Communication apparatus for routing or discarding a packet sent from a user terminal

• US 20020016858A1
• Filed: 06/28/2001
• Published: 02/07/2002
• Est. Priority Date: 06/29/2000
• Status: Active Grant

• Current Assignee: Alaxala Networks Corporation (Fortinet Inc.)
• Original Assignee: Hitachi, Ltd.
• Inventors: Nozaki, Shinji, Watanuki, Tatsuya, Sawada, Sunao
• Granted Patent: US 6,907,470 B2
• Time in Patent Office: Days
• US Class Current: 709/238
• CPC Class Codes: H04L 47/32 by discarding or delaying data units, e.g. packets or frames
• CPC Class Codes: H04L 61/10 of different types
• CPC Class Codes: H04L 61/5084 Providing for device mobility network addressing or numbering for mobility support in wireless networks H04W8/26; mobile IP H04W80/04
• CPC Class Codes: H04L 63/0236 Filtering by address, protocol, port number or service, e.g. IP-address or URL
• CPC Class Codes: H04L 63/083 using passwords cryptographic mechanisms or cryptographic arrangements for entity authentication using a predetermined code H04L9/3226
• CPC Class Codes: H04L 69/323 in the physical layer [OSI layer 1]
• CPC Class Codes: H04L 69/325 in the network layer [OSI layer 3], e.g. X.25 H04L69/16 takes precedence

Abstract

A packet communications apparatus of the present invention essentially comprises a plurality of network interfaces (NIFs), a learned address table, a packet forwarding unit (PFU) and a processor for directive packets to change state (PDPCS). The learned address table contains information for identifying a NIF through which to send a packet. The PFU selects a port through which to forward a packet by referring to the learned address table, according to the state of the NIFs, and forwards or discards a packet received from a user terminal. The PDPCS receives a packet including a directive to change the state of a specific NIF to one of the connected state, disconnected state and stateless. The PDPCS changes the state of the specific NIF to one of the connected state, disconnected state and stateless, according to the directive in the packet.

Claims

1. A packet communications apparatus to be used in a network system wherein user terminals that can be linked via a network to said apparatus send/receive packets to/from a server for authentication and a file server connected via a network to said apparatus, comprising:

a plurality of network interfaces;

a learned address table containing information for identifying one of said network interfaces through which to send a packet;

a packet forwarding unit that selects a port through which to forward a packet by referring to said learned address table, according to the state of said network interfaces, and forwards or discards a packet sent from the user terminal, addressed to the server for authentication/file server and vice versa;

a processor for directive packets to change state that receives a directive packet to change state, the packet holding a directive to change the state of a specific network interface to one of the connected state, disconnected state and stateless, via said packet forwarding unit from the server for authentication; and

state managers, each installed in each network interface and each that receives a directive packet to change state from said processor for directive packets to change state and changes the state of the network interface to one of the connected state, disconnected state and stateless, according to the directive packet to change state.

2. The packet communications apparatus according to claim 1, wherein:

said network system further includes a server for address assignment that dynamically leases an address to a user terminal linked to it via a network or networks and a router;

said apparatus further includes a filtering table in which the source address of a packet it received is registered;

said processor for directive packets to change state, upon receiving a directive packet to change state that directs it to register a specific address registered in said filtering table into said learned address table, registers the specific address into the learned address table; and

said apparatus unconditionally forwards a packet whose destination address is registered in the learned address table and forwards a packet whose destination address is registered in said filtering table, but not registered in the learned address table, provided the source address of the packet is the router or the server for authentication.

3. The packet communications apparatus according to claim 1, wherein:

each of said network interfaces further includes a link down detector that finds whether a network link terminated to the interface is now workable;

each of said state managers, when said line down detector detect a link-down, changes the state of the network interface in which the link-down has now been detected to the disconnected state;

each of said state managers, when a user terminal is user-authenticated by said server for authentication, changes the state of the network interface to which the user terminal is linked to the connected state, and

said packet forwarding unit, upon receiving a packet through a network interface set in the disconnected state, does not forward the packet to a network interface set in the disconnected or connected state, but forwards the packet to only a specific network interface, and upon receiving a packet through a network interface set in the connected state, does not forward the packet to a network interface set in the disconnected state.

4. A packet communications apparatus to be used in a network system wherein user terminals that can be linked via a network to said apparatus send/receive packets to/from a server for authentication and a file server connected via a network to said apparatus, comprising:

physical interfaces, each making the connection to a network;

a packet forwarding unit that selects a port through which to forward a packet;

filtering units that perform packet filtering, each located between each of said physical interfaces and the packet forwarding unit and comprising a filtering table containing information for forwarding or discarding a packet and a packet processor that discards a packet or transfers a packet to said packet forwarding unit, according to the contents of said filtering table; and

a processor for directives to change filtering that transfers a directive to change filtering from said server for authentication to the appropriate one of said filtering units, changes the information in the filtering table initially set to discard all received packets, according to the directive from said server for authentication, and sequentially adds information for forwarding such packets to said file server that include the address of a user terminal that has now been user-authenticated by said server for authentication as the source address to said filtering table.

5. A packet communications apparatus to be used in a network system wherein user terminals that can be linked via a network to said apparatus send/receive packets to/from a server for authentication and a file server connected via a network to said apparatus, comprising:

network interfaces for sending/receiving packets to/from the user terminals, the server for authentication and the file server;

an IP address registration table in which the addresses of the user terminals user-authenticated by the server for authentication are registered; and

a packet forwarding unit that forwards a packet whose source address matches an address registered in said IP address registration table and encapsulates a packet whose source address is not registered in the IP address registration table and then sends the encapsulated packet to a specific address.