Packet communication device, packet processing rule setting method, and program

Abstract

Provided is a packet communication device connected to one or more paths, the packet communication device comprising a routing unit for allocating a packet received from a terminal to one of the one or more paths, and a control unit for acquiring an IP address of the terminal and setting applicable rules for packet processing by the routing unit on the basis of the IP address.

Description

[Technical field]

[0001] The present invention relates to a technique for distributing packets to one of one or more paths, and a technique for performing packet processing (filtering, traffic control, etc.) during distribution. [Background technology]

[0002] In recent years, with the spread of IoT devices, various IoT devices are now connected to networks (NWs). In addition, there are an increasing number of cases where users connect their PCs to home NWs to perform work, such as for teleworking.

[0003] Terminals such as IoT devices and PCs are connected to CPE (Customer Premises Equipment) installed at bases. The CPE is also connected to one or more networks via one or more paths, and distributes packets from the terminals to the destination networks.

[0004] Techniques for realizing packet sorting include techniques for routing packets based on the input I / F, source IP address, port number, etc. (eg, Non-Patent Documents 1 and 2). [Prior art documents] [Non-patent literature]

[0005] [Non-Patent Document 1] Cisco, "Understanding Policy Routing" https: / / www.cisco.com / c / en / us / support / docs / ip / border-gateway-protocol-bgp / 10116-36.html?dtid=osscdc000283 [Non-Patent Document 2] Linux(R) IP-ROUTE https: / / manpages.debian.org / experimental / iproute2 / ip-route.8.en.html Summary of the Invention [Problem to be solved by the invention]

[0006] In bases with small-scale networks, such as ordinary homes and SOHOs, the networks within the bases are generally not separated for each terminal. In such networks, it is difficult to distinguish terminals based on input I / F, port number, etc., and source IP addresses often change dynamically due to DHCP. This poses the problem that it is difficult to appropriately process packets for each terminal. In this specification, the term "packet processing" includes at least "packet sorting," "packet filtering," and "traffic control."

[0007] The present invention has been made in consideration of the above points, and aims to provide a technology that enables appropriate packet processing in a packet communication device that distributes a packet received from a terminal to one of one or more paths. [Means for solving the problem]

[0008] According to the disclosed technology, Multiple Tunnels A packet communication device connected to The packet received from the terminal is Multiple Tunnels Any of tunnel A routing section that distributes the traffic to the following: a control unit that acquires an IP address of the terminal and sets an application rule for packet processing in the routing unit based on the IP address; The control unit is By broadcasting a request including a terminal identifier of the terminal, An IP address corresponding to the terminal identifier of the terminal is acquired, and it is monitored whether or not the IP address has been changed, and if the IP address has been changed, the application rule is updated. A packet communication device is provided. Effect of the Invention

[0009] According to the disclosed technique, it becomes possible to appropriately process packets in a packet communication device that distributes packets received from a terminal to one of the one or more paths. [Brief description of the drawings]

[0010] [Figure 1] FIG. 1 is a diagram for explaining an example of a related technique. [Diagram 2] FIG. 1 is a diagram for explaining an example of a related technique. [Diagram 3] FIG. 1 is a diagram for explaining an example of a related technique. [Figure 4] 1 is a diagram illustrating an example of an overall configuration of a system according to an embodiment of the present invention. [Diagram 5] FIG. 2 is a diagram for explaining an outline of the operation of the system according to the embodiment of the present invention. [Figure 6] 13 is a flowchart showing a processing procedure. [Figure 7] FIG. 13 is a diagram illustrating an example of a table. [Figure 8] FIG. 13 is a diagram illustrating an example of a table. [Figure 9] FIG. 1 is a diagram for explaining a first embodiment. [Figure 10] FIG. 1 is a diagram for explaining a first embodiment. [Figure 11] FIG. 13 is a diagram illustrating an example of a method for monitoring DHCP issuance. [Figure 12] FIG. 11 is a diagram for explaining a second embodiment. [Figure 13] FIG. 11 is a diagram for explaining a second embodiment. [Figure 14] FIG. 13 is a diagram for explaining a modified example. [Figure 15] FIG. 2 is a diagram illustrating an example of a functional configuration of a CPE. [Figure 16] FIG. 2 illustrates an example of a functional configuration of an orchestrator. [Figure 17] FIG. 2 illustrates an example of a hardware configuration of the apparatus. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0011] Hereinafter, an embodiment of the present invention (the present embodiment) will be described with reference to the drawings. The embodiment described below is merely an example, and the embodiment to which the present invention is applied is not limited to the following embodiment.

[0012] (About related technologies) Before describing the technology according to the present embodiment, a related technology will be described below. Fig. 1 shows an example of the configuration of a communication system in the related technology.

[0013] As shown in Fig. 1, in this communication system, a base is equipped with a CPE 10. A terminal A is connected to an interface (eth1) of the CPE 10 via a NW1, and a terminal B is connected to an interface (eth2) of the CPE 10 via a NW2. Hereinafter, the interface will be referred to as I / F.

[0014] CPE 10 is connected to virtual router A, virtual router A via carrier network 20. Note that the use of a "virtual router" is just an example, and a "router" may be used instead of a "virtual router". The same applies to the description of the embodiment of the present invention described later.

[0015] A tunnel is constructed between the tunnel I / F (tun0) on eth0 of the CPE and virtual router A, and between the tunnel I / F (tun1) and virtual router B. A tunnel is a virtual path, and may be called a "path." In the description of the related art and the embodiment of the present invention described later, a tunnel may be a tunnel that encapsulates packets, or a tunnel that does not encapsulate packets. For example, a tunnel may be used for communication of packets when QoS control or priority control is performed by assigning a DSCP value or the like to the packets.

[0016] 1, in addition to each I / F, the CPE 10 has a routing unit 11. The routing unit 11 can perform routing based on the input I / F of a packet, the source IP address of the packet, the source port number of the packet, etc., by PBR (Policy-Based Routing).

[0017] For example, in the routing unit 11, by designating a tunnel I / F as an output I / F for a packet having a specific source IP address, the packet can be distributed to a designated tunnel.

[0018] Fig. 2 shows an example of PBR routing rules set in the routing unit 11. In the example shown in Fig. 2, the output I / F is determined based on the input I / F of a packet.

[0019] Another configuration example of the related art is shown in Fig. 3. Compared with Fig. 2, the example shown in Fig. 3 has a different intra-site configuration.

[0020] In the example shown in Figure 3, the base is assumed to be a mass user or SOHO, and the network is small-scale. Since there are restrictions on the functions and installation of CPE and AP, multiple terminals belong to the same network (NW1) as shown in Figure 3. In addition, IP address assignment is managed by DHCP. This configuration has the following issues.

[0021] That is, in the configuration shown in Fig. 3, multiple terminals belong to the same NW, so the input I / F is common between multiple terminals. Therefore, it becomes impossible to distribute packets to each terminal based on the input I / F described with reference to Fig. 2. In addition, since the subnetwork is also common between terminals, distribution by source subnetwork becomes impossible.

[0022] Furthermore, because the IP address of a terminal is dynamically changed by DHCP, when packets are distributed based on the source IP address, it may not be possible to keep up with the change, making it impossible to distribute packets as desired.

[0023] Although it is possible to roughly identify an APL (application) by the port number or payload of a packet, this is not suitable for identifying a terminal, and it is difficult to distribute packets to each terminal by the port number or payload.

[0024] Below, as a technique related to an embodiment of the present invention, a technique that enables appropriate packet distribution even when multiple terminals are connected to the same network and IP addresses are dynamically changed will be described.

[0025] (System configuration example) An example of the overall configuration of a communication system according to this embodiment is shown in Fig. 4. As shown in Fig. 4, the bases in this communication system are bases having small-scale networks such as mass users and SOHOs, as in the case of Fig. 3, and it is assumed that multiple terminals belong to one network and that an IP address is assigned to each terminal by DHCP.

[0026] However, this assumption is merely an example, and the technology according to the present invention can be applied regardless of the network configuration of the base station. For example, the technology according to the present invention can be applied to the configuration shown in FIG.

[0027] The communication system in this embodiment is a system that communicates IP packets over Ethernet (registered trademark) and is assumed to have at least general functions such as ARP, but this is just one example.

[0028] As shown in Fig. 4, a base in the communication system according to the present embodiment is provided with a CPE 100. The CPE 100 may be called a customer equipment in the home, a home gateway, or the like. The CPE 100 may also be called a packet communication device.

[0029] An AP (Access Point) 30 is connected to the CPE 100, and terminals 40 to 60 are connected under the AP 30. The AP 30 is, for example, an access point for a wireless LAN. In Fig. 4, an IoT device 40, a company-provided terminal 50, and a personal terminal 60 are shown as specific examples of the terminals 40 to 60.

[0030] The CPE 100 is connected to a virtual router 610, a virtual router 620, and a virtual router 630 by each tunnel established on the carrier network 20. The virtual router 610 is connected to the Internet 710, the virtual router 620 is connected to the enterprise NW 720, and the virtual router 630 is connected to the MEC 730.

[0031] 4, for example, a packet from a personal terminal 60 is sent to a tunnel that performs best-effort forwarding, and is transmitted to the Internet 710 via the tunnel. A packet from a corporate-provided terminal 50 is sent to a VPN tunnel that performs priority control, and is transmitted to a corporate NW 720 via the tunnel. A packet from an IoT device 40 is sent to a low-latency tunnel that performs priority control, and is transmitted to a MEC (Multi-access Edge Computing) network 730 via the tunnel.

[0032] In this embodiment, even if the IP address is dynamically changed, the routing unit 140 of the CPE 100 can distribute packets for each terminal. The details of the CPE 100 that makes this possible will be described later.

[0033] In order to perform the above processing, an orchestrator 200 is provided to register information in the CPE 100, etc. Also, a service order DB 500 is provided, and the orchestrator 200 can access the service order DB 500. The service order DB 500 may be provided inside the orchestrator 200, or may be provided outside the orchestrator 200.

[0034] The service order DB500 stores, for each user, the portal site account name, service subscription status, IP addresses and API information of the CPE and virtual router, the IP address of the VPN connection destination, and CPE I / F information (I / F name and setting values), etc.

[0035] A user 400 (user terminal, etc.) can input setting information by accessing a portal site 300 (Web server, etc.).

[0036] That is, the user 400 accesses the portal site 300 (customer setting page, etc.) and sets terminal information, service information, etc. The terminal information is, for example, information on the terminal that the user wants to set (MAC address, etc.). The service information is, for example, information on the service that the user wants to set (VPN connection destination, priority, etc.).

[0037] For example, when a user wants to connect a corporate loaned terminal 50 to a business server on a corporate network with high priority via a VPN tunnel, the user accesses the portal site 300 and sets the MAC address of the corporate loaned terminal 50, the connection destination (corporate network), and information instructing the high priority connection.

[0038] The portal site 300 sends the setting information set by the user to the orchestrator 200. The orchestrator 200 acquires user information (CPE IP address, API information, authentication information, etc.) required for setting the CPE 100, CPE setting input information (tunnel interface name, DSCP value, etc.) for the connection destination service, etc., from the service order DB 500 based on the account name of the user who made the setting and the setting information input by the user, and sets the terminal information (MAC address) and the CPE setting input information in the CPE 100. The information set here corresponds to the linking information between the terminal identifier and the connection destination, which will be described later. Necessary settings are also made for the virtual router.

[0039] By configuring the CPE 100 and the like as described above, the user 400 can receive the service he or she has ordered via the portal site 300 .

[0040] (CPE100 configuration, operation, etc.) Fig. 5 is a diagram showing an example of the configuration of a communication system according to the present embodiment, including the internal configuration of the CPE 100. In the example shown in Fig. 5, a base is provided with the CPE 10. Both terminal A and terminal B are connected to the I / F (eth1) of the CPE 100 via the NW1.

[0041] A tunnel is constructed between the tunnel I / F (tun0) on eth0 of the CPE 100 and virtual router A, and between the tunnel I / F (tun1) and virtual router B.

[0042] 5, in addition to the above-mentioned I / Fs, the CPE 100 includes a process 110, a terminal information DB 120, an address information DB 130, and a routing unit 140. The process 110 corresponds to a program executed in the CPE 100. Alternatively, the process 110 corresponds to a functional unit realized by executing a program in the CPE 100.

[0043] The routing unit 140 holds application rules for packet processing such as PBR routing rules, and performs packet processing such as distribution of packets received from terminals to paths, packet filtering, and traffic control according to the application rules. The address information DB 130 is, for example, a DHCP lease table, an ARP table, a Radius server database, etc. The address information DB 130 is not limited to a DHCP lease table, an ARP table, a Radius server database, etc., and may be a table or database other than these. The address information DB 130 may be provided outside the CPE 100, not inside the CPE 100.

[0044] The process 110 has a REST API, and the setting information from the orchestrator 200 is input to each DB etc. via the REST API. The orchestrator 200 may directly input the setting to the CPE 100 using SSH instead of the API. The processing executed by the process 110 will be described with reference to the flowchart of FIG.

[0045] As a premise for the following process, the address information DB 130 stores, for each terminal, information linking the terminal's IP address with the terminal identifier. The linking information is updated if the terminal's IP address is changed. In addition, the routing unit 140 sets PBR routing rules for each terminal based on the IP address acquired by the process 110.

[0046] The use of PBR routing rules as application rules for packet processing in the routing unit 140 is merely one example. ACLs, filtering rules (e.g., iptables, firewall), and traffic control such as bandwidth control and priority control (e.g., traffic control in Linux (registered trademark)) may also be used as application rules for packet processing in the routing unit 140. Rules other than these may also be used as application rules for packet processing in the routing unit 140. Furthermore, the application rules for packet processing in the routing unit 140 may be one or multiple.

[0047] It is possible to process packets (permit, deny, implement NAPT, etc.) based on source / destination IP addresses using filtering rules based on the iptables command. Also, it is possible to process packets (shaping, delay, reordering, etc.) based on source / destination IP addresses using traffic control rules based on the tc (traffic control) command.

[0048] In this embodiment, the MAC address of the terminal is used as the terminal identifier. An example of the association information stored in the address information DB 130 is shown in Fig. 7. An example of a method for acquiring (updating) the association information between the IP address and the terminal identifier will be described in Examples 1 and 2 described later.

[0049] Note that using the MAC address of a terminal as a terminal identifier is one example. As a terminal identifier other than the MAC address, the IMSI or IMEI of a SIM, a terminal host name, etc. may be used. It is possible to link these identifiers other than the MAC address with a protocol that manages IP addresses (Radius, IoT Device discovery, etc.). The following will explain the procedure in FIG. 6. Note that the procedure shown in FIG. 6 is executed repeatedly at a predetermined time interval, for example.

[0050] <s1> In S1, the process 110 acquires, from the orchestrator 200, association information between the MAC address of a terminal and the connection destination (such as an I / F name) of the terminal, and stores the acquired association information in the terminal information DB 120. An example of information stored in the terminal information DB 120 is shown in Fig. 8. In Fig. 8, for example, entry 100 indicates that the MAC address of a certain terminal is associated with tun0.

[0051] <s2> In S2, the process 110 acquires a corresponding IP address for each terminal identifier (MAC address) stored in the terminal information DB 120 by referring to the address information DB 130. That is, the process 110 acquires an IP address assigned to the terminal with the terminal identifier (MAC address). Note that acquiring an IP address by referring to the address information DB 130 is one example.

[0052] <s3> When the process 110 detects that the IP address acquired in S2 for a certain terminal is different from the IP address acquired in the previous S2, the process 110 updates the applicable rules for packet processing for the terminal. Specifically, for example, the process 110 updates the routing rules of PBR.

[0053] For example, if a routing rule for terminal A that "packets with source IP address = AAAA.BBBB.CCCC.DDDD are sent from tun0" is set in routing unit 140, and process 110 detects that the IP address of terminal A has changed from "AAAA.BBBB.CCCC.DDDD" to "AAAA.BBBB.CCCC.EEEE", process 110 updates the routing rule to "packets with source IP address = AAAA.BBBB.CCCC.EEEE are sent from tun0".

[0054] Hereinafter, in the above-mentioned configuration, examples that more specifically explain a method of acquiring information linking an IP address with a terminal identifier (here, a MAC address) will be described as examples 1 and 2.

[0055] Example 1 Fig. 9 shows a configuration example of a communication system in the first embodiment. As shown in Fig. 9, the CPE 100 in the first embodiment includes a DHCP server 150 and a lease table 160 in addition to the I / Fs, the process 110, the terminal information DB 120, and the routing 140 described with reference to Fig. 5. The lease table 160 is an example of the address information DB 130 shown in Fig. 5.

[0056] 9 shows, as an example, a case where the CPE 100 includes a DHCP server 150 and a lease table 160. In the first embodiment, the DHCP server 150 (and the lease table 160) may be provided outside the CPE 100.

[0057] In the first embodiment, the process 110 uses the function of the DHCP server 150 to obtain the IP address assigned to the terminal from the MAC address, and updates the PBR when the IP address is changed. More specifically, see the following examples 1-1 to 1-3.

[0058] <Example 1-1> In Example 1-1, as shown as "Example 1-1" in Fig. 9, the process 110 determines whether or not there is a change in the assigned IP address for each MAC address by monitoring the lease table 160 of the DHCP server 150. Fig. 10 shows an example of information stored in the lease table 160.

[0059] <Example 1-2> In Example 1-2, the DHCP server 150 may be inside the CPE 100 or outside the CPE 100. However, Example 1-2 depends on the functions of the DHCP server 150. Here, it is assumed that the DHCP server 150 has the following functions.

[0060] In Example 1-2, the process 110 obtains an IP address corresponding to the MAC address of the terminal by using an API provided by the DHCP server 150. The process 110 may refer to the setting of a fixed IP in DHCP.

[0061] Furthermore, when the DHCP server 150 assigns an IP address to a terminal, the process 110 may receive from the DHCP server 150 the MAC address of the terminal and the assigned IP address.

[0062] <Example 1-3> In Example 1-3, the DHCP server 150 may be inside the CPE 100 or outside the CPE 100. In Example 1-3, the process 110 detects the assignment of an IP address to a terminal (DHCP client) by snooping messages transmitted between the DHCP server 150 and the terminal.

[0063] FIG. 11 shows an example of message exchange between terminal A and the DHCP server 150. As shown in FIG.

[0064] In S101, terminal A broadcasts DHCP-Discovery. In S102, DHCP server 150, which has received DHCP-Discovery, transmits DHCP-Offer including a proposed IP address to terminal A.

[0065] In S103, terminal A transmits a DHCP-Request to DHCP server 150 to request assignment of the proposed IP address. In S104, DHCP server 150 transmits a DHCP-Acknowledge to terminal A to acknowledge the IP assignment.

[0066] For example, when process 110 detects that a DHCP-Discovery has been sent from a certain terminal, in S103, process 110 monitors the DHCP-Request sent from that terminal and obtains the requested IP address included in the DHCP-Request as the IP address assigned to that terminal by DHCP server 150.

[0067] Example 2 Fig. 12 shows a configuration example of a communication system in the embodiment 2. As shown in Fig. 12, the CPE 100 in the embodiment 2 includes an ARP table 170 in addition to each I / F, process 110, terminal information DB 120, and routing 140 described with reference to Fig. 5. The ARP table 170 is an example of the address information DB 130 shown in Fig. 5.

[0068] Fig. 13 shows an example of information stored in the ARP table 170. As shown in Fig. 13, an I / F, an IP address, and a MAC address are stored in association with each other in the ARP table 170. For example, when the routing unit 140 of the CPE 100 transmits an IP packet to a terminal with an IP address of 192.168.0.10, the routing unit 140 refers to the ARP table 170 and transmits an Ether Frame (including an IP packet) from eth1, the Ether Frame being addressed to the MAC address corresponding to the IP address of 192.168.0.10.

[0069] In the second embodiment, the process 110 uses ARP to obtain an IP address from a MAC address. More specifically, see the following examples 2-1 to 2-2.

[0070] <Example 2-1> In Example 2-1, the process 110 monitors whether the IP address corresponding to each MAC address in the terminal information DB 120 has been updated (changed) by referring to the ARP table 170, and if it detects that the IP address has been updated, it updates the PBR routing rule.

[0071] <Example 2-2> In Example 2-2, the process 110 has a function of RARP (Reverse Address Resolution Protocol). The process 110 broadcasts a request including a MAC address for which the corresponding IP address is to be known, and if the terminal (or server) that receives the request knows the IP address corresponding to the MAC address, it returns the IP address to the process 110.

[0072] The process 110 acquires the corresponding IP address for each MAC address in the terminal information DB 120, for example, periodically using RARP, and updates the routing rules of the PBR when the IP address is changed.

[0073] It should be noted that any procedure (protocol) other than RARP may be used as long as it is capable of finding an IP address from a MAC address.

[0074] (Modification) In the above explanation, the routing unit 140 of the CPE 100 installed at the base performs packet distribution processing, but this configuration is just one example.

[0075] For example, as shown in Fig. 14, a routing unit 740 in a virtual CPE 700 on a cloud service connected to a base CPE 100 via an L2 tunnel may perform packet distribution processing. In the example shown in Fig. 14, the L2 tunnel is, for example, a tunnel of an L2VPN such as L2TP or VXLAN, and the virtual CPE 700 and the CPE 100 are present in the same NW.

[0076] In this example, the virtual CPE 700 has the same configuration (process, terminal information DB, etc.) as the CPE 100 described above, and executes the same processing as the CPE 100 described above. Also, the terminal may have the same configuration (process, terminal information DB, etc.) as the CPE 100 described above, and may be provided with a functional unit that executes the same processing as the CPE 100 described above.

[0077] The devices such as the CPE 100, which performs packet sorting processing and sets and changes applicable rules, the virtual CPE 700, and the functional units of the terminal may be collectively called "packet communication devices."

[0078] (Example of device configuration) Fig. 15 shows an example of the functional configuration of the CPE 100, focusing on the functions of the CPE 100. As shown in Fig. 15, the CPE 100 has a communication unit 101, a routing unit 102, a control unit 103, and a storage unit 104. The virtual CPE 700 also has a similar configuration.

[0079] The communication unit 101 corresponds to the I / F shown in Fig. 5 etc., and transmits and receives packets. The routing unit 102 corresponds to the routing unit 140 shown in Fig. 5 etc., and performs packet distribution processing based on the PBR routing rules. The control unit 103 corresponds to the process 110 shown in Fig. 5 etc., and as explained in the first and second embodiments etc., checks whether the IP address has been changed, and if there has been a change, updates the PBR routing rules in the routing unit 140. The storage unit 104 corresponds to the terminal information DB 120 and address information DB 130 shown in Fig. 5 etc., and stores various data.

[0080] 16 is a diagram illustrating an example of a functional configuration of the orchestrator 200. As illustrated in FIG. 16, the orchestrator 200 includes a setting information acquisition unit 201, a storage unit 202, and a registration unit 203.

[0081] The setting information acquisition unit 201 acquires information set by the user 400 from the portal site 300. The storage unit 202 corresponds to the service order DB 500 shown in Fig. 4. The registration unit 203 transmits (registers) the terminal identifier (MAC address, etc.) and the connection destination (I / F name, etc.) to the CPE 100 (or the virtual CPE 700) based on, for example, the information (terminal identifier (MAC address, etc.)) acquired by the setting information acquisition unit 201 and the information (connection destination (I / F name, etc.)) read from the storage unit 202.

[0082] <Hardware configuration example> The CPE 100, the virtual CPE 700, the orchestrator 200, and the terminal can all be realized by, for example, causing a computer to execute a program. This computer may be a physical computer or a virtual machine.

[0083] That is, the devices (CPE 100, virtual CPE 700, orchestrator 200, terminal) can be realized by executing a program corresponding to the processing performed by the devices using hardware resources such as a CPU and memory built into a computer. The above programs can be recorded on a computer-readable recording medium (such as a portable memory) and stored or distributed. The above programs can also be provided via a network such as the Internet or email.

[0084] Fig. 17 is a diagram showing an example of the hardware configuration of the computer. The computer in Fig. 16 has a drive device 1000, an auxiliary storage device 1002, a memory device 1003, a CPU 1004, an interface device 1005, a display device 1006, an input device 1007, an output device 1008, etc., which are mutually connected via a bus B.

[0085] The program for realizing the processing on the computer is provided by a recording medium 1001 such as a CD-ROM or a memory card. When the recording medium 1001 storing the program is set in the drive device 1000, the program is installed from the recording medium 1001 to the auxiliary storage device 1002 via the drive device 1000. However, the program does not necessarily have to be installed from the computer-readable recording medium 1001, but may be downloaded from another computer via a network. The auxiliary storage device 1002 stores the installed program as well as necessary files, data, etc.

[0086] The memory device 1003 reads out and stores the program from the auxiliary storage device 1002 when an instruction to start the program is received. The CPU 1004 realizes the functions related to the device in accordance with the program stored in the memory device 1003. The interface device 1005 is used as an interface for connecting to a network, and functions as a communication unit. The display device 1006 displays a GUI (Graphical User Interface) or the like according to a program. The input device 1007 is composed of a keyboard and mouse, buttons, a touch panel, or the like, and is used to input various operation instructions. The output device 1008 outputs the results of calculations.

[0087] The computer-readable recording medium may include a recording medium that dynamically holds a program for a short period of time, such as a communication line when transmitting a program via a network such as the Internet or a communication line such as a telephone line, or a recording medium that holds a program for a certain period of time, such as a volatile memory inside a computer system that serves as a server or client in that case. The program may also be for realizing part of the function of the device.

[0088] (Effects of the embodiment) With the technology of this embodiment, when realizing packet processing (tunnel allocation, etc.) for each terminal, even for terminals belonging to the same network, by constantly tracking changes in IP addresses and updating rules, it becomes possible to process and control packets for each terminal regardless of the size of the network or the location of DHCP servers, etc.

[0089] (Summary of the embodiment) This specification discloses at least a packet communication device, a packet processing rule setting method, and a program described in the following sections. (Section 1) A packet communication device connected to one or more paths, a routing unit that distributes a packet received from a terminal to one of the one or more paths; a control unit that acquires an IP address of the terminal and sets an application rule for packet processing in the routing unit based on the IP address; A packet communication device comprising: (Section 2) The application rule for the packet processing is one or more of a routing rule, a filtering rule, and a traffic control rule in PBR. 2. A packet communication device according to claim 1. (Section 3) The control unit monitors whether or not an IP address corresponding to the terminal identifier of the terminal has been changed by referring to a database that holds IP addresses and terminal identifiers, and updates the application rule when the IP address has been changed. 3. A packet communication device according to claim 1 or 2. (Section 4) The control unit acquires an IP address corresponding to a terminal identifier of the terminal from a DHCP server, monitors whether the IP address has been changed, and updates the application rule when the IP address has been changed. 3. A packet communication device according to claim 1 or 2. (Section 5) The control unit obtains an IP address of the terminal by snooping communication between a DHCP server and the terminal, monitors whether the IP address has been changed, and updates the application rule when the IP address has been changed. 3. A packet communication device according to claim 1 or 2. (Section 6) The control unit obtains an IP address corresponding to the terminal identifier of the terminal by using RARP, monitors whether the IP address has been changed, and updates the application rule when the IP address has been changed. 3. A packet communication device according to claim 1 or 2. (Section 7) A packet processing rule setting method executed by a packet communication device connected to one or more paths, comprising: the packet communication device includes a routing unit that distributes a packet received from a terminal to one of the one or more paths; The IP address of the terminal is acquired, and a rule for packet processing in the routing unit is set based on the IP address. How to configure packet processing rules. (Section 8) A program for causing a computer to function as each unit in a packet communication device according to any one of claims 1 to 6.

[0090] Although the present embodiment has been described above, the present invention is not limited to such a specific embodiment, and various modifications and variations are possible within the scope of the gist of the present invention described in the claims. [Explanation of symbols]

[0091] 10, 100 CPE 20 Carrier Network 30 AP 40~60 devices 101 Communications Department 102 Routing section 103 Control section 104 Storage section 110 Process 120 Terminal Information DB 130 Address Information DB 11, 140, 740 Routing section 150 DHCP Server 160 Wreath Table 170 ARP Table 200 Orchestrator 201 Setting information acquisition unit 202 Storage section 203 Registration Department 300 Portal sites 400 users 500 Service Order DB 610~630 Virtual router 700 Virtual CPE 710 Internet 720 Corporate NW 730 MEC 1000 Drive Device 1001 Recording media 1002 Auxiliary storage 1003 Memory device 1004 CPU 1005 Interface device 1006 Display device 1007 Input Device 1008 Output device

Claims

1. A packet communication device connected to a plurality of tunnels, a routing unit that distributes a packet received from a terminal to one of the plurality of tunnels; a control unit that acquires an IP address of the terminal and sets an application rule for packet processing in the routing unit based on the IP address; The control unit acquires an IP address corresponding to the terminal identifier of the terminal by broadcasting a request including the terminal identifier of the terminal, monitors whether the IP address has been changed, and updates the application rule when the IP address has been changed. Packet communication device.

2. The application rule for the packet processing is one or more of a routing rule, a filtering rule, and a traffic control rule in PBR.

2. The packet communication device according to claim 1.

3. A packet processing rule setting method executed by a packet communication device connected to a plurality of tunnels, comprising: the packet communication device includes a routing unit that distributes a packet received from a terminal to one of the plurality of tunnels, a packet processing rule setting method for acquiring an IP address of the terminal, and setting an application rule for packet processing in the routing unit based on the IP address, The packet communication device broadcasts a request including a terminal identifier of the terminal, thereby acquiring an IP address corresponding to the terminal identifier of the terminal, monitors whether the IP address has been changed, and updates the application rule when the IP address has been changed. How to configure packet processing rules.

4. A program for causing a computer to function as each unit in the packet communication device according to claim 1 or 2.

Images