Patent Abstract:
A module type node apparatus for packet communication of this invention includes an extension module for executing predetermined processing and a node apparatus main body for forwarding packet data to the extension module, the extension module including a memory for storing connectivity authentication data, and a module controller for transmitting the connectivity authentication data stored in the memory to the node apparatus main body for packet communication when the connectivity authentication data is requested from the node apparatus main body for packet communication, the node apparatus main body for packet communication being characterized by further including a connectivity authentication unit for authenticating permission of connection of the extension module based on the connectivity authentication data received from the extension module, and a connection controller for receiving the packet data from the extension module when the connectivity authentication unit permits the connection.

Full Description:
CLAIM OF PRIORITY  
       [0001]     The present application claims priority from Japanese patent application P2004-305775 filed on Oct. 20, 2004, the content of which is hereby incorporated by reference into this application.  
       BACKGROUND OF THE INVENTION  
       [0002]     This invention relates to a node apparatus for packet communication, which is designed to forward packet data, and more particularly to a technology for complete connection of an extension module.  
         [0003]     Conventionally, the node apparatus for packet communication has a processing unit, a network interface, and a switching unit. The processing unit executes a routing program to create a destination table. The network interface receives and forwards packet data with a network line. The switching unit connects the network interface with another interface.  
         [0004]     Upon reception of a packet, the network interface retrieves internal routing information of the packet from the destination table. Next, the network interface adds the retrieved internal routing information to the packet, and forwards the packet to the switching unit. The switching unit extracts the internal routing information from the forwarded packet. Then, the switching unit forwards the packet to the network interface according to the extracted internal routing information. In this manner, the node apparatus for packet communication forwards the packet.  
         [0005]     Recent popularization of an Internet Protocol (IP) network has heightened a communication speed and further a level of operation. As a result, the node apparatus for packet communication is now required to provide processing functions requested by a user in addition to the basic packet forwarding operation.  
         [0006]     JP 2004-158044 A discloses a conventional technology of providing processing functions required by a user. According to this conventional technology, authenticated program modules are stored in a module server.  
         [0007]     The software program module provides a processing function required by the user. In response to a request from the user, the module server transmits the software program module to the node apparatus for packet communication. Upon reception of the software program module, the node apparatus for packet communication executes the received software program module.  
         [0008]     This conventional technology is characterized by authentication of developers of software programs. Specifically, data of a developer of the software program module is registered in the module server in advance. Then, a digital signature of the developer added to the software program module is compared with the preregistered data of the developer so that the software program module can be authenticated.  
         [0009]     The conventional technology is further characterized by authentication of users who use the software program module. Specifically, the users who utilize the software program module are registered in the module server in advance. Then, the module server transmits the software program module only to node apparatuses for packet communication managed by the registered users.  
       SUMMARY OF THE INVENTION  
       [0010]     However, the following three problems occur in the case of the conventional technology.  
         [0011]     A first problem relates to the fact that data of developers must be registered in the module server when more developers develop software program modules. A second problem relates to the fact that users must be registered when more users use software program modules. A third problem resides in that hardware modules are not be realized.  
         [0012]     It is therefore an object of this invention to provide a node apparatus for packet communication, which can realize processing functions as hardware modules and execute authentication without any need to register data of developers or users.  
         [0013]     A module type node apparatus for packet communication according to a representative embodiment of this invention includes an extension module for executing predetermined processing and a node apparatus main body for forwarding packet data to the extension module, the extension module including a memory for storing connectivity authentication data, and a module controller for transmitting the connectivity authentication data stored in the memory to the node apparatus main body for packet communication when the connectivity authentication data is requested from the node apparatus main body for packet communication, the node apparatus main body for packet communication being characterized by further including a connectivity authentication unit for authenticating permission of connection of the extension module based on the connectivity authentication data received from the extension module, and a connection controller for receiving the packet data from the extension module when the connectivity authentication unit permits the connection.  
         [0014]     According to the representative embodiment of this invention, the extension module whose function, performance and safety are guaranteed can be connected to the node apparatus for packet communication. 
     
    
     BRIEF DESCRIPTION OF THE DRAWINGS  
       [0015]     The present invention can be appreciated by the description which follows in conjunction with the following figures, wherein:  
         [0016]      FIG. 1  is a block diagram of a node apparatus for packet communication according to a first embodiment of this invention;  
         [0017]      FIG. 2  is a configuration diagram showing a structure of an internal packet according to the first embodiment of this invention;  
         [0018]      FIG. 3  is a block diagram of a node control module according to the first embodiment of this invention;  
         [0019]      FIG. 4  is a configuration diagram of a forwarding table according to the first embodiment of this invention;  
         [0020]      FIG. 5  is a configuration diagram of a destination table according to the first embodiment of this invention;  
         [0021]      FIG. 6  is a block diagram of a network interface module according to the first embodiment of this invention;  
         [0022]      FIG. 7  is a block diagram of a module connectivity authentication interface and an extension module according to the first embodiment of this invention;  
         [0023]      FIG. 8  is a configuration diagram an authentication condition table of the module connectivity authentication interface according to the first embodiment of this invention;  
         [0024]      FIG. 9  is a configuration diagram of an authentication answer table of the extension module according to the first embodiment of this invention;  
         [0025]      FIG. 10  is a flowchart of processing of a node control unit according to the first embodiment of this invention;  
         [0026]      FIG. 11  is a flowchart, of processing of the module authentication control unit according to the first embodiment of this invention;  
         [0027]      FIG. 12  is a flowchart of processing of the module control unit according to the first embodiment of this invention;  
         [0028]      FIG. 13  is a block diagram of the module connectivity authentication interface according to a second embodiment of this invention;  
         [0029]      FIG. 14  is a flowchart of processing of the module authentication control unit according to the second embodiment of this invention;  
         [0030]      FIG. 15  is a block diagram of the module connectivity authentication interface and the extension module according to a third embodiment of this invention;  
         [0031]      FIG. 16  is a flowchart of processing of the module authentication control unit of the third embodiment of this invention; and  
         [0032]      FIG. 17  is a flowchart of processing of the module control unit according to the third embodiment of this invention. 
     
    
     DETAILED DESCRIPTION OF THE INVENTION  
       [0033]     Embodiments of this invention will be described below in detail with reference to the accompanying drawings.  
       First Embodiment  
       [0034]      FIG. 1  is a block diagram of a node apparatus for packet communication according to a first embodiment of this invention.  
         [0035]     A node apparatus  1  for packet communication includes a node control module  10 , a switching unit  30 , a plurality of network interface modules  31  to  3   n , and a module connectivity authentication interface  41 . An extension module  51  is connected to the node apparatus  1  for packet communication.  
         [0036]     As described later in detail by referring to  FIG. 3 , the node control module  10  controls the network interface modules  31  to  3   n  and the module connectivity authentication interface  41 .  
         [0037]     The node control module  10  is connected through a signal line L 1  to the network interface modules  31  to  3   n  and the module connectivity authentication interface  41 . It should be noted that through the signal line L 1 , communication of a direction from the node control module  10  to the network interface modules  31  to  3   n  or the module connectivity authentication interface  41  is permitted while communication of an opposite direction is not.  
         [0038]     The node control module  10  is connected through a signal line L 2  to the network interface modules  31  to  3   n . It should be noted that through the signal line L 2 , communication of a direction from the node control module  10  to the network interface modules  31  to  3   n  is permitted while communication of an opposite direction is not.  
         [0039]     Additionally, the node control module  10  is connected through a signal line L 3  to the module connectivity authentication interface  41 . It should be noted that through the signal line L 3 , communication of a direction from the node control module  10  to the module connectivity authentication interface  41  is permitted while communication of an opposite direction is not.  
         [0040]     The module connectivity authentication interface  41  is connected to the extension module  51 . One module connectivity authentication interface  41  is shown, but a plurality thereof may be installed.  
         [0041]     The extension module  51  includes a packet data measuring function. Further, a function, performance and safety thereof must be guaranteed. However, the extension module  51  may include other functions such as video data transcoder function and a data encoder function.  
         [0042]     The network interface module  31  is connected to a network NW 1 . Similarly, the network interface module  3   n  is connected to a network NWn. A server  4  is connected to the network NW 1 . A client  5  is connected to the network NWn. The server  4  transmits an IP packet to the client  5  via the node apparatus  1  for packet communication.  
         [0043]     The switching unit  30  includes an input port and output ports P 10 , P 31  to P 3   n , and P 41 . The switching unit  30  refers to an internal header to forward an internal packet described later by referring to  FIG. 2 . The output port  10  is connected to the node control module  10 , the output ports P 31  to P 3   n  are connected to the network interface modules  31  to  3   n , and the output port P 41  is connected to the module connectivity authentication interface  41 .  
         [0044]      FIG. 2  is a diagram showing a structure of an internal packet according to the first embodiment of this invention.  
         [0045]     An internal packet  90  includes an internal header  901  and an IP packet  902 . The IP packet  902  is packet data which the network interface modules  31  to  3   n  receive from the networks NW 1  to NWn. The internal header  901  stores an output port number (internal address) through which the switching unit  30  outputs a packet.  
         [0046]      FIG. 3  is a block diagram of the node control module  10  according to the first embodiment of this invention.  
         [0047]     The node control module  10  includes an input interface  11 , an output interface  12 , an internal header removing unit  13 , an internal header adding unit  14 , a node control unit  15 , a forwarding table  16 , a destination table  17 , an input unit  18 , a display unit  19 , and a memory  20 .  
         [0048]     The input interface  11  is connected to the output port P 10  of the switching unit  30  to receive the internal packet  90 . The output interface  12  is connected to the input port of the switching unit  30  to transmit the internal packet  90 .  
         [0049]     The internal header removing unit  13  removes the internal header  901  from the internal packet  90  received by the input interface  11 . The internal header adding unit  14  refers to the destination table  17  to add the internal header  901  to the IP packet  902  received from the node control unit  15 .  
         [0050]     The forwarding table  16  described later by referring to  FIG. 4  shows correspondence between flow information of the IP packet  902  and an internal address for the extension module  51  for processing the IP packet  902 . The destination table  17  described later by referring to  FIG. 5  shows correspondence between a destination IP address of the IP packet  902  and the internal address for forwarding.  
         [0051]     The node control unit  15  updates the forwarding and destination tables  16  and  17 . The node control unit  15  that has updated the destination table  17  updates a destination table  318  of the network interface modules  31  to  3   n  and a destination table  415  of the module connectivity authentication interface  41  through the signal line L 1 . Similarly, the node control unit  15  that has updated the forwarding table  16  updates a forwarding table  317  of the network interface modules  31  to  3   n  through the signal line L 2 .  
         [0052]     The input unit  18  receives information from an administrator, and transmits the input information to the node control unit  15 . The display unit  19  displays information received from the node control unit  15 . The input and display units  18  and  19  may be interfaces connected to a computer for inputting information to the node control unit  15 .  
         [0053]     The memory  20  stores an IP address or the like of the node control module  10 .  
         [0054]      FIG. 4  shows a structure of the forwarding table  16  according to the first embodiment of this invention.  
         [0055]     The forwarding table  16  includes flow definition information  60 A and an internal address  60 B.  
         [0056]     The flow definition information  60 A is flow information of the IP packet  902 . For example, the flow definition information  60 A contains a destination IP address and a transmission source IP address. The internal address  60 B is a number of the output port P 10  or the like through which the switching unit  30  outputs a packet.  
         [0057]     For example, as indicated by an entry  601 , the internal address  60 B of the flow definition  60 A “destination IP address=IP 5 ” is “P 41 ”.  
         [0058]      FIG. 5  shows a structure of the destination table  17  according to the first embodiment of this invention.  
         [0059]     The destination table  17  includes a destination IP address  61 A and an internal address  61 B.  
         [0060]     The destination IP address  61 A is a destination IP address of the IP packet  902 . The internal address  61 B is a number of the output port P 10  or the like through which the switching unit  30  outputs a packet.  
         [0061]      FIG. 6  is a block diagram of the network interface modules  31  to  3   n  according to the first embodiment of this invention.  
         [0062]     Each of the network interface modules  31  to  3   n  includes an output line interface  311 , an input line interface  312 , an input interface  313 , an output interface  314 , an internal header removing unit  315 , a flow control unit  316 , a forwarding table  317 , and a destination table  318 .  
         [0063]     The output line interface  311  is connected to the networks NW 1  to NWn to transmit the IP packet  902 . The input line interface  312  is connected to the networks NW 1  to NWn to receive the IP packet  902 .  
         [0064]     The input interface  313  is connected to the output port P 31  of the switching unit  30  to receive the internal packet  90 . The output interface  314  is connected to the input port of the switching unit  30  to transmit the internal packet  90 .  
         [0065]     The internal header removing unit  315  removes the internal header  901  from the internal packet  90 . The flow control unit  316  refers to the forwarding and destination tables  317  and  318  to add the internal header  901  to the IP packet  902 .  
         [0066]     The forwarding table  317  stores the same contents as those of the forwarding table  16  of the node control module  10  shown in  FIG. 4 , showing correspondence between the flow information of the IP packet  902  and the internal address for the extension module  51  for processing the IP packet  902 . The forwarding table  317  is updated by the node control module  10  through the signal line L 2 .  
         [0067]     The destination table  318  stores the same contents as those of the destination table  17  of the node control module  10  shown in  FIG. 5 , showing correspondence between the destination IP address of the IP packet  902  and the internal address. The destination table  318  is updated by the node control module  10  through the signal line L 1 .  
         [0068]     Next, description will be made of processing when the network interface modules  31  to  3   n  receive IP packets  902  from the networks NW 1  to NWn.  
         [0069]     First, the input line interface  312  receives the IP packet from each of the networks NW 1  to NWn. Then, the input line interface  312  sends received IP packet  902  to the flow control unit  316 .  
         [0070]     The flow control unit  316  that has received the IP packet  902  extracts flow information from a header of the IP packet  902 . Next, the flow control unit  316  retrieves an entry where the extracted flow information matches the flow definition information  60 A from the forwarding table  317 .  
         [0071]     Upon discovery of the matched entry, the flow control unit  316  adds an internal header  901  containing an internal address  60 B of the entry to the IP packet  902 , and sends it to the output interface  314 .  
         [0072]     On the other hand, when no matched entry is discovered, the flow control unit  316  retrieves an entry where the extracted IP address matches a destination address  61 A from the destination table  318 . Next, the flow control unit  316  adds an internal header  901  containing an internal address  61 B of the matched entry to the IP packet  902 , and sends it to the output interface  314 .  
         [0073]     The output interface  314  that has received the internal packet  90  forwards it to the switching unit  30 .  
         [0074]      FIG. 7  is a block diagram of the module connectivity authentication interface  41  and the extension module  51  according to the first embodiment of this invention.  
         [0075]     The module connectivity authentication interface  41  includes an input interface  411 , an output interface  412 , an internal header removing unit  413 , an internal header adding unit  414 , a destination table  415 , a module connection sensor  416 , a module authentication control unit  417 , a connection control unit  418 , a connector  419 , and a memory  420 .  
         [0076]     The input interface  411  is connected to the output port P 41  of the switching unit  30  to receive the internal packet  90 . The output interface  412  is connected to the input port of the switching unit  30  to transmit the internal packet  90 .  
         [0077]     The internal header removing unit  413  removes the internal header  901  from the internal packet  90 . The internal header adding unit  414  refers to the destination table  415  to add the internal packet  901  to the IP packet  902 .  
         [0078]     The destination table  415  stores the same contents as those of the destination table  17  of the node control module  10  shown in  FIG. 5 , showing correspondence between the destination IP address of the IP packet  902  and the internal address.  
         [0079]     The connection control unit  418  controls packet reception from the extension module  51 .  
         [0080]     The module authentication control unit  417  authenticates the extension module  51 . The memory  420  stores an authentication condition table or the like described later by referring to  FIG. 8 . The connector  419  is connected to a connector  519  of the extension module  51 .  
         [0081]     The module connection sensor  416  determines whether the extension module  51  is connected or not to the connector  419 , and informs a result of the determination to the module authentication control unit  417 . For example, the module connector sensor  416  is a pressure sensor, an electric sensor, or the like, and only needs to detect connection of the extension module  51  to the connector  419 .  
         [0082]     The extension module  51  includes an input unit  511 , a display unit  512 , a module control unit  513 , a memory  514 , a packet data statistics unit  515 , and a connector  519 .  
         [0083]     The input unit  511  receives information from the administrator, and transmits the input information to the module control unit  513 . The display unit  512  displays the information received from the module control unit  513 . The input and display units  511  and  512  may be interfaces connected to the computer for inputting information to the module control unit  513 .  
         [0084]     The module control unit  513  controls the entire extension module  51 .  
         [0085]     The memory  514  stores an authentication answer table described later by referring to  FIG. 9 , address information, and the like.  
         [0086]     The packet data statistics unit  515  measures the amount of data received from the module connectivity authentication interface  41 .  
         [0087]      FIG. 8  shows a structure of the authentication condition table  63  of the module connectivity authentication interface  41  according to the first embodiment of this invention.  
         [0088]     The authentication condition table  63  includes items  63 A for authentication and conditions  63 B.  
         [0089]     The items  63 A for authentication indicate types of data used for authenticating the extension module  51 . The conditions  63 B indicate conditions for authenticating the extension module  51 .  
         [0090]     As indicated by an entry  630 , a condition  63 B of an item  63 A for authentication “authentication data” is “xyz!?ABC”. As indicated by an entry  631 , a condition  63 B of an item  63 A for authentication “power consumption” is “100 watts or less”.  
         [0091]      FIG. 9  shows a structure of the authentication answer table of the extension module  51  according to the first embodiment of this invention.  
         [0092]     The authentication answer table  64  includes reply items  64 A for authentication and answer data  64 B.  
         [0093]     The reply items  64 A for authentication indicate types of answer data during authentication. The answer data  64 B indicates answer data during the authentication.  
         [0094]     As indicated by an entry  640 , answer data  64 B of a replay item  64 A for authentication “authentication data” is “xyz!?ABC”. As indicated by an entry  641 , answer data  64 B of a reply item  64 A for authentication “power consumption” is “80 watts”.  
         [0095]     Next, processing of each of the node control module  10 , the module connectivity authentication interface  41 , and the extension module  51  will be described in detail.  
         [0096]      FIG. 10  is a flowchart of processing of the node control unit  15  according to the first embodiment of this invention.  
         [0097]     When power is supplied to the node control module  10 , this operation is started (Step  700 ).  
         [0098]     First, the display unit  19  is instructed to display a request of inputting initial setting data (Step  701 ). The display unit  19  that has received the instruction displays a message of the inputting request of the initial setting data.  
         [0099]     Next, determination is made as to reception of data from the input unit  18  or the internal header removing unit  13  (Step  702 ). If the data has not been received, the process stands by until reception.  
         [0100]     Upon reception of the data, determination is made as to whether the received data is destination setting data or not (Step  703 ). The destination setting data contains a destination IP address and an internal address.  
         [0101]     If the received data is destination setting data, determination is made as to presence of the same entry as that of the received data in the destination table  17  (Step  704 ). When entries are discovered where the IP address contained in the received data is identical to a destination IP address  61 A and the internal address contained in the received data is identical to an internal address  61 B, presence of the same entry in the destination table  17  is determined.  
         [0102]     If the same entry is present in the destination table  17 , the received data is discarded, and the process returns to Step  702 .  
         [0103]     On the other hand, if the same entry is not present in the destination table  17 , the received data is stored in the destination table  17 . Further, through the signal line L 1 , the received data is stored in the destination table  318  of each of the network interface modules  31  to  3   n , and the received data is stored in the destination table  415  of the module connectivity authentication interface  41  (Step  705 ). Then, the process returns to Step  702 .  
         [0104]     The administrator can create the destination table  17  by repeatedly inputting the destination setting data to the input unit  18 .  
         [0105]     On the other hand, if the received data is not destination setting data in Step  703 , determination is made as to whether the received data is forwarding setting data or not (Step  706 ). The forwarding setting data contains flow definition information and an internal address.  
         [0106]     If the received data is forwarding setting data, determination is made as to presence of the same entry as that of the received data in the forwarding table  16  (Step  707 ). When entries are discovered where the flow definition information contained in the received data is identical to a flow definition information  60 A, and the internal address contained in the received data is identical to an internal address  60 B, presence of the same entry in the forwarding table  16  is determined.  
         [0107]     If the same entry is present in the forwarding table  16 , the received data is discarded, and the process returns to Step  702 .  
         [0108]     On the other hand, if the same entry is not present in the forwarding table  16 , the received data is stored in the forwarding table  16 . Further, through the signal line L 2 , the received data is stored in the forwarding table  316  of each of the network interface modules  31  to  3   n  (Step  708 ). Then, the process returns to Step  702 .  
         [0109]     On the other hand, if the received data is not forwarding setting data in Step  706 , determination is made as to whether the received data is address setting data of the node control module or not (Step  709 ).  
         [0110]     If the received data is IP address setting data, the received data is stored in the memory  20  (Step  710 ). Then, the process returns to Step  702 .  
         [0111]     On the other hand, if the received data is not address setting data in Step  709 , determination is made as to whether the received data is condition data for authentication or not (Step  711 ). The condition data for authentication contains items for authentication and conditions.  
         [0112]     If the received data is not condition data for authentication, route control processing or the like is executed (Step  713 ), and the process returns to Step  702 .  
         [0113]     On the other hand, if the received data is condition data for authentication, through the signal line L 3 , the received data is transmitted to the module authentication control unit  417  (Step  712 ). Then, the process returns to Step  702 .  
         [0114]     As described above, the node control unit  15  updates the forwarding table  16 , the destination table  17 , and the like.  
         [0115]      FIG. 11  is a flowchart of processing of the module authentication control unit  417  according to the first embodiment of this invention.  
         [0116]     When power is supplied to the module connectivity authentication interface  41 , this operation is started (Step  730 ).  
         [0117]     First, determination is made as to reception of conditions for authentication from the node control unit  15  (Step  731 ). If the conditions for authentication have not been received, the process stands by until reception.  
         [0118]     Upon reception of the conditions for authentication, the received data is stored in the authentication condition table  63  in the memory  420  (Step  732 ).  
         [0119]     Next, based on an output from the module connection sensor  416 , determination is made as to connection of the extension module  51  to the connector  419  (Step  733 ). If the extension module  51  has not been connected, the process stands by until connection.  
         [0120]     Upon determination of the connection of the extension module  51 , a request for module authentication data is transmitted to the module control unit  513  (Step  734 ). The request for module authentication data contains the items  63 A for authentication stored in the authentication condition table  63 .  
         [0121]     Next, determination is made as to reception of the answer data  64 B for authentication from the module control unit  513  (Step  735 ). If the answer data  64 B for authentication has not been received, the process stands by until reception.  
         [0122]     Upon reception of the answer data  64 B for authentication, determination is made as to whether the received answer data  64 B for authentication meets the conditions  63 B of the authentication condition table  63  or not (Step  736 ).  
         [0123]     If the answer data  64 B for authentication does not meet the conditions  63 B, a failure of authentication of the extension module  51  is informed to the module control unit  513  (Step  740 ). Then, the process returns to Step  733 .  
         [0124]     On the other hand, if the answer data  64 B for authentication meets the conditions  63 B, input permission of the IP address of the extension module  51  is informed to the module control unit  513  (Step  737 ). Next, the connection control unit  418  is permitted to receive data form the extension module  51  (Step  738 ). Then, the extension module  51  is instructed to start operation (Step  739 ).  
         [0125]     Next, based on an input from a management console or the like, determination is made as to an end of the operation (Step  741 ).  
         [0126]     If the operation have not ended, the process stands by until the end.  
         [0127]     Upon the end of the operation, by using the module connection sensor  416 , determination is made as to connection of the extension module  51  to the connector  419  (Step  742 ).  
         [0128]     If the extension module  51  has been connected, the process stands by until the extension module  51  is disconnected.  
         [0129]     Upon the disconnection of the extension module  51 , the process returns to Step  733 .  
         [0130]     As described above, the module authentication control unit  417  can authenticate the extension module  51  whose function, performance, and safety are guaranteed.  
         [0131]      FIG. 12  is a flowchart of processing of the module control unit  513  according to the first embodiment of this invention.  
         [0132]     When the extension module  51  is connected to the module connectivity authentication interface  41 , this operation is started (Step  760 ).  
         [0133]     First, determination is made as to reception of a request for module authentication data from the module authentication control unit  417  (Step  761 ). If the request for module authentication data has not been received, the process stands by until reception.  
         [0134]     Upon reception of the request for module authentication data, entries where items  63 A for authentication contained in the received request matches reply items  64 A for authentication are extracted from the authentication answer table  64  in the memory  514 . Next, answer data  64 B of the extracted entries is transmitted to the module authentication control unit  417  (Step  765 ).  
         [0135]     Next, determination is made as to reception of data from the module authentication control unit  417  (Step  766 ). If no data has been received from the module authentication control unit  417 , the process stands by until reception.  
         [0136]     Upon reception of data from the module authentication control unit  417 , determination is made as to whether the received data is input permission of the IP address of the extension module  51  or not (Step  767 ).  
         [0137]     If the received data is not input permission of the IP address of the extension module  51 , determination is made as to whether the received data is notification of a failure of authentication or not (Step  768 ).  
         [0138]     If the received data is not notification of a failure of authentication, the process returns to Step  767 .  
         [0139]     On the other hand, if the received data is notification of a failure of authentication, the display unit  512  is instructed to display the authentication failure (Step  769 ).  
         [0140]     On the other hand, if the data received in Step  767  is input permission of the IP address of the extension module  51 , the display unit  512  is instructed to display an input request of the IP address (Step  770 ).  
         [0141]     Next, determination is made as to whether the IP address has been input or not from the input unit  511  (Step  771 ). If the IP address has not been input from the input unit  511 , the process stands by until its input.  
         [0142]     Upon the input of the IP address from the input unit  511 , the IP address is stored in the memory  514  (Step  772 ). After the storage of the IP address, a request packet for updating the destination tables  17 ,  318  and  415  and the forwarding tables  16  and  317  may be transmitted to the module connectivity authentication interface  41 .  
         [0143]     In place of Steps  770  to  772 , processing for validating the IP address prestored in the memory  514  may be executed.  
         [0144]     Next, the display unit  512  is instructed to display an input request of conditions for statistics (Step  773 ). For example, the conditions for statistics are packet data measuring conditions per unit time, and various conditions used when the amount of data is measured by the packet data statistics unit  515 .  
         [0145]     Next, determination is made as to whether the conditions for statistics have been input or not from the input unit  511  (Step  774 ). If the conditions for statistics have not been input from the input unit  511 , the process stands by until their input.  
         [0146]     Upon the input of the conditions for statistics from the input unit  511 , the input conditions for statistics are set in the packet data statistics unit  515  (Step  775 ). After the setting of the conditions for statistics, the packet data statistics unit  515  starts processing of statistics.  
         [0147]     Next, determination is made as to reception of statistical data from the packet data statistics unit  515  (Step  776 ). The statistical data is a result of the statistical processing of the packet data statistics unit  515 .  
         [0148]     If the statistical data has not been received from the packet data statistics unit  515 , the process stands by until reception.  
         [0149]     Upon reception of the statistical data from the packet data statistics unit  515 , the display unit  512  is instructed to display the received statistical data (Step  777 ).  
         [0150]     Next, based on an input from the input unit  511 , determination is made as to an end of operation (Step  778 ).  
         [0151]     If the operation has not ended, the process returns to Step  776 .  
         [0152]     On the other hand, if the operation ends, this operation ends (Step  779 ).  
         [0153]     As described above, the module control unit  513  transmits authentication information to the module connectivity authentication interface  41 . After the authentication of the extension module  51 , the module control unit  513  instructs the packet data statistics unit  515  to start statistical processing.  
         [0154]     According to the first embodiment, the extension module  51  stores the valid answer data  64 B for authentication only when its function, performance and safety are guaranteed. Thus, by checking the answer data  64 B, the module connectivity authentication interface  41  can prevent connection of an extension module  51  whose function, performance and safety are not guaranteed.  
         [0155]     The node apparatus  1  for packet communication can authenticate connection of an extension module without registering data of a developer or a user.  
         [0156]     Furthermore, the node apparatus  1  for packet communication processes authentication not at the node control module  10  but at the module connectivity authentication interface  41 . As a result, in the node apparatus  1  for packet communication, control of the entire apparatus is not adversely affected even when an illegal extension module  51  is connected. Moreover, no reduction occurs in throughput as the node control module  10  does not process authentication.  
       Second Embodiment  
       [0157]     A node apparatus  1  for packet communication according to a second embodiment determines an abnormality of a connected extension module  51 .  
         [0158]     The node apparatus  1  for packet communication according to the embodiment is similar in configuration to that of the first embodiment except for a module connectivity authentication interface  41 , and thus description thereof will be omitted.  
         [0159]     Upon authentication of the extension module  51 , the module connectivity authentication interface  41  of the first embodiment permits communication with the extension module  51 .  
         [0160]     On the other hand, the module connectivity authentication interface  41  of the second embodiment makes determination as to transmission of abnormal data from the extension module  51  in addition to the operation of the first embodiment. When the abnormal data is sent, the data from the extension module  51  is blocked.  
         [0161]      FIG. 13  is a block diagram of the module connectivity authentication interface  41  according to the second embodiment of this invention.  
         [0162]     The module connectivity authentication interface  41  of the second embodiment includes a monitor unit  421  for output data, a monitor unit  422  for input data, a module monitor unit  423 , and a module authentication control unit  424 . Other components are similar to those of the module connectivity authentication interface  41  of the first embodiment shown in  FIG. 7 . The components similar to those of the first embodiment are denoted by similar reference numerals, and description thereof will be omitted.  
         [0163]     The monitor unit  421  for output data measures the amount of data transmitted to the extension module  51  per unit time, and informs a result of the measurement to the module monitor unit  423 . The monitor unit  422  for input data measures the amount of data received from the extension module  51  per unit time, and informs a result of the measurement to the module monitor unit  423 .  
         [0164]     The module monitor unit  423  compares the results of the measurements of the monitor units  421  and  422  for input and output data with each other to determine an abnormality of the extension module  51 . Specifically, the module monitor unit  423  determines the occurrence of an abnormality in the extension module  51  when a difference between the measuring results is large. It is because the amounts of data to be received and transmitted are equal to each other as the extension module  51  has a function of measuring the amount of data for a specific flow.  
         [0165]     Upon determination of the abnormality of the extension module  51 , the module monitor unit  423  informs the abnormality of the extension module  51  to the module authentication control unit  424 .  
         [0166]     As described below by referring to  FIG. 14 , the module authentication control unit  424  performs authentication and abnormality determination of the extension module  51 .  
         [0167]      FIG. 14  is a flowchart of processing of the module authentication control unit  424  according to the second embodiment of this invention.  
         [0168]     Processing Steps  730  to  740  of the module authentication control unit  424  of the second embodiment are similar to those of the module authentication control unit  417  of the first embodiment, and thus description thereof will be omitted. The similar steps are denoted by similar reference numerals.  
         [0169]     When the extension module  51  is instructed to start operation in Step  739 , determination is made as to reception of an abnormality notification of the extension module  51  from the module monitor unit  423  (Step  743 ).  
         [0170]     If the abnormality notification of the extension module  51  has not been received, the process stands by until reception.  
         [0171]     Upon reception of the abnormality notification of the extension module  51 , a connection control unit  418  is instructed to stop reception of data from the extension module  51  (Step  744 ). Then, this operation ends (Step  745 ).  
         [0172]     As described above, the module connectivity authentication interface  41  determines the abnormality of the extension module  51 . The module connectivity authentication interface  41  may determine the abnormality of the extension module  51  based on other pieces of information such as the number of flows per unit time.  
         [0173]     According to the second embodiment, upon detection of transmission of abnormal data from the extension module  51 , the module connectivity authentication interface  41  stops reception of data from the extension module  51 . As a result, it is possible to prevent transmission of illegal data from the node apparatus  1  for packet communication to the outside.  
         [0174]     For example, even when the extension module  51  is contaminated with viruses, or used as a base for illegal access, an illegal operation of the extension module  51  can be prevented as the module connectivity authentication interface  41  determines the abnormality of the extension module  51 .  
       Third Embodiment  
       [0175]     A node apparatus  1  for packet communication according to a third embodiment authenticates an extension module  51  by checking its function.  
         [0176]     Components of the third embodiment are similar to those of the first embodiment except for a module connectivity authentication interface  41  and an extension module  51 , and thus description thereof will be omitted.  
         [0177]     The module connectivity authentication interface  41  of the first embodiment authenticates the extension module  51  by using the data for authentication.  
         [0178]     On the other hand, the module connectivity authentication interface  41  of the third embodiment transmits packet data for authentication to the extension module  51 . Then, the module connectivity authentication interface  41  authenticates an extension module  51  only where the amount of packet data for authentication can be correctly measured.  
         [0179]      FIG. 15  is a block diagram of the module connectivity authentication interface  41  and the extension module  51  according to the third embodiment of this invention.  
         [0180]     The module connectivity authentication interface  41  of the third embodiment includes a packet generator  425  and a module authentication control unit  426 . Other components are similar to those of the module connectivity authentication interface  41  of the first embodiment shown in  FIG. 7 . The similar components are denoted by similar reference numerals, and description thereof will be omitted.  
         [0181]     The packet generator  425  generates packet data for authentication, and transmits it to the extension module  51 . As described below by referring to  FIG. 16 , the module authentication control unit  426  authenticates the extension module  51 .  
         [0182]     The extension module  51  of the third embodiment includes a module control unit  520 . Other components are similar to those of the extension module  51  of the first embodiment shown in  FIG. 7 . The similar components are denoted by similar reference numerals, and description thereof will be omitted.  
         [0183]     As described below by referring to  FIG. 17 , the module control unit  520  controls the entire extension module.  
         [0184]      FIG. 16  is a flowchart of processing of the module authentication control unit  426  of the third embodiment of this invention.  
         [0185]     When power is supplied to the module connectivity authentication interface  41 , this operation is started (Step  800 ).  
         [0186]     First, based on an output from a module connection sensor  416 , determination is made as to connection of the extension module  51  to a connector  419  (Step  801 ).  
         [0187]     If the extension module  51  has not been connected, the process stands by until connection thereof.  
         [0188]     Upon connection of the extension module  51 , connection permission conditions are transmitted to the module connection control unit  520  (Step  802 ). The connection permission conditions indicate types of function tests to authenticate connection of the extension module  51 , e.g., information of a test as to whether the extension module  51  has a function of measuring the amount of data or not. The type of a function test can be specified by presetting a corresponding number.  
         [0189]     Next, determination is made as to reception of measurement preparation completion data from the extension module  51  (Step  803 ). The measurement preparation completion data indicates that the extension module  51  has completed the function test preparation.  
         [0190]     If the measurement preparation completion data has not been received, the process stands by until reception. Upon reception of the measurement preparation completion data, the packet generator  425  is instructed to transmit packet data for measurement (Step  804 ). However, the amount of packet data for measurement may be instructed by the module authentication control unit  426 , or preset.  
         [0191]     The packet generator  425  that has received the instruction transmits packet data for testing to the extension module  51 . Then, upon completion of the transmission, the packet generator  425  informs the transmission completion of the packet data for measurement to the module authentication control unit  426 .  
         [0192]     Next, determination is made as to reception of the notification of the transmission end of the packet data for measurement from the packet generator  425  (Step  805 ). If the notification of the transmission end of the packet data for measurement has not been received, the process stands by until reception.  
         [0193]     Upon reception of the notification of the transmission end of the packet data for measurement, the received notification is forwarded to the module control unit  520  (Step  806 ).  
         [0194]     Next, determination is made as to reception of measuring result data from the module control unit  520  (Step  807 ). The measuring result data contains the amount of data measured by packet data statistics unit  515 .  
         [0195]     If the measuring result data has not been received, the process stands by until reception. Upon reception of the measuring result data, determination is made as to whether the measuring result data meets authentication conditions or not (Step  808 ). Specifically, when the received measuring result data matches the amount of packet data for authentication, the data is determined to meet the authentication conditions.  
         [0196]     If the measuring result data does not meet the authentication conditions, a failure of authentication of the extension module  51  is informed to the module control unit  520  (Step  809 ), and the process returns to Step  801 .  
         [0197]     On the other hand, if the measuring result data meets the authentication conditions, processing of Steps  737  to  742  is executed. Steps  737  to  742  are similar to those of the module authentication control unit  417  of the first embodiment of this invention shown in  FIG. 11 , and thus description thereof will be omitted.  
         [0198]      FIG. 17  is a flowchart of processing of the module control unit  520  according to the third embodiment of this invention.  
         [0199]     When the extension module  51  is connected to the module connectivity authentication interface  41 , this operation is started (Step  830 ).  
         [0200]     First, determination is made as to reception of connection permission conditions from the module authentication control unit  426  (Step  831 ). If the connection permission conditions have not been received, the process stands by until reception.  
         [0201]     Upon reception of the connection permission conditions, preparation of a function test indicated by the connection permission conditions is started. The function test of the embodiment is for measuring the amount of data transmitted from the module connectivity authentication interface  41 . Accordingly, the packet data statistics unit  515  is instructed to start measurement of the amount of data (Step  832 ).  
         [0202]     Subsequently, measuring preparation completion data is transmitted to the authentication control unit  426  (Step  833 ).  
         [0203]     Next, determination is made as to reception of a notification of a transmission end of packet data for measurement from the module authentication control unit  426  (Step  834 ). If the notification of the transmission end of the packet data for measurement has not been received, the process stands by until reception.  
         [0204]     Upon reception of the notification of the transmission end of the packet data for measurement, the packet data statistics unit  515  is instructed to finish the measurement (Step  835 ).  
         [0205]     Next, determination is made as to reception of the measuring result data from the packet data statistics unit  515  (Step  836 ). If the measuring result data has not been received, the process stands by until reception.  
         [0206]     Upon reception of the measuring result data, the received measuring result data is forwarded to the module authentication control unit  426  (Step  837 ). Thereafter, processing of Steps  767  to  779  is executed. Steps  767  to  797  are similar to those of the module control unit  513  of the first embodiment of this invention shown in  FIG. 12 , and thus description will be omitted.  
         [0207]     According to the third embodiment, the module connectivity authentication interface  41  authenticates an extension module  51  only which satisfies required specifications (function and performance). Thus, it is possible to prevent careless connection of an extension module  51  which does not satisfy the required specifications.  
         [0208]     This invention can be applied to a communication node apparatus which forwards data through a network. By applying the invention, it is possible to completely connect an extension module for executing new processing to the communication node apparatus. For example, the invention can be applied in the case of replacing an extension module for enhancing on-going processing, or in the case of redundantly connecting an extension module for executing the same processing as that of existing processing for enhancing throughput.  
         [0209]     While the present invention has been described in detail and pictorially in the accompanying drawings, the present invention is not limited to such detail but covers various obvious modifications and equivalent arrangements, which fall within the purview of the appended claims.

Technology Classification (CPC): 7