I / F is an Ether type (S102 is "Yes"), the processing proceeds to step S104.

[0152] In step S103, the DSTMAC processing unit 243a does not need to resolve the destination MAC address, and therefore notifies the NFQUEUE processing unit 244 of the hold packet response to cause it to proceed to the next rule. Then, the process moves to step S108, and the NGQUEUE hold packet process ends.

[0153] On the other hand, if the type of the destination I / F is the Ether type ("Yes" in S102), then in step S104, the DSTMAC processing unit 243a determines whether the destination MAC address resolution for the destination IP address of the retained packet is activated. If the destination MAC address resolution is not activated ("No" in S104), the process moves to step S105, and if the destination MAC address resolution is activated ("Yes" in S104), the process moves to step S106.

[0154] In step S105, the DSTMAC processing unit 243a transmits a destination MAC address resolution request to the destination MAC resolution unit 243b. Then, the process proceeds to step S106.

[0155] In step S106, the DSTMAC processing unit 243a determines whether a destination MAC address resolution response has been received from the destination MAC resolution unit 142c. If a destination MAC address resolution response has been received ("Yes" in S106), the process proceeds to step S107.

[0156] In step S107, the DSTMAC processing unit 243a notifies the NFQUEUE processing unit 244 of the hold packet response to be transferred to the next rule for all hold packets having the destination IP address corresponding to the received destination MAC address resolution response. Then, the process transfers to step S108, and the NGQUEUE hold packet processing ends.

[0157] As described above, in the HGW 210 according to the second embodiment, the existing NFQUEUE object is used instead of the DSTMAC object introduced in the first embodiment, and the DSTMAC processing unit 243a that receives the packet holding notification from the NFQUEUE object executes the destination MAC analysis. Therefore, the DSTMAC processing unit 243a does not need to incorporate its own logic for retaining or retransmitting packets, and the processing becomes simple.

[0158] Examples of applications that use the NFQUEUE object are described in the following document. Reference: sample-helloworld.c, retrieved on December 16, 2021, URL: <https: / / github.com / irontec / netfilter-nfqueue-samples / blob / master / sample-helloworld.c>

[0159] As shown in this example, since the DSTMAC processing unit 243a is a process that operates in the user space, it has an effect of being easier to create compared to a DSTMAC target generated in the kernel space.

[0160] Implementation method 3. In the first or second embodiment, a control method of HGW 110, 210 having a packet filter capable of specifying a MAC address of a LAN terminal is described. However, in the third embodiment, high-speed IP packet forwarding by H / W (HardWare) is enabled.

[0161] like Figure 1 As shown, a communication system 300 including an HGW 310 which is an in-home communication device according to Embodiment 3 includes a plurality of terminals 101 , a subscriber access server 102 , a first ISP system 103A, a second ISP system 103B, and the HGW 310 .

[0162] The terminal 101, the subscriber access server 102, the first ISP system 103A and the second ISP system 103B of the communication system 300 in the third embodiment are the same as the terminal 101, the subscriber access server 102, the first ISP system 103A and the second ISP system 103B of the communication system 100 in the first embodiment.

[0163] The HGW 310 includes a LAN I / F unit 111 , a WAN I / F unit 112 , and a network processing unit 320 . The LAN I / F unit 111 and the WAN I / F unit 112 of the HGW 310 according to the third embodiment are the same as the LAN I / F unit 111 and the WAN I / F unit 112 of the HGW 110 according to the first embodiment.

[0164] The network processing unit 320 controls processing in the HGW 310. For example, the network processing unit 320 controls relay processing of outputting packets from the subscriber communication network 105 to the LAN 104 and outputting packets from the LAN 104 to the subscriber communication network 105. Here, it is assumed that the network processing unit 320 supports IPv6.

[0165] The network processing section 320 includes a PPPoEv6 client function section 121 , a DHCPv6 client function section 122 , a DHCPv6 server function section 123 , an IPv6 router advertisement server function section 124 , and an IPv6 packet filter function section 325 . The PPPoEv6 client function unit 121, DHCPv6 client function unit 122, DHCPv6 server function unit 123 and IPv6 Router Advertisement server function unit 124 of the network processing unit 320 in Implementation Example 3 are the same as the PPPoEv6 client function unit 121, DHCPv6 client function unit 122, DHCPv6 server function unit 123 and IPv6 Router Advertisement server function unit 124 of the network processing unit 120 in Implementation Example 1.

[0166] The IPv6 packet filter function unit 325 performs filtering of packets received from the LAN 104 side by the LAN I / F unit 111 and packets received from the subscriber communication network 105 side by the WAN I / F unit 112 .

[0167] Fig.19 This is a block diagram schematically showing the structure of the IPv6 packet filtering function unit 325 in the third embodiment. The IPv6 minute filter function section 325 includes the S / W forwarding setting control section 130 , a S / W forwarding processing section 340 executed by the S / W, and a H / W forwarding processing section 350 executed by the H / W.

[0168] The S / W forwarding processing unit 340 includes a S / W packet forwarding processing unit 342 and an IP flow management unit 345. The S / W packet forwarding processing unit 342 performs filter processing obtained by combining the IP address and the MAC address described in Example 1 or 2. The S / W packet forwarding processing unit 342 includes a destination MAC analysis unit 342b.

[0169] Since the internal structure of the H / W forwarding processing unit 350 varies, only the basic operation related to the packet filter operation and IP packet forwarding in the third embodiment will be described here.

[0170] The H / W forwarding processing unit 350 includes a packet header extraction unit 351 , an IP flow matching determination unit 352 , a packet header editing unit 353 , an H / W IP flow management unit 354 , and an H / W destination MAC management unit 355 .

[0171] The packet header extraction unit 351 examines the IP header of the IP packet received by the receiving I / F, i.e., the LAN I / F unit 111 or the WAN I / F unit 112, and extracts {source IP address, destination IP address, protocol, source port number, destination port number} in the IP header. The information obtained by combining the five values ​​in {} is basic structural information for identifying which connection the packet belongs to, and is called session information or IP flow information.

[0172] The session information or IP flow information is information used to process IP packets belonging to the same session in a coherent manner. For example, when converting the source address or source port number in NAT (Network Address Translation) processing or NAPT (Network Address Port Translation) processing, all IP packets belonging to the same session must be converted using the same source address or source port number.

[0173] To achieve this, the source address or source port number for NAPT conversion is determined in the head packet, and all subsequent packets with the same session information or IP flow information are converted to the same source address or source port number as the head packet. In addition, the session information or IP flow information is equivalent to management information called connection tracking (conntrack) information in the network stack, for example in Linux, and is managed by the IP flow management unit 345. Specifically, the IP flow management unit 345 stores the session information or IP flow information in a memory (not shown) that functions as a storage unit. The memory may be Figure 7 The memory 10 shown in (A) may also be provided separately from the memory 10.

[0174] The IP flow matching judgment section 352 judges whether the flow information extracted by the packet header extraction section 351 matches an entry registered in the H / W IP flow management section 354 in the H / W transfer processing section 350 .

[0175] Since the IP flow information is not registered in the H / WIP flow management unit 354, the IP flow matching judgment unit 352 sends the packet to the S / W forwarding processing unit 340 as flow information without H / W forwarding processing.

[0176] The S / W forwarding processing unit 340 that receives the packet performs destination path analysis and filtering in the S / W packet forwarding processing unit 342. The processing of the S / W packet forwarding processing unit 362 is as follows: Fig.11 In other words, the processing of the S / W packet forwarding processing unit 362 is a combination of packet filtering and destination path analysis as described in the first embodiment.

[0177] The S / W packet forwarding processing unit 342 can perform filtering based on the MAC address of the LAN side terminal described in the first embodiment in the packet filtering process.

[0178] Here, when the S / W packet forwarding processing unit 342 determines that the leading packet is discarded in the filtering process, the IP flow information of the packet is not registered in the IP flow management unit 345 in the S / W forwarding processing unit 340, and the entry is not registered in the H / W IP flow management unit 354. Therefore, the subsequent packets are also sent to the S / W forwarding processing unit 340, and are also determined to be discarded in the S / W forwarding processing unit 340, and the subsequent packets belonging to the IP flow are not forwarded.

[0179] On the other hand, when the S / W packet forwarding processing unit 342 determines that the head packet has passed in the filtering process, the IP flow information of the packet is registered in the IP flow management unit 345 in the S / W forwarding processing unit 340. At this time, the IP flow management unit 345 registers the IP flow information in the H / W IP flow management unit 354.

[0180] Thereafter, the destination MAC analysis unit 342 b of the S / W packet forwarding processing unit 342 performs a destination MAC analysis process on the head packet, and returns the packet to the H / W forwarding processing unit 350 .

[0181] Then, the H / W transfer processing unit 350 transmits the packet from the LAN I / F unit 111 or the WAN I / F unit 112 which is the transmission I / F on the opposite side.

[0182] Here, the destination MAC analysis unit 342 b of the S / W packet forwarding processing unit 342 registers the MAC address resolved with respect to the IP address so as to always be synchronized with the H / W destination MAC management unit 355 of the H / W forwarding processing unit 350 .

[0183] Next, when a subsequent packet is received, the packet header extraction unit 351 performs a detailed inspection of the header of the subsequent packet in the same manner as the first packet, and extracts {source IP address, destination IP address, protocol, source port number, destination port number} in the IP header.

[0184] Next, the IP flow matching judgment unit 352 judges whether the extracted flow information matches the registration item in the H / WIP flow management unit 354 in the H / W forwarding processing unit 350. Here, since the IP flow information of the subsequent packets of the session is registered in the H / WIP flow management unit 354, the IP flow matching judgment unit 352 judges that the flow information matches.

[0185] Here, packets determined to match the flow information are sent to the subsequent packet header editing unit 353, except for a portion of packets that need to be processed by the S / W forwarding processing unit 340 or a portion of exception packets that cannot be processed by the H / W forwarding processing unit 350. The portion of packets that need to be processed by the S / W forwarding processing unit 340 is, for example, a control packet with a SYN flag, a FIN flag, or an RST flag of TCP (Transmission Control Protocol).

[0186] The packet header editing unit 353 performs necessary packet header editing processing based on the IP flow editing information held by the H / W IP flow management unit 354 and the MAC address held by the H / W destination MAC management unit 355. For example, the packet header editing unit 353 performs updating of the address or port number of the packet processed by NAT, updating of the source MAC based on the transmission I / F, or updating of the destination MAC address of the next port after routing.

[0187] For subsequent packets that have completed the packet header editing process, they are finally processed only by the H / W forwarding processing unit 350 from the sending I / F on the opposite side, namely the LAN I / F unit 111 or the WAN I / F unit 112. In other words, they are not sent via the S / W forwarding processing unit 340.

[0188] The H / W forwarding processing unit 350 described above may be composed of, for example, Figure 7 (B) is implemented by the processing circuit 12 shown.

[0189] Thus, in the HGW 310 involved in the third embodiment, the first packet is judged using the MAC address of the LAN side terminal, and when the first packet is judged as passed, the subsequent packets are forwarded by the H / W using the IP flow information. Therefore, even a general H / W forwarding processing unit (Network Processor: network processor) that does not have a filtering function using the MAC address can realize filtering actions using the MAC address of the LAN side terminal and high-speed IP packet forwarding actions based on the H / W.

[0190] In other words, in implementation mode 3, the HGW 310 also includes a H / W forwarding processing unit 350, which functions as a hardware forwarding unit that uses hardware to route packets, and the ip6tables extension unit 143 performs MAC filtering on the head packet of the session. When the head packet is passed through the MAC filtering, the H / W forwarding processing unit 350 routes the subsequent packets of the same session as the head packet, i.e., the subsequent packets, and does not perform MAC filtering on the subsequent packets.

[0191] The structure of the third embodiment is based on the structure of the first embodiment, but the structure of the third embodiment may be based on the structure of the second embodiment. Description of symbols

[0192] 100, 200, 300 communication system, 101 terminal, 102 subscriber access server, 103A first ISP system, 103B second ISP system, 110 HGW, 111 LANI / F unit, 112 WANI / F unit, 120, 220, 320 network processing unit, 121 PPPoEv6 client function unit, 122 DHCPv6 client function unit, 123 DHCPv6 server function unit, 124 IPv6 router broadcast server function unit, 125, 225, 325 IPv6 packet filter function unit, 130 S / W forwarding setting control unit, 131 ipv6 packet filter GUI processing unit, 132 ipv6tables rule expansion AP execution unit, 140, 240, 340 S / W forwarding processing unit, 141 ip6tables main unit, 141a pre-routing execution unit, 141b forwarding execution unit, 141c post-routing execution unit, 142, 342 S / W packet forwarding processing unit, 142a path analysis unit, 142b, 342b destination MAC analysis unit, 143, 243 ip6tables extension unit, 143a, 243a DSTMAC processing unit, 143b routed-dst-mac processing unit, 244NFQUEUE processing unit, 345IP flow management unit, 350H / W forwarding processing unit, 351 packet header extraction unit, 352IP flow matching judgment unit, 353 packet header editing unit, 354H / WIP flow management unit, 355H / W destination MAC management unit.

Claims

1. A residential communication device, characterized in that: include: a receiving interface, the receiving interface receiving the packet; a forwarding unit, the forwarding unit performing address resolution of the packet and routing of the packet; as well as An extended function unit performs filtering of a destination MAC (Media Access Control) address of the routed packet, that is, MAC filtering, according to a rule of an IP (Internet Protocol) packet filter.

2. The in-home communication device according to claim 1, wherein: The rule is a rule for performing the address resolution of the packet after the routing and performing the MAC filtering by the destination MAC address resolved by the address resolution, The extended function unit causes the forwarding unit to perform the address resolution according to the rule, and performs the MAC filtering using the resolved destination MAC address.

3. The in-home communication device according to claim 2, characterized in that: It also includes a temporary storage unit, which temporarily stores the packet before performing the address resolution. The extended function unit requests the forwarding unit to perform the address resolution of the packet while temporarily storing the packet in the temporary storage unit, and after performing the address resolution of the packet, performs the MAC filtering using the MAC address resolved by the address resolution.

4. The in-home communication device according to any one of claims 1 to 3, characterized in that: The receiving interface receives the packet from a WAN (Wide Area Network), The forwarding unit routes the packet to a LAN (Local Area Network). The extended function section performs the MAC filtering on the destination MAC address specifying the MAC address of the terminal without using the IP address of the terminal connected to the LAN.

5. The in-home communication device according to claim 4, characterized in that: Also includes: An IP address distribution unit, which distributes the IP address to the terminal; as well as A filter execution unit executes IP filtering which is filtering using the IP address.

6. The in-home communication device according to claim 5, characterized in that: The IP address distribution unit distributes the IP address included in an IPv6 address band corresponding to an IPv6 (Internet Protocol version 6) prefix acquired from the WAN to the terminal.

7. The in-home communication device according to claim 4, characterized in that: Also includes: an IP address broadcasting unit configured to broadcast an IPv6 address band corresponding to an IPv6 (Internet Protocol version 6) prefix obtained from the WAN to the terminal so as to cause the terminal to generate the IP address; as well as A filter execution unit executes IP filtering which is filtering using the IP address.

8. The in-home communication device according to any one of claims 1 to 7, characterized in that: The system also includes a hardware forwarding unit, which uses hardware to perform routing of the packets. The extended function unit performs the MAC filtering on the head packet of the session as the packet. When the head packet is passed by the MAC filtering, the hardware forwarding unit performs routing for subsequent packets of the same session as the head packet, i.e., subsequent packets, without performing the MAC filtering on the subsequent packets.

9. A filtering method, characterized in that: Receive packets, Routing of packets, According to the rules of IP (Internet Protocol) packet filters, address resolution of the packet is performed after the routing. MAC filtering, which is filtering of the destination MAC (Media Access Control) address of the packet resolved by the address resolution, is performed.

Images