JPH06291776A - Access controller for atm communication - Google Patents

Abstract

PURPOSE:To provide the broad band ISDN with high confidentiality satisfying safety of information. CONSTITUTION:The controller executes access control in an application file level and cell level, a sender side in this access control compares destination address information written to a header part of a cell with address information fed from a transmission enable list section. 9, and only when the destination address information is coincident with the address information of the transmission enable list, the signal is transferred. On the other hand, a receiver side equipment extracts destination address information of a received cell and sender address information and compares the destination address information with self-address information and compares the sender address information and reception enable address information and receives a reception signal when the destination address of the reception signal is coincident with the self-address and the sender address information is coincident with the address information of the reception enable list and the access control is executed in the application level.

Description

Detailed Description of the Invention

[0001]

BACKGROUND OF THE INVENTION The present invention relates to a wide band ISDN (BI).
More particularly, it relates to an access control device for a cell used in an asynchronous transfer mode (ATM).

[0002]

2. Description of the Related Art Currently, research on an asynchronous transfer mode (ATM) is under way as a means for realizing a wideband ISDN for transmitting multimedia signals. In the asynchronous transfer mode (ATM), user information is assembled into fixed length packets called cells, and communication is performed in cell units.
Since a large amount of information is transmitted at a high bit rate of Mbps and the receiving side decomposes received cells to generate information, it is suitable for video / audio signal transfer and high-speed data communication. The communication network in the asynchronous transfer mode is composed of a terminal device such as a personal computer, a terminal adapter (TA), a multiplexing device, an exchange, and a cross connector. The above-mentioned cell disassembly / assembly is a terminal device that transmits / receives information or It runs at the edge of the network. FIG. 4 is a model diagram showing the structure of a cell. User information 25 is assembled into a cell 28 consisting of a header section 26 and an information field section 27, and the header section 26 stores the value of the identifier of the connection to which the cell belongs. To be done. There are a virtual channel identifier (VCI) and a virtual path identifier (VPI) as connection identifiers, and cells are transferred by a predetermined route based on the value of each identifier. In addition, a virtual path may be set according to the VP capacity in the network for effective use of network resources.

FIG. 5 is a block diagram showing a transmission / reception unit of an asynchronous transfer mode communication device in consideration of security. Application files (data and programs) as user information are transmitted from the application execution unit 32 in the CPU board unit 30. The file is input to the application access control unit 34, the transmission permission / reception permission address list described in the application access table unit 36 is referred to, and only the file of the address described in the table unit 36 is assembled / inserted into the header. It is supplied to the section 38 and assembled into a cell in which the address of the receiving side is written in the header section 22. The assembled cell is output to the cell transmitting unit 40 in the next stage, is subjected to electrical / optical conversion, and is optically transmitted to a network composed of optical fibers or the like. On the other hand, on the receiving side, the transmitted cell is received by the cell receiving section 42, and is subjected to optical / electrical conversion and supplied to the header decoder section 44. The header decoder unit 44 decodes the destination address written in the header unit 22 of the received cell,
It is output to the reception address comparison unit 46. When the own address is supplied from the CPU board section 30 to the reception address comparison section 46, the destination address written in the header section 22 of the received cell is compared with the own address, and both addresses match. Signal is output to the access gate unit 48. The access gate unit 48 inputs the signal from the reception address comparison unit 46, and by opening the gate, the reception cell is fetched from the cell reception unit 42 and output to the cell decomposition unit 50 at the next stage. The unit information is decomposed, converted into application format data, and output to the application access control unit 34 in the CPU board unit 30. In the application access control unit 34, the address signal included in the received signal outputs the application file described in the application access table unit 36 to the application executing unit in the next stage, and captures the received signal. In this way, the broadband ISDN in the asynchronous transfer mode can assemble and disassemble user information in cell units and transfer at high speed.
It is indispensable for communication services in the future, and its expectations are increasing. In the asynchronous transfer mode communication device having such a configuration, the application access control unit 34, the application access table 36 unit, and the application execution unit 32 are operating systems and the like in the workstation. It has an independent structure.

On the other hand, maintaining the security of information is an important issue in the information-oriented society, and security has been improved by performing access control at the application level in the above-mentioned wideband ISDN in the asynchronous transfer mode. However, since access control at the application level is performed independently of the asynchronous transfer mode communication network, it is easy for the user to operate, and there is a technology to keep the application access control unit and the application access table unit secret from the user. On the other hand, at the cell level, on the other hand, the call admission judgment is made by comparing the destination address written in the header part of the transferred cell with the own address, so that the data is transmitted to the desired address. As a result, the receiving side may easily tamper with the data, and the transmitting side does not want to transfer the data by mistake or intentionally, that is, the undesired destination is Even if it is specified and data is about to be transferred,
There is a problem that confidential information leakage cannot be prevented because there is no protection measure.

[0005]

SUMMARY OF THE INVENTION The present invention has been made in view of the problems of the communication service in the asynchronous transfer mode as described above. In addition to access control at the application level, cell level access that has a simple structure and can be processed at high speed is provided. By giving the control function to the cell transceiver,
The purpose of the present invention is to provide a broadband ISDN that satisfies the security of information and is highly confidential.

[0006]

SUMMARY OF THE INVENTION To achieve this object, an access control device for an ATM communication device according to the present invention comprises an application level access control section for performing access control at an application level and a cell level access for performing access control at a cell level. A cell address access control unit on the transmission side, wherein the cell level access control unit on the transmission side compares the destination address information written in the header of the cell with the address information supplied from the transmission permission list unit; And the access gate section which operates by the control signal from the transmission address comparison section, and the destination address information written in the header section of the cell matches the address information of the transmission permission list. Open the access gate part only when transferring cells On the other hand, the cell level access control unit on the receiving side extracts the destination address information and the source address information written in the header portion of the cell, compares the destination address information with its own address information, and transmits the transmission. A reception address comparison unit that compares the original address information and the address information supplied from the reception permission list unit; and an access gate unit that operates by the output from the reception address comparison unit while inputting the received cell, Only when the destination address written in the header part of the cell matches its own address and the source address information matches the address information in the reception permission list, the access gate part is opened and the transferred cell is taken in. It is characterized by

[0007]

DESCRIPTION OF THE PREFERRED EMBODIMENTS The present invention will be described below in detail based on the embodiments shown in the drawings. FIG. 1 is a block diagram showing an access control function at an application level and a cell level in an asynchronous transfer mode communication apparatus according to the present invention, in which A is an application level access control unit and B is a cell level access control unit. is there. The application file, which is user information, is supplied from the application execution unit 2 in the CPU board unit 1 to the access control unit 3, and the transmission permission address written in the access table unit 4 and the transmission address of the file input to the access control unit 3 When is matched, the data is supplied to the cell assembly / header insertion unit 5. The cell assembling / header inserting section 5 of the cell level access control section B divides the data into fixed-length information fields, assembles the addresses of communication destinations into cells described in the header section, and then outputs them to the access gate section 6. The cell assembling / header inserting section 5 outputs the header section added to the cell to the header decoder section 7. The header decoder unit 7 decodes the destination address written in the input header unit and outputs the result to the transmission address comparison unit 8. On the other hand, the transmission permission list unit 9 is supplied with an address of a destination to which data may be transmitted from the CPU board 1. In the transmission address comparison unit 8, both addresses inputted from the header decoder unit 7 and the transmission permission list unit 9 are supplied. Information is compared, and a control signal is output to open the gate of the access gate unit 6 only when both address information match. The access gate unit 6 that receives the control signal from the transmission address comparison unit 8 outputs the cellized data to the cell transmission unit 10 in the next stage, and the cell transmission unit 10 performs the electrical / optical conversion of the cell and the network. Optical transmission to. That is, by performing access control at the application level and by collating the destination address information written in the header of the cell with the destination address information listed in the transmission permission list in the transmission address comparison unit 8, Misdelivery can be prevented, and information security can be maintained at a high level.

On the other hand, at the time of reception, the cell transmitted from the network is optically / electrically converted by the cell receiving section 11 and supplied to the header decoder section 12 and the access gate section 13. The header decoder section 12 extracts and decodes the destination address information and the source address information written in the header section of the received cell, and outputs them to the received address comparison section 14. The CPU board unit 1 supplies the reception address comparison unit 14 with the reception address information and the address information of the transmission source that may receive the data transferred via the reception permission list unit 15. In the reception address comparison unit 14, whether or not the destination address information written in the header part of the transferred cell is the same as the address information on the reception side, and the source address information written in the header part of the cell permits reception. Then, the control signal is output to the access gate 13. Therefore, only when the destination address written in the header part of the transferred cell is the same as its own address and the source address is in the list permitting reception, the access gate is opened and the cell is opened. It is taken into the cell disassembly unit 16. The cell disassembling unit 16 combines the information field units of the received cells, converts the data into application file format data, and outputs the data to the access control unit 3 in the CPU board unit 1. The access control unit 3 fetches the received signal into the application execution unit 2 only when the address of the received data matches the address described in the access table unit 4, and completes the data transfer. Thus, at the cell level, the destination and source addresses of the transferred cells are double checked,
Since the call admission control is performed and the access control is also performed at the application level, data is not transferred from an undesired party, that is, a party not listed in the reception permission list, and data tampering is prevented, and information is prevented. Can increase the safety of.

FIG. 2 is a diagram showing an embodiment of the access gate unit 6, the transmission address comparison unit 8 and the transmission permission list unit 9 of the cell level access control unit B in the above-mentioned asynchronous mode communication device. In this embodiment, the case where the address is 4 bits will be described. Transmission permission list section 9
Is composed of an assembly of latch circuits 17, and each latch circuit 17
Addresses to which transmission is permitted are supplied from the CPU board unit 1 to a, 17b, ... That is,
One or more destination addresses to which data may be transmitted are stored in each latch circuit. On the other hand, the transmission address comparison unit 8 includes a plurality of AND gates 18a, 18A, 18
b, 18B ... 18z, 18Z, the 4-bit destination address information output from the header decoder unit 7 is A
It is supplied to the ND gates 18a, 18b ... 18z.
Further, signals are supplied to the AND gates 18a, 18b, ..., 18z from the latches 17a, ..., 17z of the transmission permission list unit 9, and whether or not the destination address of the transfer data matches the address of the transmission permission destination Is collating. Therefore, the destination address of the transfer data is the latch circuit 1
If any of the addresses written in 7a ... 17z matches, then any AND gate 18A ...
18Z output becomes 1 and outputs a signal to the AND gate 20 of the access gate unit 6 via the OR gate 19, and the cellized information data supplied from the cell assembling / header inserting unit 5 is the cell of the next stage not shown. It is output to the transmitter.

FIG. 3 shows an access gate unit 13 on the receiving side.
FIG. 3 is a diagram showing an embodiment of a reception address comparison unit 14 and a reception permission list unit 15. The difference from FIG. 3 described above is that AND gates 21a and 21A and a reception permission list unit for determining whether or not the destination address information of the data transferred in the reception address comparison unit 14 matches its own address. The point is that a latch circuit 22 is newly provided in 15 and an AND gate 23 for receiving the output of the AND gate 21A and the output of the OR gate 19 is newly provided. Further, the destination address information described in the header part of the transferred cell is supplied from the header decoder part 12 to the AND gate 21a, while the AND gates 18a and 18b are supplied.
The source address information described in the header of the transferred cell is supplied to 18z. The CPU board unit 1 writes its own address information in the latch circuit 22, compares the destination address information of the transferred data with the address information written in the latch circuit 22, and latch circuits 17a ... 17z. By comparing the reception allowance list information written in to the transmission source address information of the transferred data, the transfer data is transmitted to its own address, and the transmission source permits reception. The access gate is opened only when the other party, and the information is taken in.

By thus configuring the cell access control function with a simple logic gate, high-speed processing becomes possible, and data communication with a high transfer rate such as wideband ISDN using an asynchronous transfer mode is also supported. Furthermore, since the access control is performed at the application level in the CPU, it is possible to maintain a high level of information security. In the above-described embodiment, the permit list section stores the accessible address. However, conversely, an inaccessible address is used, the reception permit list section is changed to the reception disapproval list section, and the OR gate 19 is used. It is also possible to connect a negative circuit to the interface between the AND gate 23 and the AND gate 23 so that the access-prohibited cells are blocked in the access gate section.

[0012]

Since the present invention is constructed and functions as described above, access control of a cell can be performed by using a simple logic gate, and a communication layer close to a physical layer called a cell. Since access control is performed with, communication security becomes strong, and it exerts a remarkable effect in improving the safety of information.

[0013]

[Brief description of drawings]

FIG. 1 is a block diagram showing an access control function of an asynchronous mode communication device according to the present invention.

FIG. 2 is a diagram showing an embodiment of an access gate unit, a transmission address comparison unit, and a transmission permission list unit.

FIG. 3 is a diagram showing an embodiment of an access gate unit, a reception address comparison unit, and a reception permission list unit.

FIG. 4 is a model diagram showing a configuration of a cell.

FIG. 5 is a block diagram showing a transmission / reception unit of an asynchronous mode communication device in consideration of security.

[Explanation of symbols]

 1 ... CPU board part 2 ... Application execution part 3 ... Access control part 4 ... Access table part 5 ... Cell assembly / header insertion part 6, 13 ... Access gate part 7, 12・ ・ ・ Header decoder unit 8 ・ ・ ・ Transmission address comparison unit 9 ・ ・ ・ Transmission permission list unit 10 ・ ・ ・ Cell transmission unit 11 ・ ・ ・ Cell reception unit 14 ・ ・ ・ Reception address comparison unit 15 ・ ・ ・ Reception permission List section 16 ... Cell disassembly section 17 ... Latch circuit 18, 20, 23 ... AND gate 19 ... OR gate A ... Application level access control section B ... Cell level access control section

Claims (5)

[Claims] 1. Broadband ISDN using asynchronous transfer mode.
2. An access control device for ATM communication, comprising: an application level access control unit that controls access to a file at an application level; and a cell level access control unit that performs access control at a cell level. 2. The cell-level access control unit includes a transmission address comparison unit that compares the destination address information written in the header portion of the cell with the address information supplied from the transmission permission list unit, and is assembled in the cell. It is composed of an access gate unit which is operated by a control signal from the transmission address comparison unit while inputting a signal, and only when the destination address information written in the header portion of the cell matches the address information of the transmission permission list. The access control device for ATM communication according to claim 1, wherein the access gate unit is opened and the cell is transferred. 3. The cell level access control unit extracts the destination address information and the source address information written in the header of the cell, and compares the destination address information with its own address information. A reception address comparison unit that compares the source address information with the address information supplied from the reception permission list unit; and an access gate unit that inputs the received cell and operates by the output from the reception address comparison unit. The transfer gate is opened by opening the access gate part only when the destination address written in the header part of the cell matches its own address and the source address information matches the address information in the reception permit list. The access control device for ATM communication according to claim 1, wherein: 4. A wideband ISDN using an asynchronous transfer mode.
In, the transmission address comparison unit for comparing the destination address information written in the header portion of the cell with the address information supplied from the transmission permission list unit, and the transmission address comparison unit for inputting the signal assembled in the cell Access gate section operated by a control signal from the cell, and the access gate section is opened to transfer the cell only when the destination address information written in the header section of the cell matches the address information of the transmission permission list. Characterized cell access control device. 5. Wideband ISDN using asynchronous transfer mode.
In the means, means for extracting the destination address information and the source address information written in the header part of the cell, and comparing the destination address information with the own address information, and the source address information and the reception permission list part It is provided with a reception address comparison unit that compares the address information supplied from the device and an access gate unit that inputs the received cell and that is operated by the output from the reception address comparison unit. Access to a cell characterized by opening the access gate unit and incorporating the transferred cell only when the destination address matches its own address and the source address information matches the address information of the reception permission list Control device.