Abstract:
There are provided an apparatus and method for traffic performance improvement and traffic security in an interactive satellite communication system. The method for traffic performance improvement of an interactive satellite communication system includes the steps of: a) storing an Internet protocol (IP) packet that is received from a user terminal connected to a satellite mobile terminal of the interactive satellite communication system and is to be transmitted to a central station through a satellite; b) transmitting acknowledgement for the stored IP packet to the user terminal by acting for the central station, before the stored IP packet is transmitted to the central station; and c) transmitting the stored IP packet through the satellite to the central station, and retransmitting an unacknowledged IP packet according to a retransmission request of the central station.

Description:
FIELD OF THE INVENTION  
       [0001]     The present invention relates to an apparatus and method for traffic performance improvement and traffic security in an interactive satellite communication system; and, more particularly, to an apparatus and method for traffic performance improvement and traffic security in an interactive satellite communication system, in which a process of transmitting/retransmitting an IP packet to be transmitted from a user terminal or a web server of an external network, which is connected to the interactive satellite communication system, through a satellite to a central station or a satellite mobile terminal is performed by acting for the web server of the external network or the user terminal, and a type of traffic is previously inserted into an IP header before an IP packet is encrypted in the satellite mobile terminal, thereby improving the traffic performance in consideration of a quality of service (QoS) and making it possible to apply a security scheme.  
       DESCRIPTION OF RELATED ART  
       [0002]     A conventional interactive satellite communication system does not use a quality of service (QoS) support technique, a technique for transmission control protocol (TCP) traffic performance improvement, an encryption technique for a virtual private network (VPN), and so on. Even though these techniques are used, they are applied independently. Therefore, there is a demand for an integrated system using correlated techniques in the interactive satellite communication system. Problems of the integrated system will now be described.  
         [0003]     When the QoS support technique, the technique for the traffic performance improvement, and the encryption technique for the VPN are simultaneously applied to the integrated interactive satellite communication system, an encrypted TCP header may not be read. Thus, traffics having priorities may not be classified or a spoofing acknowledgment (ACK) may not be processed.  
         [0004]     In order for the QoS, a satellite mobile terminal (SMT) analyzes TCP headers according to types of service and classifies the traffics received from users into Voice of Internet Protocol (VOIP) traffic, web business page traffic, game and moving picture traffic, and other traffic according to the analysis result.  
         [0005]     On the contrary, when Internet Protocol security protocol (IPsec) is applied for the VPN, an IP payload containing a TCP header is encrypted in a third layer of an Open Systems Interconnection (OSI) 7 layer model, that is, a network layer. Therefore, the SMT has difficulty in classifying traffics because it cannot read an encrypted TCP header located in front of the IP payload.  
         [0006]     Like in the QoS, a performance enhancement proxy (PEP) server for TCP performance enhancement analyzes TCP header together with IP header and processes a spoofing ACK for TCP traffic. Because IP packet is encrypted based on IPsec, the SMT has difficulty in reading TCP header.  
         [0007]     When the PEP server and a traffic classifier for QoS are implemented in the same server, the VPN server using the IPsec may be located in a front end or a rear end of the traffic classifier and the PEP server. If the VPN server is located in the front end of the traffic classifier and the PEP server, the traffic classifier and the PEP server cannot perform their functions because of the data encryption.  
         [0008]     On the contrary, if the VPN server is located in the rear end of the traffic classifier and the PEP server, an SMT&#39;s data processing module (DPM) that must perform a resource allocation to the central station according to an amount of IP data classified by the traffic classifier and stored in the respective queues is processed at a kernel of an operating system, e.g., Linux. Therefore, the traffics are transferred through a link layer in an Asynchronous Transfer Mode (ATM) cell or Moving Picture Experts Group 2 transport stream (MPEG2-TS) form without transferring to 3-layer or higher. However, because the IPsec of the VPN server is provided at the 3-layer, it cannot be applied.  
       SUMMARY OF THE INVENTION  
       [0009]     It is, therefore, an object of the present invention to provide an apparatus and method for traffic performance improvement and traffic security in an interactive satellite communication system, in which a process of transmitting/retransmitting an IP packet to be transmitted from a user terminal or a web server of an external network, which is connected to the interactive satellite communication system, through a satellite to a central station or a satellite mobile terminal is performed by acting for the web server of the external network or the user terminal, and a type of traffic is previously inserted into an IP header before an IP packet is encrypted in the satellite mobile terminal, thereby improving the traffic performance in consideration of a quality of service (QoS) or applying a security scheme.  
         [0010]     In accordance with an aspect of the present invention, there is provided a method for traffic performance improvement of an interactive satellite communication system, including the steps of: a) storing an Internet protocol (IP) packet that is received from a user terminal connected to a satellite mobile terminal of the interactive satellite communication system and is to be transmitted to a central station through a satellite; b) transmitting acknowledgement for the stored IP packet to the user terminal by acting for the central station, before the stored IP packet is transmitted to the central station; and c) transmitting the stored IP packet through the satellite to the central station, and retransmitting an unacknowledged IP packet according to a retransmission request of the central station.  
         [0011]     In accordance with another aspect of the present invention, there is provided a traffic security method considering a quality of service (QoS) in an interactive satellite communication system, including the steps of: a) storing an IP packet that is received from a user terminal and is to be transmitted through a satellite to a central station, the user terminal being connected to a satellite mobile terminal of the interactive satellite communication system; b) inserting traffic type information, which is previously stored in a TCP header, into an IP header of the stored IP packet before the stored IP packet is encrypted; c) encrypting an IP payload except the IP header of the stored IP packet; d) classifying the encrypted IP packet according to the traffic type information; and e) requesting a resource allocation of a return link with respect to the classified IP packet to the central station according to a traffic type based priority.  
         [0012]     In accordance with a further another aspect of the present invention, there is provided a method for traffic performance improvement in an interactive satellite communication system, including the steps of: a) storing an Internet protocol (IP) packet that is received from a web server of an external network connected to a central station of the interactive satellite communication and is to be transmitted to a satellite mobile terminal (SMT) through a satellite; b) transmitting acknowledgement for the stored IP packet to the web server of the external network by acting for the satellite mobile terminal, before the stored IP packet is transmitted to the satellite mobile terminal; and c) transmitting the stored IP packet through the satellite to the satellite mobile terminal, and retransmitting an unacknowledged IP packet according to a retransmission request of the satellite mobile terminal.  
         [0013]     In accordance with a still further aspect of the present invention, there is provided an apparatus for traffic performance improvement and traffic security considering a quality of service (QoS) in a satellite mobile terminal of an interactive satellite communication system, including: a performance enhancement proxy (PEP) server for storing an IP packet received from a user terminal, transmitting acknowledgement for the stored IP packet to the user terminal by acting for a central station, retransmitting an unacknowledged IP packet according to retransmission request of the central station, and inserting a traffic type information, which is previously stored in a TCP header, into an IP header of the stored IP packet before the stored IP packet is encrypted; a virtual private network (VPN) server for encrypting an IP payload except the IP header of the IP packet received from the performance enhancement proxy server; a traffic classifier for classifying the encrypted IP packet according to the traffic type information; and a data transmit/receive (TX/RX) module for requesting a resource allocation of a return link with respect to the classified IP packet to the central station.  
         [0014]     In accordance with a yet further aspect of the present invention, there is provided an apparatus for traffic performance improvement and traffic security considering a quality of service (QoS) in a central station of an interactive satellite communication system, including: a performance enhancement proxy (PEP) server for storing an IP packet received from a web server of an external network, transmitting acknowledgement for the stored IP packet to the web server of the external network by acting for a satellite mobile terminal, retransmitting an unacknowledged IP packet according to retransmission request of the satellite mobile terminal; a virtual private network (VPN) server for encrypting an IP payload except the IP header of the IP packet received from the performance enhancement proxy server; and a network resource management module for allocating a network resource considering a priority of a traffic type according to a return link resource request of the satellite mobile terminal.  
         [0015]     The QoS support technique transfers data from the SMT to the central station according to services. The data are classified into VOIP traffic, business web page traffic to which the VPN is applied, game and moving picture traffic, and other traffic. The VOIP traffic providing voice is processed as the highest priority and then the business web traffic, the game or moving picture traffic, and other traffic are processed in this order. Therefore, when the return link resource is allocated in the central station, the traffic having the highest priority is first processed according to the above processing criterion.  
         [0016]     The encryption technique for the VPN applies the IPsec to the network layer, i.e., the third layer of the OSI 7 layer model, in order for the VPN configuration. The encryption technique maintains the IP traffic security by encrypting the payload of the IP header. In order to encrypt the data transmitted through the wireless link of the satellite communication, a forward link transmitted through the central station to the SMT is encrypted in the central station and the encrypted data is decoded in the SMT. On the contrary, the data of the SMT is encrypted in the SMT and the encrypted data is decoded in the central station. Consequently, it can be available in the interactive satellite communication system.  
         [0017]     In addition, the technique for traffic performance improvement includes a geostationary orbit satellite having a round trip time of 500 ms, and a technique for preventing a TCP transmission performance due to a congestion control at a bit error rate (BER) higher than a cable network. Because the data rate in the normal state of the TCP is inversely proportional to the RTT and packet loss rate, the performance is degraded by the excessive congestion control during the TCP traffic transmission. To solve the performance degradation, a PEP server is installed between the cable network and the satellite network. The PEP server stores data packet and performs the retransmission to the receiving side when the retransmission is necessary due to the loss of data link, and generates a spoofing ACK so that the transmitting side cannot perform the congestion control. That is, the congestion control preventing process generates and transmits the spoofing ACK. Therefore, the RTT recognized at the transmitting side is reduced to the RTT of the cable link. Consequently, the TCP performance restriction factor due to the RTT or BER can be removed. 
     
    
     BRIEF DESCRIPTION OF THE DRAWINGS  
       [0018]     The above and other objects and features of the present invention will become apparent from the following description of the preferred embodiments given in conjunction with the accompanying drawings, in which:  
         [0019]      FIG. 1  is a block diagram of an interactive satellite communication system for traffic performance improvement and traffic security in accordance with an embodiment of the present invention;  
         [0020]      FIG. 2  is a block diagram illustrating a traffic classification method based on traffic priority in accordance with an embodiment of the present invention;  
         [0021]      FIG. 3  is a block diagram of an SMT to which the traffic classification method of  FIG. 2  is applied; and  
         [0022]      FIG. 4  is a diagram illustrating a traffic security method considering QoS in an SMT in accordance with an embodiment of the present invention. 
     
    
     DETAILED DESCRIPTION OF THE INVENTION  
       [0023]     Other objects and aspects of the invention will become apparent from the following description of the embodiments with reference to the accompanying drawings, which is set forth hereinafter.  
         [0024]      FIG. 1  is a block diagram of an interactive satellite communication system for traffic performance improvement and traffic security in accordance with an embodiment of the present invention. The interactive satellite communication system can be used as an extended network from a terrestrial external network.  
         [0025]     Referring to  FIG. 1 , the interactive satellite communication system includes a central station  10  and satellite mobile terminals (SMTs)  12 . The central station  10  and the SMTs  12  exchange IP packets through a satellite network. The SMTs  12  provide IP packets received from the central station  10  to user terminals or user PCs  128 .  
         [0026]     The central station  10  includes a performance enhancement proxy (PEP) server  111 , a gateway  112 , a virtual private network (VPN) server  113 , a hub  114 , a network resource management module (NRMM)  115 , a transmitter (TX) module  116 , and a receiver (RX) module  117 . The NRMM  115  includes a dynamic host configuration protocol/network address translator (DHCP/NAT)  1151 , a network management module (NMM)  1152 , and a dynamic resource module (DRM)  1153 . The TX module  116  includes an L-band converter  1161 , a DVB-S modulator  1162 , and an IP encapsulator  1163 . The RX module  117  includes a return link IF module (WIM)  1171 , a return link demodulator (RLD)  1172 , and an RX data processor (RDP)  1173 .  
         [0027]     The respective elements will be described below in detail.  
         [0028]     The PEP server  111  stores IP packets received from a web server of an external network. The PEP server  111  transmits a spoofing ACK to the web server of the external network or retransmits the stored IP packets according to a retransmission request of the SMT when a transmitted link is lost. The PEP server  111  is located between a cable network and a satellite network to perform a retransmission to a receiving side, and prevents a performance degradation of TCP traffic due to a long round trip time (RTT) of the satellite network. The PEP server  111  passes a user datagram protocol (UDP).  
         [0029]     The gateway  112  routes the IP packets received from the PEP server  111 .  
         [0030]     The VPN server  113  encrypts the IP payload but not the IP header of the IP packet stored in the PEP server  111  by using the IPsec. This aims to maintain the traffic security by applying the IPsec to the network layer, i.e., the third layer of the OSI 7 layer model, in order for the VPN configuration.  
         [0031]     The VPN server  113  transmits the encrypted IP packet to the TX module  116 . In order for data protection of satellite periods, the VPN server  113  is located at a position where the analysis of the IP header and the TCP header is completed.  
         [0032]     The hub  114  connects the VPN server  113  to the TX module  116  and transmits IP packet.  
         [0033]     The TX module  116  including the L-band converter  1161 , the DVB-S modulator  1162 , and the IP encapsulator  1163  transmits the IP packet encrypted by the VPN server  113  to the SMT through the satellite network. The RX module  117  receives an IP packet from the SMT through the WIM  1171 , the RLD  1172 , and the RDP  1173 .  
         [0034]     The NRMM  115  performs a network management function, such as dynamic host configuration and network address translation. Specifically, the DRM  1153  allocates return link resources differently according to a resource allocation request of the SMT in each IP traffic. The DRM  1153  allocates the resources according to the resource allocation request in each IP traffic in order from higher priority to lower priority. That is, the VOIP traffic having the highest priority is processed and then the web business traffic, the game or moving picture traffic, and other traffic are processed.  
         [0035]     The SMT  12  includes a data TX/RX module  121 , a network address translation (NAT)  124 , a VPN server  125 , a PEP server  126 , and a hub  127 . The data TX/RX module  121  includes a forward RX module (FRM) or demodulator &amp; decoder for forward link  1211 , a data processing module (DPM)  1212 , and a TDMA TX module (TTM) or modulator &amp; encoder for return link  1213 . The respective elements will now be described in detail.  
         [0036]     The PEP server  126  stores an IP packet among Internet data transmitted from the user PC  128  through the hub  127  and inserts a type of traffic to an IP header of the stored IP packet, based on the services. This process aims to allow the DPM  1212  to request the different resource allocation with respect to the service traffic in order to provide a QoS. The type of the traffic is inserted into a TOS field of the IP header, which is a plaintext. The TOS field is an 8-bit signal value of an IP datagram header indicating or identifying the priority of the individual packets. The priority of the packet is determined using the TOS field and another queue is applied.  
         [0037]     The PEP server  126  analyzes the IP header and the TCP header and transmits a spoofing ACK to the user PC  128  or retransmits the stored IP packet according to a retransmission request of the central station. The PEP server  126  transmits to the VPN server  125  the IP packet in which the type of the traffic is inserted into the IP header.  
         [0038]     The VPN server  125  encrypts the IP packet received from the PEP server  126  by using the IPsec.  
         [0039]     The data TX/RX module  121  transmits/receives the IP packet through the satellite network.  
         [0040]     The VPN server  125  decodes the IP packet received by the data TX/RX module  121 . The VPN server  113  of the central station receives the IP header (plaintext) and the IP payload (ciphertext) and transforms the IP payload encrypted by the VPN server  113  into a plaintext and then transmits it to the user PC  128 .  
         [0041]     The VPN server  125  is used for data protection of a satellite period and is located at a position where the analysis of the IP header and the TCP header is completed.  
         [0042]     The traffic classifier ( 21   FIG. 2 ) analyzes the TOS field of the IP header contained in the IP packet encrypted by the VPN server  125  and classifies the traffics according to the traffic priority. The traffic classifier classifies the traffics into VOIP traffic, web business traffic, game or moving picture traffic, and other traffic and manages the classified traffics in the separate queues. This process aims to allow the DPM  1212  to request different resources according to size of the queue separately classified based on the IP traffics.  
         [0043]     The DPM  1212  requests the resource of the return link channel to the central station  10  according to the classified traffic priority, i.e., the priority of a scheduler ( 22  in  FIG. 2 ). For example, the priority of the scheduler is determined according to an amount of IP data stored in the respective queues.  
         [0044]     The VPN server  125  transforms the plaintext of the IP payload, not the IP header, into the ciphertext, and transmits the ciphertext to the DPM  1212 . The DPM  1212  can analyze only the IP header that is the plaintext. The DPM  1212  classifies the traffics into the VOIP traffic, the web business traffic, game or moving picture traffic, and other traffic according to the TOS field of the IP header and manages the classified traffics in the separate queues. The DPM  1212  requests the resources for the return link channels to the central station  10  according to the scheduler determined by an operator&#39;s policy.  
         [0045]     For example, when the IP packet is the VOIP traffic, the DPM  1212  classifies the IP packet as the traffic having the highest priority and requests the resource allocation in which a constant data rate is secured, and requests the resource allocation in sequence according to the respective priorities.  
         [0046]      FIG. 2  is a block diagram illustrating a traffic classification method based on a traffic priority in accordance with an embodiment of the present invention.  
         [0047]     The traffic classifier  21  classifies the traffics according to the type of service in the SMT  12  in order to provide the QoS, and the scheduler  22  schedules the classified traffics in different queues. That is, the traffic classifier  21  classifies the traffics into VOIP traffic, web business traffic, game or moving picture traffic, and other traffic according to the services and buffers the classified traffics in the corresponding queues. Then, the traffic classifier  21  drives the scheduler  22  according to the user&#39;s request, such that the DPM  1212  request the resource allocation to the DRM  1153  according to the traffics.  
         [0048]      FIG. 3  is a block diagram of the SMT to which the traffic classification method of  FIG. 2  is applied.  
         [0049]     Referring to  FIG. 3 , the SMT  12  includes the PEP server  126 , the VPN server  125 , and the traffic classifier  21 .  
         [0050]     A user Internet traffic of the user PC  128  is transmitted to the DPM  1212  through the hub  127 , the PEP server  126 , the VPN server  125 , and the traffic classifier  21 . The DPM  1212  request the resource allocation to the DRM  1153  and transmits the user Internet traffic to the central station  10  using the allocated resource.  
         [0051]      FIG. 4  is a diagram illustrating a traffic security method considering QoS in an SMT in accordance with an embodiment of the present invention.  
         [0052]     As illustrated in  FIG. 4 , the IP packet processing method of the SMT will be described based on the user Internet traffic, the IP packet in the PEP server  126 , the IP traffic in the VPN server  125 , and the IP traffic in the traffic classifier  21 .  
         [0053]     The user Internet traffic of the user PC  128  includes the IP header and the IP payload. Also, the IP payload includes the TCP header and the datagram.  
         [0054]     The PEP server  126  stores the IP packet received from the user PC  128 , analyzes the IP header and the PCT header of the stored TCP header, sends a spoofing ACK to the user PC  128 , and inserts a type of service traffic into the TOS field of the IP header (plaintext).  
         [0055]     The VPN server  125  receives the IP packet from the PEP server  126  and encrypts only the IP payload of the received IP packet, but not the IP header.  
         [0056]     The DPM  21  analyzes the TOS field of the IP header contained in the IP packet encrypted by the VPN server  125 , classifies the traffics according to the traffic priority, manages the classified traffics in the separate queues, and requests the resource for the return link channel to the central station  10  according to the priority of the scheduler  22 , for example, the priority based on an amount of the IP data stored in the respective queues.  
         [0057]     As described above, the process of transmitting/retransmitting the IP packet to be transmitted from the user terminal or web server of the external network, which is connected to the interactive satellite communication system, through the satellite to the central station or the satellite mobile terminal is performed by acting for the web server of the external network or the user terminal, and the type of traffic is previously inserted into the IP header before the IP packet is encrypted in the satellite mobile terminal, thereby improving the traffic performance in consideration of QoS and making it possible to apply the security scheme.  
         [0058]     That is, the present invention can request the resource allocation of the return link based on the type of service by classifying the traffics according to the type of service, thereby preventing the TCP performance degradation due to the long RTT and securing the QoS.  
         [0059]     The methods in accordance with the embodiments of the present invention can be realized as programs and stored in a computer-readable recording medium that can execute the programs. Examples of the computer-readable recording medium include CD-ROM, RAM, ROM, floppy disks, hard disks, magneto-optical disks and the like.  
         [0060]     The present application contains subject matter related to Korean patent application Nos. 2005-0120189 and 2006-0106523, filed with the Korean Intellectual Property Office on Dec. 8, 2005, and Oct. 31, 2006, respectively, the entire contents of which is incorporated herein by reference.  
         [0061]     While the present invention has been described with respect to certain preferred embodiments, it will be apparent to those skilled in the art that various changes and modifications may be made without departing from the scope of the invention as defined in the following claims.